# Attribution and third-party notice **Inside orch: Building and Operating a Docker Orchestrator in Go** — Aleksandar Popovic, https://www.alekpopovic.com. Copyright © 2026 Aleksandar Popovic. All rights reserved. No new public license is granted for the original manuscript. Source excerpts and third-party materials retain their existing rights and notices. ## Orch source edition Repository: https://github.com/alekpopovic/orch. Exact source baseline: `cbfc94ade5b57e449d6b73bf1485b1c5b1647022`. Every excerpt must preserve bytes and carry its path, symbol, line interval and pinned link. Historical commit associations come from the supplied commit and patch corpus; they are not literal transcripts proving prompts ran. The application snapshot and application-development prompts remain immutable research material and are not automatically public downloadable companion content. ## Dependency provenance The following direct dependencies are declared in the pinned `go.mod` (source versions, not permission grants): - `github.com/docker/docker v28.5.2+incompatible` - `github.com/docker/go-connections v0.8.1` - `github.com/jackc/pgx/v5 v5.10.0` - `github.com/opencontainers/image-spec v1.1.1` - `github.com/prometheus/client_golang v1.24.1` - `github.com/spf13/cobra v1.10.2` - `gopkg.in/yaml.v3 v3.0.1` `go.sum` verifies downloaded module content rather than licensing. No dependency license text is fabricated here. The final companion-material audit must enumerate copied files, exact upstream origin/version, applicable license and retained notice. Standard-library references and external protocol names do not imply endorsement. If no dependency files or binaries are distributed, do not pretend this notice is a vendored-code license bundle. ## Brand and font provenance Existing mark/wordmark sources are `evidence/orch/docs/assets/orch-mark.svg` and `orch-wordmark.svg`; palette source is `docs/BRAND.md` at the pinned SHA. Exact brand asset checksums belong in the design manifest. New geometry must be identified as book composition rather than an unmodified upstream mark. Final exports must record the actually embedded fonts and available license paths. No externally fetched font or image is part of this foundation task. ## Pending release material audit Inspect final PDF font embedding and EPUB media, selected examples, archives and any executable distribution. Retain license notices only when verified; unresolved third-party permission or absent license text blocks distributing that material. The owner's manuscript rights decision is resolved; dependency/material review remains a separate release gate. ## Locally bundled publication fonts DM Sans is copyright 2014 The DM Sans Project Authors. Passion One is copyright 2011 Fontstage, with the reserved font name Passion. Both are distributed under the SIL Open Font License 1.1. Local publication copies are `publication/fonts/dm-sans.ttf` and `publication/fonts/passion-one-bold.ttf`; their retained notices are `dm-sans-OFL.txt` and `passion-one-OFL.txt` in that directory. These font licenses apply to the font software; the original manuscript retains the owner’s All rights reserved decision. The fonts were copied from existing licensed website assets without an external fetch. Final export inspection must separately verify actual embedding. DejaVu Sans Mono is bundled locally for code typography as `publication/fonts/dejavu-sans-mono.ttf`. It retains the installed Bitstream Vera/DejaVu notice in `publication/fonts/dejavu-sans-mono-LICENSE.txt`. DejaVu changes are public domain under that notice; the underlying font includes its retained Bitstream license conditions. No new license is granted by this book for the font software. The bold code face is bundled as `publication/fonts/dejavu-sans-mono-bold.ttf` under the same retained Bitstream Vera/DejaVu notice. Exact historical source listings include emoji symbols; their local fallback is `publication/fonts/noto-color-emoji.ttf`, copyright Google Inc. and Arjen Nienhuis, under SIL Open Font License 1.1 retained in `noto-color-emoji-OFL.txt`. These installed assets are copied locally, without a build-time fetch. ## Completed local-edition material audit — October 13, 2026 The final local candidate’s distributed material was inspected in `validation/publication/material-audit.json`. Its explicit companion traversal contains 152 files: original worked answers, laboratory/exercise guidance and teaching helpers, source-attribution metadata, bounded execution/claim records, fixtures and one source-checked lifecycle diagram. These files do not include vendored Go modules, node modules, compiled application executables or the immutable research snapshot. Teaching programs call pinned application APIs; importing a dependency does not redistribute that dependency’s source or grant its license. Exact source listings retain their immutable source/line attribution. Five locally bundled publication font files retain four verified notice texts: DM Sans and Passion One under their SIL OFL notices; regular and bold DejaVu Sans Mono under the retained Bitstream Vera/DejaVu notice; and Noto Color Emoji under its SIL OFL notice. The final PDF reports 17 embedded Unicode-mapped font subsets from DM, DM-Bold, BookMono, BookMono-Bold and BookEmoji. Passion One cover lettering is outlined rather than an added PDF font substitution. The EPUB embeds the exact catalog cover PNG and checked lifecycle PNG; it contains no font software. Its reflowable text uses reader-selected fonts. The existing Orch mark is embedded unchanged from `docs/assets/orch-mark.svg` at source revision `cbfc94ade5b57e449d6b73bf1485b1c5b1647022`; surrounding cover geometry and outlined book typography are original book composition. The final PDF and EPUB hashes, actual media members, font/notice hashes and every referenced companion are retained in the material audit. No LICENSE/COPYING/NOTICE file was observed in the pinned application snapshot. The owner’s all-rights-reserved instruction covers original manuscript material and adds no new public license to Orch, its contributors’ material or its dependencies. This completed local material audit resolves the earlier pending inventory for the files actually included; it does not claim a vendored transitive-dependency license audit, rights over omitted dependency software, a legal certification, or permission to publish a different bundle. Live deployment remains outside this local candidate.