This distribution combines independently licensed components. It is an aggregate; the Linux kernel license does not change the license of OpenVMM or the distribution tooling.
| Component | Location | License and source |
|---|---|---|
| Linux 6.18.38 | Generated under .cache/linux |
GPL-2.0-only; the upstream archive and patch series are pinned in SOURCE-MANIFEST.json and kernel/patches. Each build exports its exact config, and collect-sources emits the complete patched tree. |
| OpenVMM | openvmm |
MIT; see openvmm/LICENSE. Source is a private Git submodule and is available only to authorized users. |
| NVX guest/build sources | guest, nvx-rs, ubuntu, kernel, scripts/nvx_tools |
MIT; see LICENSE. |
| Rust core and standard libraries | linked into all ten Rust guest binaries listed in the musl row, and into bin/nvx-rs, or bin/nvx-rs.exe, of every release package |
MIT OR Apache-2.0; the exact release is pinned by rust-toolchain.toml. Source and license files are under rust-lang/rust/library, with LICENSE-MIT and LICENSE-APACHE at the repository root. |
Rust compiler_builtins |
Rust target runtime routines used by the guest binaries and bin/nvx-rs[.exe] |
MIT OR Apache-2.0 for rust-lang/compiler-builtins; routines derived from LLVM compiler-rt are Apache-2.0 WITH LLVM-exception. Source is the revision bundled by the pinned Rust release under rust-lang/compiler-builtins and its llvm-project/compiler-rt sources. |
Rust libc crate 0.2.189 |
linked into the guest binaries and the Linux bin/nvx-rs through nix and getrandom |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and source and license files are at rust-lang/libc tag 0.2.189. |
Rust nix crate 0.31.3 |
system-call wrappers used by the guest binaries and the Linux bin/nvx-rs |
MIT; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by nix-rust/nix. |
Rust getrandom crate 0.4.3 |
random bytes for the guest binaries, such as nvx-reseed --sample, and for bin/nvx-rs[.exe], such as control capabilities |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by rust-random/getrandom. |
Rust bitflags crate 2.13.2 |
transitive nix dependency in the guest binaries and the Linux bin/nvx-rs |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by bitflags/bitflags. |
Rust cfg-if crate 1.0.5 |
transitive nix, getrandom, and sha2 dependency in the guest binaries and bin/nvx-rs[.exe] |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by rust-lang/cfg-if. |
Rust memoffset crate 0.9.1 |
transitive nix dependency in the guest binaries and the Linux bin/nvx-rs |
MIT; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by Gilnaa/memoffset. |
Rust serde crate 1.0.229 |
serialization framework of bin/nvx-rs[.exe] |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by serde-rs/serde. |
Rust serde_core crate 1.0.229 |
transitive serde and serde_json dependency in bin/nvx-rs[.exe] |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by serde-rs/serde. |
Rust serde_derive crate 1.0.229 |
procedural macro that generates the serde derives of nvx-rs while it builds; the code that it generates, not the crate, is in bin/nvx-rs[.exe] |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by serde-rs/serde. |
Rust proc-macro2 crate 1.0.107 |
build-time serde_derive dependency, not linked into bin/nvx-rs[.exe] |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by dtolnay/proc-macro2. |
Rust quote crate 1.0.47 |
build-time serde_derive dependency, not linked into bin/nvx-rs[.exe] |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by dtolnay/quote. |
Rust syn crate 3.0.6 |
build-time serde_derive dependency, not linked into bin/nvx-rs[.exe] |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by dtolnay/syn. |
Rust unicode-ident crate 1.0.26 |
build-time proc-macro2 and syn dependency, not linked into bin/nvx-rs[.exe] |
(MIT OR Apache-2.0) AND Unicode-3.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by dtolnay/unicode-ident. |
Rust serde_json crate 1.0.151 |
JSON reading and writing in bin/nvx-rs[.exe] |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by serde-rs/json. |
Rust itoa crate 1.0.18 |
integer formatting for serde_json in bin/nvx-rs[.exe] |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by dtolnay/itoa. |
Rust memchr crate 2.8.3 |
byte search for serde_json in bin/nvx-rs[.exe] |
Unlicense OR MIT; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by BurntSushi/memchr. |
Rust zmij crate 1.0.23 |
floating-point formatting for serde_json in bin/nvx-rs[.exe] |
MIT; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by dtolnay/zmij. |
Rust sha2 crate 0.10.9 |
SHA-256 in bin/nvx-rs[.exe] |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by RustCrypto/hashes. |
Rust digest crate 0.10.7 |
transitive sha2 dependency in bin/nvx-rs[.exe] |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by RustCrypto/traits. |
Rust crypto-common crate 0.1.7 |
transitive sha2 dependency in bin/nvx-rs[.exe] |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by RustCrypto/traits. |
Rust block-buffer crate 0.10.4 |
transitive sha2 dependency in bin/nvx-rs[.exe] |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by RustCrypto/utils. |
Rust cpufeatures crate 0.2.17 |
transitive sha2 dependency in bin/nvx-rs[.exe] |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by RustCrypto/utils. |
Rust generic-array crate 0.14.7 |
transitive sha2 dependency in bin/nvx-rs[.exe] |
MIT; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by fizyk20/generic-array. |
Rust typenum crate 1.20.1 |
transitive sha2 dependency in bin/nvx-rs[.exe] |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by paholg/typenum. |
Rust windows-sys crate 0.61.2 |
Windows API bindings of bin/nvx-rs.exe |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by microsoft/windows-rs. |
Rust windows-link crate 0.2.1 |
transitive windows-sys dependency in bin/nvx-rs.exe |
MIT OR Apache-2.0; the exact crate checksum is pinned in nvx-rs/Cargo.lock, and the source is published by microsoft/windows-rs. |
| musl libc | statically linked into /sbin/nvx-console-pending, /sbin/nvx-mmio-write, /sbin/nvx-reseed, /sbin/nvx-exit, /sbin/nvx-device-io, /sbin/nvx-managed-agent, /sbin/nvx-ingress, /sbin/nvx-time, /sbin/nvx-time-probe, and /sbin/nvx-init in every generated initramfs, and into bin/nvx-rs of the linux-kvm and linux-mshv release packages |
MIT; Copyright © 2005-2020 Rich Felker, et al. The exact implementation is supplied by the pinned Rust release's x86_64-unknown-linux-musl target. Upstream source and the full copyright notice are at musl libc. |
LLVM libunwind |
statically linked, with musl, into the ten guest binaries and the Linux bin/nvx-rs, which unwind and print backtraces through it |
Apache-2.0 WITH LLVM-exception, whose exception lifts the attribution conditions for code embedded in a compiled program. The exact implementation is the libunwind.a that the pinned Rust release's x86_64-unknown-linux-musl target supplies, which the Rust project builds from its fork of llvm-project/libunwind. |
| Microsoft C runtime: the Visual C++ runtime and the Universal C Runtime | statically linked into bin/nvx-rs.exe of the windows-whp release package, which CI builds with -C target-feature=+crt-static, so that it runs without the Visual C++ Redistributable |
Proprietary Microsoft object code, linked in by the Visual Studio build tools and the Windows SDK of CI's Windows runner under their Microsoft Software License Terms, which permit distributing the programs built with them; see Redistribute Visual C++ files. No source is distributed. |
| Alpine Linux packages | generated initramfs images | Per-package licenses. Every build emits *.packages.json; retain that manifest and collect the corresponding aports recipes and upstream sources before distributing an image. |
| Azure Linux 3.0 packages | generated Azure Linux initramfs | Per-package licenses, including GPLv2 BusyBox. The base image is digest-pinned in SOURCE-MANIFEST.json, every supplemental RPM is SHA-256 pinned in azurelinux/packages.lock.json, and every build emits initramfs-azurelinux.cpio.gz.packages.json. collect-sources does not collect this corresponding source yet, so --include-source packages omit the Azure Linux initramfs; publish the matching source before distributing a binary-only package that contains it. |
| Ubuntu Base 26.04.1 LTS and supplemental packages | generated Ubuntu initramfs and EROFS images | Per-package licenses. The base archive and every supplemental .deb are SHA-256 pinned. Retain the generated Ubuntu manifests and publish the matching .dsc plus all referenced source members before distributing an image. Ubuntu artifacts contain Ubuntu userland with the NVX kernel, not the Ubuntu kernel. |
The source manifest records pinned versions, commits, and the upstream Linux
archive digest. A binary release made with scripts/nvx.py package --include-source includes separate project, patched Linux, Alpine, and Ubuntu
source archives and excludes the Azure Linux guest artifacts. OpenVMM source is
intentionally excluded; its MIT license notice is included in the binary
release.
Run scripts/nvx.py collect-sources before creating a source-inclusive
release. It saves the patched Linux source archive under build/sources/linux
and exact aports recipes plus abuild verify-checked upstream source files
under build/sources/alpine. Ubuntu source packages are stored under
build/sources/ubuntu with their verified source-index and .dsc metadata.