Graphene itself is licensed under the LGPL-3.0-or-later.

Graphene also includes the following third party sources (and licenses):

mbedtls crypto libraries - Apache 2.0

Internet Software Consortium (permissive license): Pal/lib/network/inet_pton.c

MIT JOS (mix of MIT and BSD licenses):
* Pal/lib/stdlib/printfmt.c

cJSON - MIT

A number of files taken from other C libraries:
* glibc - LGPL
 ** clone, sysdeps.h (and variants) used in code
 ** Pal/src/host/Linux/clone-x86_64.S
 ** LibOS/shim/include/elf.h
 ** LibOS/shim/src/elf/ - basically the whole directory, and most code related to linking and loading (e.g., Pal/src/db_rtld.c)
 ** Pal/include/elf/elf.h
 ** Pal/include/sysdeps/generic/ldsodefs.h
 ** Pal/include/sysdeps/generic/sysdep.h
 ** Pal/lib/network/hton.c
 ** Pal/lib/string/atoi.c
 ** Pal/lib/string/strchr.c
 ** Pal/lib/string/strlen.c
 ** Pal/src/dynamic_link.h, do-rel.h , dl-machine-x86_64.h
 ** Pal/include/arch/x86_64/Linux/ - whole directory - for signal API definitions
 ** We also build a patched glibc

* musl - MIT
 ** Pal/lib/string/strspn.c
 ** Pal/lib/string/ctype.c
