Third-party licences#

Wheelhouse ships other people's code in three places: modules compiled into the agent binary, libraries bundled into the web UI's JavaScript, and the several thousand Debian and VyOS packages that make up the image. This page lists the first two in full; the third is enumerated on the machine itself, generated from what is installed. The complete licence texts travel with the software, at /usr/share/doc/wheelhouse-agent/copyright and /usr/share/doc/<package>/copyright.

Compiled-in dependencies are permissive only — MIT, BSD-2, BSD-3, ISC, Apache-2.0. Anything weak-copyleft needs a recorded decision before it goes in; anything strong-copyleft is out.

Compiled into wheelhouse-agent#

The agent is one static Go binary, so these modules travel inside it and their notices travel with it.

Everything else in the agent is the Go standard library. TOTP (RFC 6238), the Prometheus text exposition format and the op-mode table parsers are implemented in the product rather than pulled in.

go-oidc is pinned at v3.9.0 rather than the newest release: v3.20 raises the module's minimum Go version to 1.25, which would move the toolchain under every build.

Bundled into the web UI#

The UI is a built bundle, so these are inside the JavaScript files it ships. The transitive names are the ones whose notices ship in the agent's copyright file.

No runtime dependency is added for charts, icons, dates or state management: the charts are SVG the UI draws, the icons are inline SVG drawn for the product, and the data layer is fetch plus two hooks. The bundle is small enough to ship in the package and serve off the router.

Typefaces#

Both are variable fonts, served from the router itself — the UI fetches nothing from a content delivery network. Each ships beside its own licence text.

The UI sets values that came off the router in JetBrains Mono, and its own words in Inter.

Build-time only, and not shipped#

vite, @vitejs/plugin-react, typescript, tailwindcss, @tailwindcss/postcss, postcss, playwright-core and the @types/* packages are development dependencies. None of them is in the package, so none is listed in the shipped copyright file.

The base system#

Almost everything on a Wheelhouse OS machine was written by other people and is free software. The authoritative list is on the machine rather than on this page, where it would drift from the image:

The three headline entries in that file:

• VyOS — GPL-2.0-or-later. The image is built from vyos-build source; the commit is in SOURCES.txt. VyOS is a registered trademark of Sentrium S.L., and this is a self-built image rebranded as upstream's artwork licence requires, not a VyOS release.
• Debian — many licences, one per package.
• The Linux kernel — GPL-2.0, an unmodified Debian/VyOS build.

The routing, DHCP, DNS, VPN and firewall daemons come from Debian and VyOS package repositories unmodified, and their licences are in their own copyright files.

Where the full texts are#

This page is an index. The texts themselves are reproduced in full, unedited, in two places:

Re-deriving this list#

To check the tables above rather than take them on trust:

cd agent && go list -m all                        # the module graph, versions included
cd ui && npm ls --all --omit=dev                  # the runtime dependency tree
cd ui && npx license-checker --production --summary   # if the tool is available

A difference between what those commands print and the tables above is a bug worth reporting — Support.

See also#

• Built on VyOS — the rules that keep the compiled-in list permissive.
• Corresponding source — the GPL half, and how to obtain its source.
• The Wheelhouse licence — what the proprietary parts are licensed under.
• Files on the router — where each of these lands on disk.