openclaw/deploy/lightpanda

Lightpanda deployment provenance

These files configure an optional, externally managed engine. See the deployment instructions. They do not add an engine binary, container layer, or npm dependency to OpenClaw.

License boundary

OpenClaw's adapter is MIT-licensed. Lightpanda 0.4.1 is AGPL-3.0-or-later, as stated in its source header and license. The engine is independently installed and communicates with OpenClaw over CDP; OpenClaw does not link, vendor, or relicense its implementation. This is not an MIT-only stack or a certification that every deployment is legally compliant. Do not select Lightpanda when your policy excludes copyleft software.

Before redistributing a binary or image, review AGPL sections 4–6, preserve notices, and provide the required complete Corresponding Source. Before serving a modified engine, also review section 13's network-source requirements. Third-party and container-package obligations remain separate. A process or socket boundary alone does not decide whether software forms an independent work; see the GNU aggregation guidance.

Artifact integrity

Reviewed on 2026-09-21:

• Release 0.4.1 resolves to source commit 614c1640af8065b1972559abef7ca4cea06f8ba3.
• SHA256SUMS records all four official Linux/macOS x86-64/ARM64 binary digests. Each matched the corresponding release API digest.
• compose.yaml pins the official multi-platform image index, rather than relying on the version tag alone.

OCI object	SHA-256 digest
Image index	73f67d2dc0bc243f3a8c87065c9871c98b121197baf7b650df5da91b33b98f02
Linux amd64 manifest	a20e5d4671a3c5d4af42eb41c1c451e0aa684b0ea9cfe5fa18901ad82dc9ad88
Linux arm64 manifest	c7b93852d3f40693826209e2763327199bafe50d376fa9b805d90954f8a06de3

Both image engine layers were downloaded and hashed without execution. Their usr/bin/lightpanda contents matched the corresponding Linux binary checksums in SHA256SUMS. The attached SLSA provenance identifies browser-docker commit 844bcb2e3df1aac108f7301edb97f8859edd7e35 and build argument TAG=0.4.1. Neither architecture's attestation manifest included an SPDX or CycloneDX SBOM. This observation is not signature verification or proof of a reproducible build.

That Dockerfile's final stage copies the engine, CA bundle, and Tini; it does not explicitly copy Lightpanda's license, source, or third-party notices. Its engine layers contain only the executable. The sample pulls upstream artifacts directly; it does not establish that mirroring or repackaging them satisfies redistribution obligations.

Existing JavaScript clients

The adapter reuses these pre-existing dependencies without changing package manifests or the lockfile:

Package	Version	License	Verified npm tarball integrity
playwright-core	1.63.0	Apache-2.0	sha512-rYCsBF/M5HjUch52bbtVONEFjv6Xu8sm8h72dNlR5bzIE1fvC/bxgspzkjSfU+MweEMmPM8KJebG6nnyxo5mCg==
ws	8.21.3	MIT	sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==

Downloaded tarball SHA-512 values matched pnpm-lock.yaml. Playwright's package also bundles 79 npm components, including its own ws 8.21.0, plus a WebP codec. Ordinary npm dependency traversal does not inventory this inlined code. Preserve its LICENSE, NOTICE, ThirdPartyNotices.txt, and lib/*.LICENSE files, including the libwebp/Emscripten notices. Preserve ws's LICENSE too. Permissive dependencies can accompany an MIT project without becoming MIT-only.

Engine dependency scope

The pinned Zig dependency manifest and build-tool versions identify these components. This table is a source-level inventory, not a complete binary SBOM or a replacement for their notices.

Component	Pin	License evidence
BoringSSL	535cc391915c37912ff9b3edb0cff9b3c5c77db0	Apache-2.0 root and Zig wrapper; third-party terms remain separate
Brotli	1.2.0, 028fb5a23661f123017c060daa546b55cf4bde29	MIT
curl	8.22.0	curl license
isocline	ec538faf435c616a6b38716f53980b5815c30f8a	MIT
nghttp2	1.69.0	MIT
PCRE2	10.48	BSD-3-Clause WITH PCRE2-exception
SQLite build wrapper	7a615f5af79009cd733e3480658586d9b0d28b35	MIT wrapper; SQLite's own terms are separate
V8	14.9.207.35	BSD-style root and separately licensed components; MIT Zig wrapper
zenai	be5d2e70d3dcc9866041dbdbcfa1f18799601a30	Apache-2.0
zlib	1.3.2	Zlib

The Rust lockfile contains 105 registry packages. All pinned versions' crates.io license metadata was checked: declarations use permissive families including MIT, Apache-2.0, BSD, Zlib, and Unicode-3.0, sometimes in combination. Metadata review does not verify every file in those crates. The bundled fonts have their own Bitstream/DejaVu/Arev notices and naming conditions.

This review does not cover all OpenClaw dependencies, V8's complete third-party closure, platform system libraries, Debian image packages, or availability of complete Corresponding Source for every distributed artifact. Recheck these boundaries and pins when changing the engine version or distribution model.