Wheelhouse docs

Corresponding source#

A Wheelhouse OS image contains software licensed under the GNU General Public License and other copyleft licences. You are entitled to the complete corresponding source for those parts, whether or not you got the image from us, and this page is how to get it. There are three routes: the source record published with every release, the upstream packages themselves, and a written offer by post. The proprietary half — the agent, the web UI and the installer — is not covered by any of them, and this page says exactly where that line falls. The offer as shipped is packaging/iso/branding/doc/SOURCE-OFFER.txt, installed on every image at /usr/share/doc/wheelhouse/SOURCE-OFFER.txt.

1. From the release#

Every release publishes a source record beside the image on the download host. Its name is SOURCES-<version>.txt and it lives in that release's directory:

releases.rhymelikedi.me/v<version>/SOURCES-<version>.txt

That is the same URL the product's own System → About page builds and links — ui/src/components/product.ts (sourcesUrl). The current release is at the download host.

The same record is on the machine, at /usr/share/doc/wheelhouse/SOURCES.txt, so it travels with the object code rather than only with the download. The two differ in one respect, for a mechanical reason: the in-image copy is written before the image is built, so it points at /var/lib/dpkg/status for the package versions, while the published copy is written afterwards and carries the full package list — packaging/iso/build-iso.sh.

What the record says#

The shape, with the values a build fills in:

Wheelhouse OS <version> — corresponding source

Base:      https://github.com/vyos/vyos-build @ <commit>
           branch rolling, pinned in packaging/iso/build-iso.sh
Container: vyos/vyos-build:rolling@sha256:<digest>
Agent:     wheelhouse-agent_<version>_amd64.deb (proprietary; a separate program
           driving VyOS over its HTTP API)

Changes to the GPL build tooling, published as vyos-build-wheelhouse-<version>.patch:
  scripts/image-build/build-vyos-image  --iso-application "VyOS" -> "Wheelhouse"
  scripts/image-build/build-vyos-image  --iso-volume "VyOS" -> "WHEELHOUSE"
  scripts/image-build/build-vyos-image  hostname=vyos -> hostname=wheelhouse

Files added to the base, all Wheelhouse's own work and none derived from it:
  data/build-flavors/wheelhouse.toml
  data/live-build-config/hooks/live/50-wheelhouse-brand.binary
  data/live-build-config/hooks/live/50-wheelhouse-brand.chroot
  data/live-build-config/includes.binary/isolinux/splash.png    (replaced)
  data/live-build-config/bootloaders/grub-pc/splash.png         (replaced)
  data/live-build-config/includes.chroot/usr/share/doc/wheelhouse/
  packages/wheelhouse-agent_<version>_amd64.deb

Installed packages:
  <every package and its exact version>

Three things in there are what a source request actually needs: the vyos-build commit, the container digest the build ran in, and the exact version of every installed package.

The build-tooling patch#

Wheelhouse modifies one GPL file, and only in the build tooling rather than in the image. The patch is published with each release as vyos-build-wheelhouse-<version>.patch, is named in the source record, and the build fails outright if the diff comes out empty — so a release cannot quietly ship with the patch unrecorded.

2. From upstream#

Every GPL and LGPL component in the image is an unmodified upstream VyOS or Debian package. Their source is the Debian source package for the version installed:

bash
# on the router: what is installed, and at exactly which version
dpkg-query -W -f='${Package} ${Version}\n' | sort

# on a Debian machine with matching sources, one package's source
apt-get source <package>=<version>

Where the version has aged out of the mirrors, https://snapshot.debian.org keeps them. For the base itself, the source is the vyos-build commit named in the record:

bash
git clone https://github.com/vyos/vyos-build
git -C vyos-build checkout <commit from SOURCES.txt>

3. By post#

For three years from the date you received the image, Wheelhouse will send any third party a copy of the complete corresponding source for the copyleft software in it, on a physical medium, for no more than the cost of performing the distribution. The offer is valid to any third party, whether or not you obtained the image from us. The address to write to is <TODO: owner>.

Include the version — the first line of the console banner, or cat /etc/os-release — so the right build's source is sent.

What the offer does not cover#

The Wheelhouse agent, the web UI and the installer are proprietary and are not derived from any GPL work. They are separate programs that drive the router over its HTTP API and op-mode commands. Their source is not offered. Wheelhouse's position, recorded in docs/licenses.md and enforced by rules the project holds itself to, is that they are separate programs and not derived works — Built on VyOS sets out where that boundary sits, and /usr/share/doc/wheelhouse/THIRD-PARTY.txt says the same on the machine.

The permissively-licensed libraries compiled into the agent and bundled into the UI are a separate matter again: their licences require notices, not source, and those notices ship in full at /usr/share/doc/wheelhouse-agent/copyright — Third-party licences.

Checking any of this yourself#

On a running router, without a network:

bash
cat /usr/share/doc/wheelhouse/SOURCES.txt        # what this image was built from
cat /usr/share/doc/wheelhouse/SOURCE-OFFER.txt   # this offer, verbatim
ls /usr/share/doc/<package>/copyright            # that package's licence and copyright
ls /usr/share/common-licenses/                   # the full GPL, LGPL and Apache texts

The per-package copyright files are generated from the packages actually installed in the image, not transcribed by hand, so they cannot drift from what is on the disk.

See also#

Checked against#

packaging/iso/branding/doc/SOURCE-OFFER.txt · packaging/iso/branding/doc/THIRD-PARTY.txt · packaging/iso/build-iso.sh · packaging/build-deb.py · ui/src/components/product.ts · docs/README.md · CHANGELOG.md

Updated 2026-09-02 gpl source licences legal

Edit this page