# Bundled components VPNPilot ships third-party VPN engines as separate executables. Their licences are unaffected by VPNPilot's own, but distributing them carries obligations that have to be met by whoever publishes the installers. | Component | Version | Licence | Source | | --- | --- | --- | --- | | OpenVPN | 2.6.14 | GPL-2.0-only (with OpenSSL linking exception) | https://swupdate.openvpn.org/community/releases/ | | openconnect | 9.12 | LGPL-2.1-or-later | https://www.infradead.org/openconnect/download/ | | wireguard-go | v0.0.0-20260522210424-ecfc5a8d5446 | MIT | https://git.zx2c4.com/wireguard-go/ (built for Linux and Windows alike) | | vpnc-scripts | 20240116 | GPL-2.0-or-later | https://gitlab.com/openconnect/vpnc-scripts | | Wintun | 0.14.1 | Proprietaria — «Prebuilt Binaries License», WireGuard LLC | https://www.wintun.net/ | | nftables (`nft`) | 1.1.1 | GPL-2.0-only | https://www.netfilter.org/projects/nftables/ | | libnftnl | 1.2.8 | GPL-2.0-or-later | https://www.netfilter.org/projects/libnftnl/ | | libmnl | 1.0.5 | LGPL-2.1-or-later | https://www.netfilter.org/projects/libmnl/ | | LZO | as packaged by Alpine 3.22 | GPL-2.0-or-later | linked into the Linux openvpn | | OpenSSL | as packaged by Alpine 3.22 | Apache-2.0 | linked into the Linux engines | | libxml2 | as packaged by Alpine 3.22 | MIT | linked into the Linux openconnect | ## LZO, and why it is linked in From 2026-08-22 the Linux openvpn is built with `--enable-lzo`. Not to compress anything: `comp-lzo no` means "compression off, framing present", and OpenVPN still adds a byte to every data packet. An engine built without LZO does not expect that byte, so the data channel runs one byte out of step while the control channel — which does not use the framing — works perfectly. The tunnel establishes and carries nothing. liblzo2 is GPL-2.0-or-later, which is compatible with openvpn's own GPL-2.0. It is statically linked into the binary we ship, so its source belongs on the sources page like the rest. ## Wintun is not free software The prebuilt `wintun.dll` is **not** GPL, whatever the project's source repository is under. It carries WireGuard LLC's "Prebuilt Binaries License", and this table said GPL-2.0 until 2026-08-22, which was wrong. Two clauses decide what we may do: - **3.d** forbids redistribution *except* when the DLL travels alongside software that uses it only through the API declared in `wintun.h`. wireguard-go, openconnect and openvpn all do exactly that, so shipping it is permitted. - **3.c** forbids removing the copyright notices. Extracting only the DLL from the zip removed them, so `packaging/licenses/wintun-LICENSE.txt` now travels in every package — beside the engines on Windows, in `/usr/share/doc/vpnpilot` on Linux. If a future version of VPNPilot ever calls into Wintun by anything other than the published API, or modifies the DLL, neither clause holds any more. ## What has to ship with a release 1. The licence text of each component above, in the installer payload. 2. The corresponding source of the GPL and LGPL components. VPNPilot publishes the sources rather than offering them: https://vpnpilot.70m3.eu/sorgenti carries the pinned upstream tarballs and the two build scripts that turn them into the binaries we ship. A written offer valid three years would satisfy the licence too, but it commits whoever signs it to answering requests for three years; publishing ends the obligation the day it goes up. The build scripts are part of the corresponding source and have to be there: the licence covers the instructions for building, not only the code. They disclose version pins and configure flags, and nothing about VPNPilot itself. 3. Any patches applied during `packaging/engines/build-*.sh` — currently none. If that changes, the patches become part of the corresponding source. The version pins in `packaging/engines/build-linux.sh` and `packaging/engines/build-windows.sh` are the authoritative record of what a given release bundled. Bump them there and here together. ## VPNPilot's own source stays closed, and why that is allowed Two facts, both checked rather than assumed: - **The engines are separate executables.** openvpn, openconnect, nft and wireguard-go are spawned as processes and driven over a command line and a socket. Not one line of them is linked into vpnd or the GUI. GPLv2 §2 calls this mere aggregation, and it does not reach the program alongside. - **Every Rust dependency is permissive.** A census of Cargo.lock on 2026-08-22 read the declared licence of 558 of the 661 crates: MIT, Apache-2.0, BSD, Unicode-3.0, and five MPL-2.0 crates (`cssparser`, `selectors` and friends). No GPL anywhere. The 103 unread ones are platform crates for macOS, Android and Haiku that never reach our binaries. MPL-2.0 is file-level copyleft and §3.3 permits combination with proprietary code; we modify none of those files, so keeping their notices is the whole obligation. Re-run the census when dependencies change: it is the load-bearing fact under everything in this section. ## Static linking The Linux engines are linked statically (see `packaging/engines/build-linux.sh`) so the packages do not have to pull openvpn, openconnect, wireguard-go and nftables in from the distribution. That changes the obligations in one way worth recording: openconnect and libmnl are LGPL-2.1, and static linking means a recipient must be able to relink them against a modified library. What satisfies that here is the build script itself — it pins every version, applies no patches, and reproduces the binaries from published sources with one command, so anyone can swap in their own libopenconnect and rebuild.