diskos/DEPENDENCY_INVENTORY.md

Dependency inventory - generated from a self-built onefile artifact

Scope note: this inventory describes a self-built PyInstaller onefile. The published diskOS release does NOT ship that onefile - it distributes source and runs from your own Python (see NOTICE.md / licenses/THIRD_PARTY_BUNDLED.md), so these bundled libraries are not redistributed by this project. This file is retained for anyone who chooses to build and redistribute the onefile themselves (they take on these obligations).

This is an artifact-derived list from a PyInstaller onefile build: ~93 distinct native .so entries were bundled. Below are the license-bearing shared libraries PyInstaller pulled in transitively (CPython + Tkinter GUI + pycryptodome + pyusb chains), grouped by license obligation. They matter only if you build and redistribute the onefile yourself; the published source release does not bundle them.

Copyleft - obligations to satisfy (priority)

Library	Bundled as	License	Obligation
libudev (systemd)	libudev.so.1	LGPL-2.1	ship license text + §6 relink materials (or drop it)
FreeType	libfreetype.so.6	FTL or GPLv2 (dual)	ship FTL text (permissive path) + attribution
libcap	libcap.so.2	BSD-3 / GPLv2 (dual)	permissive path: BSD text

NOTE: libudev (LGPL) is bundled only because of the Tkinter GUI's X/font chain. Consider a --nowindow/CLI-only build, or explicitly excluding libudev, to remove the LGPL relink burden.

Permissive - attribution/notice only (ship license texts)

Library	Bundled as	License
OpenSSL 3	libssl.so.3, libcrypto.so.3	Apache-2.0
Tcl / Tk 8.6	libtcl8.6.so, libtk8.6.so	TCL/Tk (BSD-style)
libpng	libpng16.so.16	PNG Reference License
zlib	libz.so.1	zlib
xz / liblzma	liblzma.so.5	0BSD / public-domain
bzip2	libbz2.so.1.0	bzip2 (BSD-style)
libffi	libffi.so.8	MIT
fontconfig	libfontconfig.so.1	MIT-style
expat	libexpat.so.1	MIT
brotli	libbrotlicommon/dec	MIT
X11 client libs	libX11/Xext/Xrender/Xft/Xau/Xdmcp/Xss	MIT (X11)
BLT	libBLT*	BSD-style

Already in NOTICE.md (direct deps)

CPython (PSF), pyusb (BSD-3), pycryptodome (BSD-2 + public-domain), PyInstaller bootloader (GPL-2.0 + bootloader exception). The pycryptodome _raw_*/_ghash_* etc. modules are part of it.

If you build and redistribute the onefile yourself

The published release does not ship the onefile, so none of the above is an obligation for it. If you choose to build one (build/build.sh) and hand it to others, you become the redistributor of everything it embeds and must satisfy those licenses - in particular the LGPL libudev and the dual-licensed FreeType pulled in by the Tkinter GUI. The simplest way to avoid that burden is a CLI-only build that excludes tkinter. To enumerate exactly what a given onefile bundles, walk the extracted binary's shared objects and map each back to its distribution package.