diskos/NOTICE.md

diskOS installer - third-party components & licenses

The diskOS installer ships the third-party programs and libraries below. Each is invoked as a separate program or loaded as a library; this document provides the required attribution and points to the corresponding source that ships alongside the binaries. The full verbatim license texts are in licenses/; this file is the component-to-license index.

Bundled native programs (called as subprocesses - mere aggregation)

Component	Purpose	License	Source
usbboot	Ingenic X2000 mask-ROM USB loader (the flasher front-end)	GPL-2.0-or-later - © 2021 Aidan MacDonald, © 2015 Amaury Pouly	included: src/usbboot/ (built from this)
mksquashfs / unsquashfs (squashfs-tools 4.6.1)	build/extract the rootfs image	GPL-2.0	https://github.com/plougher/squashfs-tools (v4.6.1)
dropbearmulti (Dropbear SSH 2022.83)	embedded in the diskOS image; started by the opt-in Debug Mode for SSH-over-WiFi	MIT-style (© 2002-2020 Matt Johnston; components under MIT/BSD/public-domain) - text in licenses/LICENSE-dropbear.txt	https://matt.ucc.asn.au/dropbear/dropbear.html (v2022.83; predates the CVE-2023-48795 "Terrapin" Strict-KEX mitigation - an update is planned. Debug Mode SSH is opt-in and short-lived, and Dropbear's Terrapin exposure is limited.)

usbboot and squashfs-tools are GPL-2.0, so anyone redistributing them must make their corresponding source available and include the GPL-2.0 license text. (dropbearmulti is MIT-style - no source-availability obligation, only its license text as noted above.) The complete corresponding source ships in-tree and in every release tarball, so it travels from the same place as the binaries (GPL-2.0 §3(a), plus the "same place" provision in §3's final paragraph): usbboot's own source is src/usbboot/usbboot.c; squashfs-tools 4.6.1 source is corresponding-source/squashfs-tools_4.6.1*. Both are rebuilt by build/build-usbboot-static.sh / build/build-squashfs-static.sh.

Static linking (Linux): the prebuilt Linux usbboot, mksquashfs, and unsquashfs are shipped fully statically linked (built with gcc -static on a glibc host). They therefore statically incorporate:

• libusb-1.0.27 (LGPL-2.1) - in usbboot
• liblzo2 2.10 (GPL-2.0-or-later), zlib, liblzma (permissive) - in squashfs-tools
• the GNU C Library (glibc, LGPL-2.1-or-later) - the host's system C runtime, in all three

Because liblzo2 is GPL, the resulting mksquashfs/unsquashfs binaries are effectively GPL-2.0. The corresponding source for the statically-linked GPL/LGPL libraries is provided so their §3/§6 obligations are met:

• liblzo2 (corresponding-source/lzo2_2.10*) and libusb-1.0 (corresponding-source/libusb-1.0_1.0.27*) ship in-tree.
• glibc (statically linked, so it travels inside the binary): the complete corresponding source is vendored in corresponding-source/glibc_2.39* (the exact version the shipped binaries were built against). Because it is statically linked it does not qualify for the "system library" exception, so its source ships alongside the binaries like the others.

Relink path (satisfies LGPL-2.1 §6 for libusb and glibc): we ship the complete source of usbboot (src/usbboot/usbboot.c) and squashfs-tools (corresponding-source/squashfs-tools_4.6.1*) plus the exact build recipes (build/build-usbboot-static.sh, build/build-squashfs-static.sh). A user can therefore rebuild and relink these tools against a modified libusb, liblzo2, or glibc of their choosing - the freedom §6 exists to protect. See corresponding-source/README.md.

Python runtime + libraries - NOT redistributed by this project. The installer runs from source with your own Python. The two Python dependencies (pyusb, pycryptodome) are fetched from PyPI by your pip into a local .venv (created by ./install.sh); CPython, tkinter, and their transitive native libraries (OpenSSL, Tk/Tcl, the X11 stack, freetype, fontconfig, zlib, etc.) all come from your system's Python - this project ships none of them, so their redistribution notices are not our obligation. Their license texts (for reference) are still listed in licenses/README.md.

If you instead build a self-contained PyInstaller onefile yourself (build/build.sh), that binary embeds CPython + ~90 native libraries and you become the redistributor of them - see licenses/THIRD_PARTY_BUNDLED.md for the enumeration and obligations. The published release does not do this; it distributes source + the native flash tools below.

Bundled device blobs

Component	Purpose	Notes
my_write5_dram.bin	the bad-block-aware DRAM NAND writer run on-device	diskOS project code - source: flash/my_write5.c
disc_spl_lpddr3.bin	Ingenic X2000 USB stage-1 SPL (DRAM init)	GPL-2.0 - built from source: Ingenic-community/uboot-xburst 1060b516 + our LPDDR3 patches. Corresponding source in spl-src/; see SPL_SOURCE.md. (No vendor/USBCloner binary is redistributed.)

Python dependencies (fetched by your pip, not redistributed by us)

./install.sh installs these from PyPI into a local .venv; CPython comes from your own system Python. This project does not ship any of them, so their license texts are listed here only for reference. (PyInstaller is used only if you build the optional onefile yourself; it is not involved in the source release.)

Component	License
pyusb (USB device detection)	BSD-3-Clause
pycryptodome (AES-decrypt of FiiO OTA chunks)	BSD-2-Clause + public-domain (Unlicense)
CPython (your system's)	Python Software Foundation License
PyInstaller runtime bootloader (only for a self-built onefile)	GPL-2.0 with a bootloader exception permitting distribution of the packaged app under any license

Bundled shared libraries (macOS build)

Component	License
libusb-1.0 (bundled next to usbboot on macOS)	LGPL-2.1

diskOS's own code

• The Python installer, build scripts, and docs in this repo are licensed MIT - Copyright (c) 2026 diskOS contributors. See LICENSE.

• The diskOS UI (payload/mq_ui) ships as a binary-only component (static-musl, MIPS): its source is not yet published and it is not covered by the MIT license above.

  diskOS UI Binary License: You may use and redistribute the mq_ui binary verbatim - on its own or as part of the diskOS installer - free of charge. It is provided AS IS, without warranty of any kind. Its source is not published, and no right to modify, decompile, or reverse-engineer it is granted. The embedded third-party components below retain their own licenses. © 2026 the diskOS author (alias b0hemia).

  It statically incorporates these third-party components, whose licenses apply to the shipped binary:

  Embedded in mq_ui	License	Text / source
  musl libc (static C runtime)	MIT	licenses/MIT-musl.txt; source: https://musl.libc.org/
  LVGL (UI toolkit)	MIT	licenses/MIT-LVGL.txt
  JSMN (JSON parser)	MIT	licenses/MIT-JSMN.txt
  SQLite (amalgamation)	Public domain	https://sqlite.org/copyright.html
  MD5 (Peslyak/Solar Designer)	Public domain	in the (unpublished) UI source
  QR Code generator (Nayuki qrcodegen)	MIT	licenses/MIT-qrcodegen.txt
  TJpgDec (tiny JPEG decoder, via LVGL)	BSD-style (ChaN)	licenses/LICENSE-TJpgDec.txt
  Montserrat font (via LVGL built-in fonts)	SIL OFL 1.1	licenses/OFL-1.1-Montserrat.txt
  Source Han Sans SC (CJK fallback font, subset)	SIL OFL 1.1	licenses/OFL-1.1-SourceHanSans.txt
  Font Awesome Free glyphs (via LVGL LV_SYMBOL_*)	OFL 1.1 (fonts) + CC-BY 4.0 (icons)	licenses/OFL-1.1-FontAwesome.txt, licenses/CC-BY-4.0.txt

NOT distributed by this installer

• FiiO's stock rootfs - you supply your own official firmware; the installer only reads it locally and never redistributes it.
• ffmpeg - used at runtime for album-art decoding, but it is part of FiiO's stock firmware already on the device (/usr/bin/ffmpeg); the installer does not ship it.

---

Compliance checklist (done)

• ✅ Full license texts shipped in licenses/ (GPL-2.0, LGPL-2.1, BSD, PSF, LVGL-MIT, dropbear, Font Awesome OFL/CC-BY) - see licenses/README.md.
• ✅ diskOS installer license stated: MIT (LICENSE). The mq_ui binary is documented as binary-only (source unpublished, not MIT) with its embedded LVGL/JSMN/Font Awesome notices shipped.
• ✅ Exact upstream versions pinned and their complete corresponding source shipped in-tree for the GPL/LGPL native binaries: squashfs-tools 4.6.1, liblzo2 2.10, libusb-1.0 1.0.27, the SPL, and usbboot - in corresponding-source/ and spl-src/. Source travels from the same place as the binaries; no separate written offer is needed.