Licensing and provenance

Pepvoid Builder’s original source code is licensed under GPL-3.0-or-later. Third-party software, artwork, themes, icons, and photographs retain their own copyright and license terms; the project license does not relicense those materials.

The project tracks known attributions, licenses, and unresolved source records in its root THIRD_PARTY_NOTICES.md. That same notice is installed in built systems at /usr/share/licenses/pepvoid/THIRD_PARTY_NOTICES.md.

Maintainer-confirmed original Pepvoid marks and project logos are listed with SHA-256 digests in the maintainer confirmation record. The same GPL-3.0-or-later grant and covered paths are documented in the installed BRAND-ASSETS-COPYRIGHT.md notice. It applies only to that listed original artwork, not to adjacent third-party or generic assets. The maintainer also confirmed that project-created Pepvoid Calamares branding and configuration assets are covered by GPL-3.0-or-later; the file hashes are listed in that same record. Embedded or adapted upstream components retain their own notices and license terms. The Pepvoid Calamares about.qml adapts the KaOS branding example from Calamares Extensions. It credits Anke Boersma under GPL-3.0-or-later, with PeppermintOS modifications credited separately in the file header. The package templates in custom_packages/python*/template were created for this project and are licensed GPL-3.0-or-later. Their license metadata fields describe the packaged upstream software rather than the recipe source. The current Calamares recipe is a modified derivative of the Cereus-pkgs recipe at commit 1c16bb52fdc63878e5fd0e58851b23447409c2b9; the repository’s COPYING applies BSD-2-Clause terms, and that full text is included in the project and installed notices. Its source history identifies KF-Art and Kevin Figueroa as contributors. The recipe file’s SPDX header and the verified asset manifest record this attribution. Its XBPS license metadata still describes the Calamares package, which is GPL-3.0-or-later.

The initial Pepvoid Builder commit retains an earlier Calamares recipe in Git history. Its exact source was not recorded at the time, but a comparison against the pinned Cereus-pkgs commit now identifies the source: the historical recipe preserves its Qt 6 configuration, metadata structure, dependencies, module exclusions, swap-size patch, and post-install handling, with identifiable Pepvoid changes to version, downloads, dependencies, and target integration. The source template is covered by the repository’s BSD-2-Clause COPYING at that commit. The historical blob and source blob hashes are recorded in the verified-history section of licensing/verified-assets.json. The recovered F-Void Qt 5 template is not the source.

The recovered johna23-lab/calamares-for-fvoid repository helps rule out one possible source: its template is Calamares 3.2.62/Qt 5, committed by johna23-lab on 2023-02-22 (commit ebefb980acf40ff77a20590c033da6d25a85feb6), whereas the historical Pepvoid blob is Calamares 3.4.2/Qt 6. The F-Void repository has no license file or license declaration for its template; its README’s CC0 notice is scoped to that README. It therefore does not establish the source or license of the historical Pepvoid blob. Its services-runit.patch is traceable through the upload commit to the embedded upstream Calamares patch by Artoo; the separate localecfg.patch was also uploaded by johna23-lab, but carries no distinct author metadata in the patch itself. These attribution facts are recorded for the recovered files without treating them as a license grant for Pepvoid’s historical recipe.

Third-party assets matched byte-for-byte to pinned public source repositories, including source paths, commits, and licenses, are listed in the verified asset manifest. The bubbles source also supplies PepTools, Kumo, Plymouth, and older PeppermintOS logo assets used by this project; the manifest identifies the exact files and GPL-3.0 source license. Three modified Calamares icons are attributed to Feather under MIT; the manifest records their source paths and local hashes, and the corresponding license text is shipped with the project. The custom GRUB theme fonts are regenerated from the Terminus 4.49.1 and Ubuntu Font Family 0.83 source packages. Their PF2 family names comply with the respective reserved-name and derivative-naming conditions, and the exact font licenses accompany the installed fonts. Source package and output hashes are recorded in the verified-assets manifest.

Explicit unresolved records in the unresolved asset manifest are release blockers until their source/license or redistribution authorization is documented. The release gate also detects tracked and non-ignored untracked payload media that has no verified or maintainer-confirmed record, even if it has not yet been added to the unresolved manifest. Tree-level records cover assets whose upstream license is not established; an individual-file hash list cannot resolve that missing grant. The 26 XPM images used by the IceWM theme were created for Pepvoid and are covered by the maintainer’s GPL-3.0-or-later confirmation dated 2026-11-03. Their exact paths and SHA-256 hashes are pinned in docs/licensing/maintainer-confirmations.json and checked by the release gate. The 25 current wallpapers are text-only generated assets designated under GPL-3.0-or-later. The previous derivative files have been removed from the payload, and their original photo blobs have been purged from the reviewed Git branch histories. No redistribution rights are claimed for those photographs. Hash-only records of the former paths and blob digests are retained in the removed-history audit; tests verify that these Git blobs are not reachable from repository refs.

Tela Circle’s pinned upstream tag 2022-11-06 includes COPYING.md, which explicitly licenses the theme under GPL version 3 and identifies certain embedded SVG artwork, primarily Google Material icons, as Apache License 2.0. Exact copies of this file and the tag’s AUTHORS file ship with the system in /usr/share/licenses/pepvoid/upstream/Tela-circle/; the full GPL-3.0 and Apache-2.0 license texts are also installed. The scope and hashes are recorded in docs/licensing/verified-assets.json. We record GPL-3.0-only for Tela Circle, not GPL-3.0-or-later; Pepvoid Builder’s own code and marks have their separate GPL-3.0-or-later terms. The tree’s Apache exception remains explicit because upstream does not enumerate the individual SVG files.

The local tree comparison against upstream tag 2022-11-06 can be reproduced from a clean checkout with:

.. code-block:: sh

git clone https://github.com/vinceliuice/Tela-circle-icon-theme.git /tmp/tela-circle-upstream git -C /tmp/tela-circle-upstream checkout 19fc7419addfdb768cd60e4c97160cf1ece4c8ca mkdir -p /tmp/tela-circle-generated cd /tmp/tela-circle-upstream DESKTOP_SESSION=xfce bash install.sh -n Tela-circle -d /tmp/tela-circle-generated standard blue green red cd /path/to/pepvoid-builder python3 tools/compare_tela_circle_vendor.py /tmp/tela-circle-generated

The comparison excludes generated icon-theme.cache files and compares file content hashes and symlink targets. It documents how closely the vendored variants match the pinned source; the GPL and Apache terms come from upstream’s COPYING.md, not from the comparison. The counts are in docs/licensing/verified-assets.json.

The tag-triggered release gate validates file-record paths, byte sizes, and SHA-256 hashes; checks copied license sources, verified theme directory patterns, and a deterministic inventory digest of every regular file and symlink in the recorded theme variants; verifies recorded Git-history blobs; and inventories tracked plus non-ignored untracked image, font, archive, and binary assets in the distributable payload directories. Every such asset must be covered by a hash-pinned verified record, maintainer confirmation, verified source tree, or an explicit unresolved blocker. The inventory excludes only generated icon-theme.cache files from the Tela tree comparison. Run python3 tools/check_release_licenses.py locally before proposing a release tag; exit status 1 means provenance is still unresolved, while status 2 indicates an invalid or stale inventory.

The first full tracked-asset audit on 2026-11-03 found 1,207 distributable image, font, and binary assets without verified source, license, or permission evidence. The current ledger contains 1,231 individually hash-pinned verified asset paths, plus a separately verified Tela Circle asset tree. These records include 840 Xfwm theme assets tied to the pinned Marwaita for Xfwm source commit, 200 exact-hash matches and 20 SVG palette derivatives against the pinned Marwaita GTK source, 74 additional exact Marwaita-Teal SVG matches, 23 GTK/Cinnamon stylesheet derivatives with hashes for both the local files and their vendored source counterparts, four Roboto v3.015 font copies, six Comfortaa v3.105 files with corroborating embedded and upstream metadata, and eight Debian Joy Plymouth PNGs with individually recorded source, license, and decoded-pixel evidence. The Joy Plymouth theme is extensively modified for Pepvoid. Its script has 1,175 lines versus 1,106 in the Debian source. Pepvoid changes the splash composition around project artwork, recolors and replaces artwork, adds responsive background scaling and graphite fallback colors, hides the legacy logo sprite, and changes progress, message, and password-prompt placement. Although the retained script structure has about 95% line-level similarity to upstream, that metric does not measure the extent of the visual and behavioral modifications. Attribution and licensing for retained Joy code remain separate from the Pepvoid-created and confirmed artwork. The GNOME welcome illustration is attributed to Jakub Steiner under CC BY-SA 4.0; source artwork and local metadata changes are recorded per theme variant, and the complete license is included. The original Pepvoid workspace placeholder is recorded under GPL-3.0-or-later. The unused misnamed software-center icon was removed from the payload. The replacement text-only wallpaper set is installed. The former wallpaper source-photo blobs were purged from the reviewed branch histories and are recorded separately as hash-only audit evidence.

Third-party notices

Pepvoid Builder’s original code is distributed under GPL-3.0-or-later. The repository also contains separate third-party works and assets. Their existing copyright and license notices remain in force; the project license does not replace them.

The repository was previously distributed under the MIT notice naming AçorOS linux, and Pep-Suggested previously carried an MIT notice naming Manuel Rocha. The complete earlier notices are preserved in LICENSES/. This records the licenses attached to earlier releases and preserves their attribution; it does not revoke any rights already granted for those releases. The Pep-Suggested MIT notice is also included under its application payload so it accompanies that separately installed copy.

The maintainer confirmed on 2026-10-28 that Pepvoid and the project-created Calamares branding/configuration were created for this project and belong to PeppermintOS. The specifically covered Pepvoid artwork is listed in configs/custom_files/licenses/pepvoid/BRAND-ASSETS-COPYRIGHT.md and the hash-pinned docs/licensing/maintainer-confirmations.json; it is released under GPL-3.0-or-later. This grant excludes the distinct older pmoS logo variants and third-party artwork. Installer slides and other project-created Calamares assets are included in the confirmation record. The Tela Circle icon tree’s source, license, and comparison evidence are recorded in the verified asset manifest.

Known separately licensed material includes:

The four templates in custom_packages/python*/template were created for this project. Their template source is GPL-3.0-or-later, as recorded with file hashes in docs/licensing/maintainer-confirmations.json. The license field inside each template describes the separately packaged Python project’s upstream license; it is not the license of the template file.
configs/custom_files/plymouth/themes/joy/: derived from Debian’s Joy Plymouth theme and extensively modified by the PeppermintOS Team for Pepvoid. The local joy.script has 1,175 lines compared with Debian desktop-base 13.0.4’s 1,106-line source. Pepvoid changes the splash composition around project artwork, recolors and replaces artwork, adds responsive background scaling and graphite fallback colors, hides the legacy logo sprite, and changes progress, message, and password-prompt placement. The retained script structure has about 95% line-level similarity to upstream; this metric does not measure the extent of the visual and behavioral modifications. Debian’s desktop-base copyright file licenses joy-theme/* under GPL-2-or-later and separately attributes joy.script to Canonical Ltd., Aurélien Couderc, and Jonathan Carter. The license text is included as LICENSES/GPL-2.0.txt. Debian specifically treats its original debian_logo* files as SPI artwork under GPL-3-or-later or CC BY-SA 3.0; the local debian_logo.png and debian_logo16.png visually contain Peppermint branding, so that Debian grant cannot be assumed to cover the replacements. Both local files are byte-for-byte matches for iso_configs/plymouth/peppermint/debian_logo*.png in the PeppermintOS bubbles repository at commit 55c372654ca96cef8cc933f5a9075880b49dcae6, which licenses the assets under GPL-3.0. Their local hashes and source paths are recorded in docs/licensing/verified-assets.json. These files show the older PeppermintOS/pmoS wordmark, distinct from the Pepvoid brand covered by the maintainer confirmation. The local background.png is byte-for-byte identical to the maintainer-confirmed Pepvoid artwork at configs/custom_files/backgrounds/pepvoid.png (SHA-256 343a7775a3d0e8d3a33b6d54c46ec58193c0643e05f5d0f9ffcc90d5db21248c). Its GPL-3.0-or-later grant is recorded in the hash-pinned confirmation; Debian’s Joy theme license is not used to establish rights for this image. Debian’s source copyright inventory is at https://sources.debian.org/src/desktop-base/13.0.4/debian/copyright; the source archive is at https://deb.debian.org/debian/pool/main/d/desktop-base/desktop-base_13.0.4.tar.xz. Its archive SHA-256, source paths, image-content comparisons, and GPL terms are pinned for the eight password/progress PNGs in docs/licensing/verified-assets.json; seven are pixel-identical after PNG decoding, while Pepvoid recolors the eighth and retains its alpha silhouette. The source copyright file and signed .dsc descriptor are included under configs/custom_files/licenses/pepvoid/upstream/Debian-desktop-base-13.0.4/.
configs/custom_files/wsdd/: wsdd by Steffen Christgau, MIT License. The upstream license is included in that directory.
configs/custom_files/fonts/Comfortaa/: Comfortaa version 3.105, SIL Open Font License 1.1, copyright The Comfortaa Project Authors. Every bundled font embeds the version, copyright, and OFL metadata; the upstream source commit is 4aa21cfb7b018629dcf17aab6220e638411c7164, as recorded by the pinned Google Fonts metadata commit 2fe1e8c6b137fb13041a7cfca6fdcd8a910ea4dc. The full upstream notice and license are included as configs/custom_files/fonts/Comfortaa/OFL.txt.
configs/custom_files/desktops/cinnamon*/etc/skel/.fonts/Roboto-*.ttf: Roboto Regular and Medium, version 3.015, from the official hinted static release files. Each file is an exact byte-for-byte copy from the pinned upstream archive; SHA-256 values, the v3.015 source commit, archive digest, and Google Fonts metadata commit are recorded in docs/licensing/verified-assets.json. The embedded metadata identifies the Roboto Project Authors and SIL Open Font License 1.1. The upstream notice and license are included as LICENSES/OFL-Roboto-3.015.txt and installed with the system notices.
configs/custom_files/desktops/cinnamon*/etc/skel/.fonts/CustomTkinter_shapes_font.otf: byte-for-byte matches the font in the official CustomTkinter 5.2.2 source archive (SHA-256 fd8db3bafa961c982ee6030dba80b4c2e25858630756b513986db19113d8d207). The package metadata declares CC0-1.0, and the upstream maintainer explicitly confirmed CC0 for the library in https://github.com/TomSchimansky/CustomTkinter/discussions/615. The source archive also includes an MIT LICENSE; both license texts are preserved in the project and installed system notices. Per-file hashes and source details are in docs/licensing/verified-assets.json.
configs/custom_files/icons/Tela-circle*/: Tela Circle icon theme by vinceliuice and MolassesLover. The pinned upstream tag 2022-11-06 (19fc7419addfdb768cd60e4c97160cf1ece4c8ca) includes COPYING.md, which states that the Tela-Circle icon theme is licensed under GNU GPL version 3 and identifies certain embedded SVG vector artwork, primarily Google Material icons, as Apache License 2.0. Exact upstream copies of COPYING.md and AUTHORS are shipped under configs/custom_files/licenses/pepvoid/upstream/Tela-circle/; their hashes and source commit are in docs/licensing/verified-assets.json. GPL-3.0 and Apache-2.0 license texts are installed with the system notices. The recorded SPDX terms are GPL-3.0-only for Tela Circle and Apache-2.0 for the embedded artwork identified by upstream. This notice applies only to the Tela Circle theme and its embedded artwork, not to unrelated Pepvoid Builder code. Attribution: Tela Circle Icon Theme; authors and customizers Vince Liuice vinceliuice@hotmail.com and MolassesLover syrupmedia@protonmail.com. Pinned upstream sources: COPYING.md https://github.com/vinceliuice/Tela-circle-icon-theme/blob/19fc7419addfdb768cd60e4c97160cf1ece4c8ca/COPYING.md and AUTHORS https://github.com/vinceliuice/Tela-circle-icon-theme/blob/19fc7419addfdb768cd60e4c97160cf1ece4c8ca/AUTHORS. The strongest tree match among the upstream release tags checked is the output generated from Tela Circle tag 2022-11-06 (commit 19fc7419addfdb768cd60e4c97160cf1ece4c8ca): the local index.theme is byte-for-byte identical after replacing %NAME% with Tela circle; its SHA-256 is 6548a40fd0f982e81b29fcdc13dbfa333e0169fd62dfcaa252e5f1cf97814cb0. A generated-tree comparison found 9,993 of 10,042 regular files and 15,323 of 15,348 symlink targets identical in each standard color variant; each dark variant had 4,914 of 4,919 regular files and 5,417 of 5,422 symlink targets identical. Generated icon-theme.cache files were excluded. The comparison can be reproduced with tools/compare_tela_circle_vendor.py and the reproducible command in docs/licensing/verified-assets.json. It supports identifying the vendored theme as a derivative of that licensed release; it is not used as the license grant. The COPYING.md scope and its Apache 2.0 exception are preserved verbatim in the installed source notice.
configs/custom_files/themes/Marwaita*/: GTK theme by darkomarko42, GPL-3.0. Each vendored theme directory contains the full license text as COPYING; the canonical text is also in LICENSES/GPL-3.0.txt. Upstream sources are https://github.com/darkomarko42/Marwaita and https://github.com/darkomarko42/Marwaita-Teal. The 200 individual assets listed for this source in docs/licensing/verified-assets.json match byte-for-byte against Marwaita commit 39fc23d4a3d7f0af60f7f6d8dce25e8948e92026; the source LICENSE SHA-256 matches LICENSES/GPL-3.0.txt. A further 74 SVGs are exact byte-for-byte matches to the pinned Marwaita-Teal history: 70 in tag 17.0 and four checkbox-off.svg copies in its preceding commit tree. The source license is preserved in configs/custom_files/licenses/pepvoid/upstream/Marwaita-Teal-17.0-LICENSE. All distributed assets from this theme family have verified source/license records or maintainer confirmation; no unresolved theme assets remain.
configs/custom_files/desktops/lxqt/usr/share/Kvantum/PepvoidDark/: Pepvoid’s Kvantum theme is adapted from KvGnomeDark by Tsu Jan, from Kvantum V1.1.8. The SVG preserves upstream vector geometry and identifiers; the palette is changed for Pepvoid. The local README records the source, changes, and GPL-3.0-or-later terms; upstream copyrights remain applicable. The asset record identifies the effective GPL-3.0-only upstream license, pins commit 058534fc15d1798c3887590166f05c598e8e946c, and records that the SVGs become byte-identical when hexadecimal color literals are normalized. The upstream COPYING file is installed under configs/custom_files/licenses/pepvoid/upstream/Kvantum-V1.1.8/. Source: https://github.com/tsujan/Kvantum/tree/V1.1.8/Kvantum/themes/kvthemes/KvGnomeDark.
configs/custom_files/themes/Pepvoid Modern*/gnome-shell/: inherited GNOME Shell theme CSS carries Red Hat and Intel copyright notices and is licensed under LGPL-2.1; the full text is present in each copied theme directory as COPYING.LGPL-2.1 and at LICENSES/LGPL-2.1.txt. The gnome-shell-start.svg artwork is by Jakub Steiner, sourced from GNOME Shell commit 2bb532d633008a36fc809a26d0aa973627d1306a, and licensed CC BY-SA 4.0. Both Pepvoid variants retain creator, source, and license metadata; their artwork matches the pinned source after metadata and editor fields are removed. The full CC BY-SA 4.0 text is in LICENSES/CC-BY-SA-4.0.txt and the installed license directory. The workspace-placeholder.svg is original Pepvoid art licensed GPL-3.0-or-later; its SPDX header and source project commit are recorded per file. The inherited GNOME placeholder was removed. GNOME Shell source: https://gitlab.gnome.org/GNOME/gnome-shell.
The unused configs/custom_files/icons/hicolor/48x48/apps/pep-software-center.png was removed from the payload. It contained SVG markup despite its .png suffix and had no project references.
configs/custom_files/themes/Pepvoid Modern*/gnome-shell/calendar-today*.svg: GNOME Shell calendar indicator artwork from data/theme, present in both theme variants. These files are distributed as part of GNOME Shell, which is licensed GPL-2.0-or-later; see its upstream COPYING and theme sources at https://github.com/GNOME/gnome-shell/tree/main/data/theme. The adjacent gnome-shell-start.svg has a separate CC BY-SA 4.0 license as documented above.
configs/custom_files/themes/Pepvoid Modern*/gnome-shell/pad-osd.css: exact copies of GNOME Shell’s data/theme/pad-osd.css, verified by SHA-256. The source is distributed in the GNOME Shell repository under GPL-2.0-or-later; retain its attribution and license terms. Upstream source: https://github.com/GNOME/gnome-shell/blob/main/data/theme/pad-osd.css.
configs/custom_files/themes/Pepvoid Modern-Xfwm*/xfwm4/: image and theme assets derive from the Marwaita for Xfwm project by Bunny Miércoles: https://gitlab.com/wednesbunny/marwaita-for-xfwm. Its GPL-3.0-only LICENSE, source paths, and commit d111162f645c4d8f572b64cc3781272e5438abb3 are pinned in docs/licensing/verified-assets.json; the upstream license file is also installed at configs/custom_files/licenses/pepvoid/upstream/Marwaita-for-Xfwm/LICENSE. The five Marwaita variants are generated from its src/xfwm4/ templates, colorschemes.ini, and colorschemes.py. Their XPM files match the generated output byte-for-byte. The PNG files are generated derivatives; a rebuild with the current ImageMagick is not pixel-identical to the bundled output. Pepvoid Modern Xfwm copies the upstream Alt variant’s image assets; Pepvoid Modern Xfwm Dark copies the Dark variant’s assets. The two Pepvoid xfwm4/themerc files change only active and inactive title text colors. The records pin each distributed image’s hash and distinguish exact matches from generated derivatives.
configs/custom_files/themes/Pepvoid Modern*/metacity-1/metacity-theme-*.xml: these files retain the upstream Marwaita name and author Darkomarko42. The light XML files are 99.1% textual matches to vendored Marwaita versions; the dark files match Marwaita versions byte-for-byte. Attribute this Metacity material to Darkomarko42 under GPL-3.0; the full license is in configs/custom_files/themes/Marwaita Peppermint/COPYING and LICENSES/GPL-3.0.txt.
The files under configs/custom_files/themes/Pepvoid Modern and configs/custom_files/themes/Pepvoid Modern Dark that match byte-for-byte with files in the vendored Marwaita* theme directories are Marwaita copies and carry its GPL-3.0 license. This comparison was made by SHA-256 across matching filenames. Further content comparison identified these modified Marwaita derivatives in both theme variants: gtk-2.0/gtkrc, general/gtk-base.css, general/gtkrc-light, general/gtkrc-dark, GTK 3 and GTK 4 gtk-base.css, and cinnamon/cinnamon.css. Each retains at least 89% of the corresponding Manjaro Marwaita file’s lines. The GTK base files replace the teal accent palette; the Cinnamon files preserve the source’s first 520 and final 251 lines verbatim and add menu rules. The following additional files also match Marwaita content: Pepvoid Modern/general/cinnamon-color.css, Pepvoid Modern Dark/general/cinnamon-color.css, and Pepvoid Modern Dark/general/cinnamon-light.css. Attribute these modified files to Darkomarko42 and distribute them under GPL-3.0, as required for Marwaita-derived files; the corresponding upstream license text is in Marwaita Dark Manjaro/COPYING and LICENSES/GPL-3.0.txt. These findings also apply to the GTK 3/4 gtk.css and gtk-dark.css entrypoint files in both Pepvoid variants. These files retain Marwaita’s import structure and theme-variable definitions, and load the Marwaita-derived base stylesheets. Their additional Pepvoid rules are modifications to the Marwaita theme and are distributed under GPL-3.0. Each modified GTK/Cinnamon text file is now hash-pinned in docs/licensing/verified-assets.json together with the hash of its corresponding vendored Marwaita source file and the GPL-3.0 text. Twenty further GTK SVG assets in the Marwaita Debian, Marwaita Manjaro, Pepvoid Modern, and Pepvoid Modern Dark variants retain the geometry and element structure of pinned Marwaita source SVGs after editor metadata and palette colors are normalized. Their paths, hashes, source commit, and GPL-3.0 terms are recorded individually in docs/licensing/verified-assets.json; Pepvoid’s palette changes are GPL-3.0-or-later. The two openbox-3/themerc files are Pepvoid theme configurations first added as project files, with no matching Marwaita source found in the vendored themes. They are identified as PeppermintOS Team work and carry GPL-3.0-or-later. The release inventory currently contains no unresolved theme assets.
docs/wallpapers/manifest.json: hashes and dimensions for the 25 currently distributed wallpapers, each generated from text descriptions only and designated under GPL-3.0-or-later. The previous wallpaper derivatives have been removed from the build payload. The 25 original source-photo blobs were purged from the reviewed Git branch histories. Hash-only audit records are retained in docs/licensing/removed-history-assets.json; they do not assert redistribution rights for the former photographs. See the wallpaper guide for the collection and its provenance.
CustomTkinter_shapes_font.otf in the Cinnamon and Cinnamon-XLibre user skeletons is distributed under the upstream maintainer’s explicit CC0-1.0 statement for the CustomTkinter library. The 5.2.2 source archive also includes an MIT LICENSE; both CC0 and MIT texts are preserved in the repository and installed notices. The exact archive checksum, local hashes, and source path are recorded in docs/licensing/verified-assets.json.
configs/custom_files/icons/settings-manager-icons/*.png: these seven PepTools icons are byte-for-byte matches for files in the PeppermintOS bubbles repository at commit 55c372654ca96cef8cc933f5a9075880b49dcae6. The repository identifies iso_configs/PepProPixMaps/ as PepTools icons and provides a GPL-3.0 license. Source paths and local SHA-256 digests are recorded in docs/licensing/verified-assets.json. See https://codeberg.org/Peppermint_OS/bubbles and the accompanying GPL-3.0 license text in LICENSES/GPL-3.0.txt.
configs/custom_files/kumo/kumosm.png and its application copy at configs/custom_files/kumo/app/images/kumosm.png are identical Kumo logo artwork (SHA-256 a61979d22a1743d0dfbf07515357adea855bc6aabd0346faf612356f8e891157). Both copies are byte-for-byte matches for iso_configs/pmostools/peptools/images/kumosm.png in the PeppermintOS bubbles repository at commit 55c372654ca96cef8cc933f5a9075880b49dcae6; they are covered by its GPL-3.0 license. Source details are recorded in docs/licensing/verified-assets.json.
The project maintainer confirmed that the Pepvoid Calamares branding and configuration were created for this project and may be redistributed under GPL-3.0-or-later. The hash-pinned list of covered files is in docs/licensing/maintainer-confirmations.json; the license is included in LICENSES/GPL-3.0.txt and installed system notices. This grant covers the project’s Calamares configuration, slideshow artwork, squid artwork, and project-created branding icons. It does not change licenses for upstream components, which remain separately attributed below.
custom_packages/calamares/template is a modified derivative of the Calamares XBPS recipe in Cereus-pkgs, licensed under the repository’s BSD-2-Clause terms. Its source is https://codeberg.org/cereus-linux/cereus-pkgs, commit 1c16bb52fdc63878e5fd0e58851b23447409c2b9, file srcpkgs/calamares/template. The template history identifies KF-Art and Kevin Figueroa as contributors; the repository’s COPYING retains the Void Linux copyright and BSD-2-Clause terms. The full license text is included in LICENSES/BSD-2-Clause.txt and installed notices. PeppermintOS modifications update the Calamares release and Void dependencies, cross-build handling, swap size, runit module setting, and Polkit rule installation. The license field inside the recipe describes Calamares itself, not the recipe file. The initial Pepvoid Builder commit also contains an earlier recipe in Git history. A pinned comparison identifies it as a modified derivative of the Cereus-pkgs Calamares template: it preserves the Qt 6 configuration, dependency structure, module exclusions, swap-size patch, and install steps, while making identifiable Pepvoid changes. The source template is covered by the BSD-2-Clause COPYING at the pinned source commit. The historical source and blob hashes are recorded in docs/licensing/verified-assets.json. The recovered F-Void checkout at https://github.com/johna23-lab/calamares-for-fvoid contains a Qt 5 / Calamares 3.2.62 template committed by johna23-lab on 2023-02-22, unlike the Qt 6 / Calamares 3.4.2 historical Pepvoid blob. The recovered repo has no license declaration for its template; its README’s CC0 notice covers only the README. Its services-runit.patch upload commit contains the original Calamares patch metadata for Artoo, while localecfg.patch was uploaded by johna23-lab and contains no separate author metadata. This evidence rules out the recovered F-Void template as the source of the historical Pepvoid blob. The historical recipe’s source and license are now verified; no source-history blocker remains for this blob.
configs/custom_files/calamares/branding/pepvoid/about.qml is adapted from the Calamares Extensions branding/kaos_branding/about.qml example, whose source header credits Anke Boersma (2020, 2022) and declares GPL-3.0-or-later. PeppermintOS modifications are separately credited in the file header and covered by the maintainer-confirmed GPL-3.0-or-later grant. Source: https://github.com/calamares/calamares-extensions/tree/calamares/branding/kaos_branding.
custom_packages/calamares/patches/services-runit.patch contains a git-formatted upstream patch whose embedded commit metadata attributes it to artoo <artoo@artixlinux.org> and commit 1eb51f4ec5f4f3c601d0100bba01b836b67e649d. This identifies the provenance of that runit-services patch. The patch retains its embedded Calamares and contributor copyright and GPL notices.
configs/custom_files/calamares/branding/pepvoid/pan-end-symbolic.svg is byte-for-byte identical to src/modules/keyboardq/data/pan-end-symbolic.svg in the Calamares 3.4.2 release archive (https://codeberg.org/calamares/calamares/releases/download/v3.4.2/calamares-3.4.2.tar.gz, SHA-256 733bbbb00dc9f84874bd5c22960952f317ea2537565431179fa2152b2fbfdccc, matching the pinned checksum in custom_packages/calamares/template). Its upstream sidecar declares SPDX-FileCopyrightText: 2022 demmm <anke62@gmail.com> and SPDX-License-Identifier: GPL-3.0-or-later. The GPL-3.0 text is included in LICENSES/GPL-3.0.txt and installed with the system notices.
icon-custom.svg, icon-rolling.svg, and icon-speed.svg in configs/custom_files/calamares/branding/pepvoid/ are modified versions of Feather’s sliders.svg, refresh-cw.svg, and zap.svg, respectively. Their vector geometry matches the upstream icons; Pepvoid changes the color, stroke width, dimensions, and SVG markup. Feather is distributed under the MIT License, copyright 2013-2023 Cole Bemis. The upstream geometry remains attributed under MIT; Pepvoid modifications are covered by the maintainer’s GPL-3.0-or-later confirmation. The source commit, paths, local hashes, and modifications are recorded in docs/licensing/verified-assets.json and docs/licensing/maintainer-confirmations.json. The full MIT license is included in LICENSES/MIT-Feather-icons.txt and the installed system notices. Source: https://github.com/feathericons/feather.
draw-rectangle.svg, pan-start-symbolic.svg, and pan-up-symbolic.svg are covered by the maintainer’s project authorship and GPL-3.0-or-later confirmation for Pepvoid Calamares branding. The confirmation is pinned to their hashes in docs/licensing/maintainer-confirmations.json.
configs/custom_files/grub/modern/background.png and configs/custom_files/grub/peppermint/background.png are identical Pepvoid-branded artwork (SHA-256 4115ab49c226952b5a9ac6ebd872bd6b54bededb9711232282f94d03477a3542). The maintainer confirmed Pepvoid ownership and GPL-3.0-or-later terms; see the brand asset notice above. The three select_*.png and nine terminal_box_*.png files in configs/custom_files/grub/peppermint/ match byte-for-byte the corresponding files in assets/menu/ from Distro Grub Themes 3.2. That upstream project’s README applies GNU GPL version 3.0 to the project; its GPL-3.0 text is included in LICENSES/GPL-3.0.txt and installed with the system notices. The source archive SHA-256 is fcb569f78468ec5b7b8fb2a0c32e1dc666dafb9594644df231299f61954399e6. These files are therefore attributed to Distro Grub Themes and covered by its stated GPL-3.0 grant. References: https://github.com/AdisonCavani/distro-grub-themes/releases/tag/v3.2 and https://github.com/AdisonCavani/distro-grub-themes/blob/master/README.md. The terminal-box images also match Ventoy’s theme, but that second match is not the basis for the license conclusion. These images do not match the same-named GNU GRUB 2.12 Starfield images byte-for-byte. The four GRUB class icons (gnu-linux.png, lfs.png, linux.png, and unknown.png) also match byte-for-byte their same-named generic Tux icons in assets/icons/ from that release. The repeated icon artwork is intentionally identical in that source. Their hashes and source paths are pinned in docs/licensing/verified-assets.json; this replaces the older PeppermintOS/pmoS artwork previously stored under those filenames. The six PF2 fonts are now regenerated from licensed source fonts instead of carrying the Distro Grub Themes copies. Four Terminus PF2 files were built from the regular PCF fonts in Void’s terminus-font 4.49.1_1 package; their family name is Pepvoid Mono, avoiding the OFL Reserved Font Name Terminus Font. The two Ubuntu PF2 files were built from Ubuntu Font Family 0.83_4 Ubuntu-R.ttf; their family name is Ubuntu derivative Pepvoid, as required for a modified font by Ubuntu Font Licence 1.0. The embedded source font metadata credits Copyright (C) 2020 Dimitar Toshkov Zhekov for Terminus and Copyright 2011 Canonical Ltd., with type design and engineering by Dalton Maag Ltd., for Ubuntu. The complete font-specific license texts are installed with the images as LICENSES/OFL-Terminus-4.49.1.txt and LICENSES/Ubuntu-font-1.0.txt. Source package/archive checksums, source font hashes, generation commands, and resulting PF2 hashes are recorded in docs/licensing/verified-assets.json. References: https://terminus-font.sourceforge.net/, https://ubuntu.com/legal/font-licence, https://github.com/void-linux/void-packages.
configs/custom_files/icons/Pepvoid Modern*/: the Pepvoid-specific icon SVGs and theme metadata are separate from their inherited Tela Circle icon set. The maintainer confirmed the original Pepvoid mark artwork is team-owned and GPL-3.0-or-later; SPDX metadata is embedded in the SVG files. Tela Circle’s independent licensing issue is described above.
configs/custom_files/pep-store/app/pep_store/assets/, configs/custom_files/pep-welcome/app/assets/, and configs/custom_files/pep-suggested/app/images/logo.png: five PNG files named logo.png and peppermint_logo.png are identical older PeppermintOS/pmoS logo artwork (SHA-256 4aef85ee485cb6721b5079d72339ae3d49902f083f705561f59015c567457b93). They are byte-for-byte matches for iso_configs/PepProPixMaps/logo.png in the PeppermintOS bubbles repository at commit 55c372654ca96cef8cc933f5a9075880b49dcae6 and are covered by its GPL-3.0 license. Source details are recorded in docs/licensing/verified-assets.json. This older wordmark remains distinct from the Pepvoid artwork covered by the maintainer confirmation.
configs/custom_files/pep-fetch/app/pfetch-logo.svg, configs/custom_files/gdm/pepvoid-gdm.svg, and configs/custom_files/sddm/themes/pepvoid/background.svg are branded SVGs covered by the maintainer’s ownership and GPL-3.0-or-later confirmation. SPDX metadata is embedded in the SVG files (see the brand asset notice above).
The former GNOME Flashback and XFCE wallpaper photographs are absent from the current payload and their Git blobs were purged from the reviewed branch histories. Their source origins and rights remain undocumented; the project makes no redistribution claim for those photographs. Hash-only removal records are retained in docs/licensing/removed-history-assets.json. The current wallpaper collection is documented separately in docs/wallpapers/manifest.json.
custom_packages/*/template: package recipes record upstream package licenses for the packages they build. Those package licenses do not license the Pepvoid Builder source code.
The 26 .xpm images in configs/custom_files/desktops/icewm/**/Pepvoid-Modern-Dark/ were created for this project. The maintainer confirmed their project ownership and coverage under GPL-3.0-or-later on 2026-11-03. Exact paths and SHA-256 digests are recorded in docs/licensing/maintainer-confirmations.json and checked by the release licensing gate.

This inventory records the notices found during the repository audit. A file or asset with its own license or copyright notice remains governed by that notice; consult it before modifying or redistributing that material.

Exact paths, source commits, SHA-256 digests, and verified license information for matched assets are tracked in docs/licensing/verified-assets.json. Unresolved paths and digests remain tracked in docs/licensing/unresolved-assets.json. Hash-only records of purged historical files are tracked separately in docs/licensing/removed-history-assets.json.

The first automated payload audit on 2026-11-03 found 1,207 tracked image, font, and binary assets without verified source, license, or permission evidence. The current ledger contains 1,231 individually hash-pinned verified asset paths, plus a separately verified Tela Circle asset tree. The current build includes 25 text-only wallpaper images. The old source-photo blobs were purged from the reviewed branch histories and are tracked by hash-only audit records. Run python3 tools/check_release_licenses.py locally before proposing a release tag; a nonzero exit status indicates an incomplete or invalid inventory.