This repository contains two distinct kinds of material, under two distinct licensing regimes. This document states which is which.
Everything authored in this repository — the package build specifications
(packages/*/build.ncl), build scripts (packages/*/build.sh, patches,
helper files), CI workflows, and tooling — is licensed under the
Apache License, Version 2.0, like the rest of the repository.
A small number of packages (for example minimal-sshd) are programs whose
source code itself lives in this repository; those are likewise Apache-2.0
and declare it in their license_spdx.
Each package built from these recipes packages someone else's software, and that software remains under its own upstream license. Building or distributing a package through this repository's infrastructure does not relicense it.
Every package declares its upstream license as an SPDX expression in its build specification:
attrs = {
license_spdx = "GPL-3.0-or-later",
} | Attrs,Packages without a single meaningful upstream license use either:
- an SPDX expression (
(LGPL-2.1-only AND GPL-2.0-only)) when the artifact combines materials under several licenses; - a
LicenseRef-*identifier for software that is not under an open-source license at all (for exampleLicenseRef-Anthropic-Proprietary) — such packages may carry redistribution restrictions beyond what this document covers.
A few internal aggregate packages (base, toolchain, …) compose many
other packages and intentionally declare no single license; their contents
are governed by the licenses of the packages they aggregate.
Binaries built from these recipes are distributed through a binary cache,
and the source archives they are built from are mirrored (see
gs://minimal-staging-archives). License obligations — carrying copyright
notices and license texts, and for copyleft licenses providing the
corresponding source — attach at that distribution point. The source mirror
holds the exact, content-addressed archives each binary was built from and
serves as the corresponding-source offer for copyleft packages.
Mirror objects are write-once (uploads never overwrite) and the bucket carries a three-year retention policy — the GPLv2 §3(b) written-offer period — so archives cannot be deleted or modified while the offer is live. Retention runs from each object's upload time and is reviewed periodically, since the offer lasts for as long as the corresponding binary is distributed. A weekly automated sweep verifies every distributed copyleft package's exact pinned source is present on the mirror. If public distribution moves to a different endpoint, these obligations follow wherever consumers actually fetch, and the mirror and this policy move with it.
Questions about a specific package's license belong on the package (check
its license_spdx and upstream project) — questions about this
repository's license terms belong with the LICENSE file and the
CLAs under legal/.