Third-party licences#

Wheelhouse ships other people's code in three places: modules compiled into the agent binary, libraries bundled into the web UI's JavaScript, and the several thousand Debian and VyOS packages that make up the image. This page lists the first two in full and says where the third is enumerated authoritatively — on the machine, generated from what is actually installed, so it cannot drift. The complete licence texts are not summarised here: they travel with the software, at /usr/share/doc/wheelhouse-agent/copyright and /usr/share/doc/<package>/copyright.

The list is short on purpose. Compiled-in dependencies are permissive only — MIT, BSD-2, BSD-3, ISC, Apache-2.0. Anything weak-copyleft needs a decision recorded in an ADR before it goes in; anything strong-copyleft is out. That rule is why this table fits on a screen and why it can be audited — docs/licenses.md.

Compiled into wheelhouse-agent#

The agent is one static Go binary, so these modules travel inside it and their notices have to travel with it. Versions are from agent/go.mod.

Everything else in the agent is the Go standard library. TOTP (RFC 6238), the Prometheus text exposition format and the op-mode table parsers are implemented in the repository rather than pulled in, because each is small, specified, and cheaper to own than to audit. YAML is the exception, and the reason is written down in ADR-001.

Two notes on the OIDC pair, because both are deliberate. go-oidc is pinned at v3.9.0 rather than the newest release: v3.20 raises the module's minimum Go version to 1.25, which would bump the toolchain for every build. And go-oidc is there precisely because it is not our code — signature verification, alg handling and JWKS rotation are the part of OIDC a hand-rolled implementation gets quietly wrong (ADR-002).

Bundled into the web UI#

The UI is a built bundle, so these are inside the JavaScript files it ships. Declared versions are in ui/package.json; the transitive names are the ones whose notices ship in packaging/copyright.

No runtime dependency is added for charts, icons, dates or state management: ui/src/components/Sparkline.tsx draws SVG directly, icons are inline glyphs, and the data layer is fetch plus two hooks. That keeps the bundle small enough to embed in the agent binary, and keeps this table short enough to be worth reading.

Typefaces#

Both are variable fonts, served from the router itself — the UI fetches nothing from a content delivery network. Each ships beside its own licence text.

JetBrains Mono is used for values that came off the router, which is a distinction the UI makes deliberately: what we wrote is set in Inter, what the router said is set in monospace.

Build-time only, and not shipped#

vite, @vitejs/plugin-react, typescript, tailwindcss, postcss, autoprefixer, playwright-core and the @types/* packages are development dependencies. None of them is in the package, so none is listed in the shipped copyright file.

The base system#

Almost everything on a Wheelhouse OS machine was written by other people and is free software. It is not transcribed into this page, because a transcription would drift from the image. The authoritative list is on the machine — packaging/iso/branding/doc/THIRD-PARTY.txt:

The three headline entries in that file:

• VyOS — GPL-2.0-or-later. The image is built from vyos-build source; the commit is in SOURCES.txt. VyOS is a registered trademark of Sentrium S.L., and this is a self-built image rebranded as upstream's artwork licence requires, not a VyOS release.
• Debian — many licences, one per package.
• The Linux kernel — GPL-2.0, an unmodified Debian/VyOS build.

The routing, DHCP, DNS, VPN and firewall daemons come from Debian and VyOS package repositories unmodified, and their licences are in their own copyright files.

Where the full texts are#

This page is an index. The texts themselves are reproduced in full, unedited, in two places:

Re-deriving this list#

If you want to check the tables above rather than trust them:

cd agent && go list -m all                        # the module graph, versions included
cd ui && npm ls --all --omit=dev                  # the runtime dependency tree
cd ui && npx license-checker --production --summary   # if the tool is available

The repository's own rule is that docs/licenses.md is updated in the same change that adds or removes a dependency, so a difference between that file and go.mod is a bug worth reporting — Support.

See also#

• Built on VyOS — why the compiled-in list is permissive only.
• Corresponding source — the GPL half, and how to obtain its source.
• The Wheelhouse licence — what the parts we wrote are licensed under.
• Files on the router — where each of these lands on disk.

Checked against#

docs/licenses.md · agent/go.mod · ui/package.json · packaging/copyright · packaging/iso/branding/doc/THIRD-PARTY.txt · ui/src/components/AboutPage.tsx · docs/adr/001-desired-state-file.md · docs/adr/002-oidc-client.md