# Licensing and provenance Pepvoid Builder's original source code is licensed under GPL-3.0-or-later. Third-party software, artwork, themes, icons, and photographs retain their own copyright and license terms; the project license does not relicense those materials. The project tracks known attributions, licenses, and unresolved source records in its root `THIRD_PARTY_NOTICES.md`. That same notice is installed in built systems at `/usr/share/licenses/pepvoid/THIRD_PARTY_NOTICES.md`. Maintainer-confirmed original Pepvoid marks and project logos are listed with SHA-256 digests in {download}`the maintainer confirmation record `. The same GPL-3.0-or-later grant and covered paths are documented in the installed `BRAND-ASSETS-COPYRIGHT.md` notice. It applies only to that listed original artwork, not to adjacent third-party or generic assets. The maintainer also confirmed that project-created Pepvoid Calamares branding and configuration assets are covered by GPL-3.0-or-later; the file hashes are listed in that same record. Embedded or adapted upstream components retain their own notices and license terms. The Pepvoid Calamares `about.qml` adapts the KaOS branding example from Calamares Extensions. It credits Anke Boersma under GPL-3.0-or-later, with PeppermintOS modifications credited separately in the file header. The package templates in `custom_packages/python*/template` were created for this project and are licensed GPL-3.0-or-later. Their `license` metadata fields describe the packaged upstream software rather than the recipe source. The current Calamares recipe is a modified derivative of the Cereus-pkgs recipe at commit `1c16bb52fdc63878e5fd0e58851b23447409c2b9`; the repository's `COPYING` applies BSD-2-Clause terms, and that full text is included in the project and installed notices. Its source history identifies KF-Art and Kevin Figueroa as contributors. The recipe file's SPDX header and the verified asset manifest record this attribution. Its XBPS `license` metadata still describes the Calamares package, which is GPL-3.0-or-later. The initial Pepvoid Builder commit retains an earlier Calamares recipe in Git history. Its exact source was not recorded at the time, but a comparison against the pinned Cereus-pkgs commit now identifies the source: the historical recipe preserves its Qt 6 configuration, metadata structure, dependencies, module exclusions, swap-size patch, and post-install handling, with identifiable Pepvoid changes to version, downloads, dependencies, and target integration. The source template is covered by the repository's BSD-2-Clause `COPYING` at that commit. The historical blob and source blob hashes are recorded in the verified-history section of `licensing/verified-assets.json`. The recovered F-Void Qt 5 template is not the source. The recovered `johna23-lab/calamares-for-fvoid` repository helps rule out one possible source: its template is Calamares 3.2.62/Qt 5, committed by `johna23-lab` on 2023-02-22 (commit `ebefb980acf40ff77a20590c033da6d25a85feb6`), whereas the historical Pepvoid blob is Calamares 3.4.2/Qt 6. The F-Void repository has no license file or license declaration for its template; its README's CC0 notice is scoped to that README. It therefore does not establish the source or license of the historical Pepvoid blob. Its `services-runit.patch` is traceable through the upload commit to the embedded upstream Calamares patch by Artoo; the separate `localecfg.patch` was also uploaded by `johna23-lab`, but carries no distinct author metadata in the patch itself. These attribution facts are recorded for the recovered files without treating them as a license grant for Pepvoid's historical recipe. Third-party assets matched byte-for-byte to pinned public source repositories, including source paths, commits, and licenses, are listed in the {download}`verified asset manifest `. The `bubbles` source also supplies PepTools, Kumo, Plymouth, and older PeppermintOS logo assets used by this project; the manifest identifies the exact files and GPL-3.0 source license. Three modified Calamares icons are attributed to Feather under MIT; the manifest records their source paths and local hashes, and the corresponding license text is shipped with the project. The custom GRUB theme fonts are regenerated from the Terminus 4.49.1 and Ubuntu Font Family 0.83 source packages. Their PF2 family names comply with the respective reserved-name and derivative-naming conditions, and the exact font licenses accompany the installed fonts. Source package and output hashes are recorded in the verified-assets manifest. Explicit unresolved records in the {download}`unresolved asset manifest ` are release blockers until their source/license or redistribution authorization is documented. The release gate also detects tracked and non-ignored untracked payload media that has no verified or maintainer-confirmed record, even if it has not yet been added to the unresolved manifest. Tree-level records cover assets whose upstream license is not established; an individual-file hash list cannot resolve that missing grant. The 26 XPM images used by the IceWM theme were created for Pepvoid and are covered by the maintainer's GPL-3.0-or-later confirmation dated 2026-11-03. Their exact paths and SHA-256 hashes are pinned in `docs/licensing/maintainer-confirmations.json` and checked by the release gate. The 25 current wallpapers are text-only generated assets designated under GPL-3.0-or-later. The previous derivative files have been removed from the payload, and their original photo blobs have been purged from the reviewed Git branch histories. No redistribution rights are claimed for those photographs. Hash-only records of the former paths and blob digests are retained in the {download}`removed-history audit `; tests verify that these Git blobs are not reachable from repository refs. Tela Circle's pinned upstream tag `2022-11-06` includes `COPYING.md`, which explicitly licenses the theme under GPL version 3 and identifies certain embedded SVG artwork, primarily Google Material icons, as Apache License 2.0. Exact copies of this file and the tag's `AUTHORS` file ship with the system in `/usr/share/licenses/pepvoid/upstream/Tela-circle/`; the full GPL-3.0 and Apache-2.0 license texts are also installed. The scope and hashes are recorded in `docs/licensing/verified-assets.json`. We record GPL-3.0-only for Tela Circle, not GPL-3.0-or-later; Pepvoid Builder's own code and marks have their separate GPL-3.0-or-later terms. The tree's Apache exception remains explicit because upstream does not enumerate the individual SVG files. The local tree comparison against upstream tag `2022-11-06` can be reproduced from a clean checkout with: .. code-block:: sh git clone https://github.com/vinceliuice/Tela-circle-icon-theme.git /tmp/tela-circle-upstream git -C /tmp/tela-circle-upstream checkout 19fc7419addfdb768cd60e4c97160cf1ece4c8ca mkdir -p /tmp/tela-circle-generated cd /tmp/tela-circle-upstream DESKTOP_SESSION=xfce bash install.sh -n Tela-circle -d /tmp/tela-circle-generated standard blue green red cd /path/to/pepvoid-builder python3 tools/compare_tela_circle_vendor.py /tmp/tela-circle-generated The comparison excludes generated `icon-theme.cache` files and compares file content hashes and symlink targets. It documents how closely the vendored variants match the pinned source; the GPL and Apache terms come from upstream's `COPYING.md`, not from the comparison. The counts are in `docs/licensing/verified-assets.json`. The tag-triggered release gate validates file-record paths, byte sizes, and SHA-256 hashes; checks copied license sources, verified theme directory patterns, and a deterministic inventory digest of every regular file and symlink in the recorded theme variants; verifies recorded Git-history blobs; and inventories tracked plus non-ignored untracked image, font, archive, and binary assets in the distributable payload directories. Every such asset must be covered by a hash-pinned verified record, maintainer confirmation, verified source tree, or an explicit unresolved blocker. The inventory excludes only generated `icon-theme.cache` files from the Tela tree comparison. Run `python3 tools/check_release_licenses.py` locally before proposing a release tag; exit status `1` means provenance is still unresolved, while status `2` indicates an invalid or stale inventory. The first full tracked-asset audit on 2026-11-03 found 1,207 distributable image, font, and binary assets without verified source, license, or permission evidence. The current ledger contains 1,231 individually hash-pinned verified asset paths, plus a separately verified Tela Circle asset tree. These records include 840 Xfwm theme assets tied to the pinned Marwaita for Xfwm source commit, 200 exact-hash matches and 20 SVG palette derivatives against the pinned Marwaita GTK source, 74 additional exact Marwaita-Teal SVG matches, 23 GTK/Cinnamon stylesheet derivatives with hashes for both the local files and their vendored source counterparts, four Roboto v3.015 font copies, six Comfortaa v3.105 files with corroborating embedded and upstream metadata, and eight Debian Joy Plymouth PNGs with individually recorded source, license, and decoded-pixel evidence. The Joy Plymouth theme is extensively modified for Pepvoid. Its script has 1,175 lines versus 1,106 in the Debian source. Pepvoid changes the splash composition around project artwork, recolors and replaces artwork, adds responsive background scaling and graphite fallback colors, hides the legacy logo sprite, and changes progress, message, and password-prompt placement. Although the retained script structure has about 95% line-level similarity to upstream, that metric does not measure the extent of the visual and behavioral modifications. Attribution and licensing for retained Joy code remain separate from the Pepvoid-created and confirmed artwork. The GNOME welcome illustration is attributed to Jakub Steiner under CC BY-SA 4.0; source artwork and local metadata changes are recorded per theme variant, and the complete license is included. The original Pepvoid workspace placeholder is recorded under GPL-3.0-or-later. The unused misnamed software-center icon was removed from the payload. The replacement text-only wallpaper set is installed. The former wallpaper source-photo blobs were purged from the reviewed branch histories and are recorded separately as hash-only audit evidence. ```{include} ../THIRD_PARTY_NOTICES.md ```