Open-source attributions

OTA-Pulse is built on open-source software. This page lists the third-party components we distribute, so you can review their licenses and satisfy your own compliance obligations when you ship a device running OTA-Pulse.

Nothing here restricts your use of OTA-Pulse itself. These are the upstream projects our binaries are built from or link against.

Device agent and artifact tooling

The OTA-Pulse device agent (soc-ota-agent) and the otapulse-artifact CLI are derived from the Mender open-source project by Northern.tech AS, and are distributed under the Apache License 2.0.

Component	Upstream project	Copyright	License
`soc-ota-agent`	mender	Copyright Northern.tech AS	Apache-2.0
`otapulse-artifact`	mender-artifact	Copyright Northern.tech AS	Apache-2.0
Artifact container	Mender artifact format v3 (identifier `otapulse` from `otapulse-artifact` 3.11.2-op2)	Copyright Northern.tech AS	Apache-2.0
`otapulse-convert`	mender-convert (tag `5.3.0`)	Copyright Northern.tech AS	Apache-2.0

The Apache License 2.0 permits this redistribution, including under a different product name. The full license text ships with the source of each component.

NOTICE

The device agent’s NOTICE file, excerpted verbatim (all sections except the device-image one):

OTA-Pulse
Copyright 2024 Northern.tech AS (upstream Apache-2.0 licensor -- see LICENSE)

This distribution includes modifications to, and code that vendors,
software originally developed by Northern.tech AS as part of the Mender
project (https://mender.io), used here under the Apache License, Version
2.0. This NOTICE file is provided per Section 4(d) of that License and does
not modify the License itself.

"Mender" is a trademark of Northern.tech AS. Its use here is limited to
identifying the origin of vendored/derived code, per Section 6 of the
Apache License, Version 2.0 -- it is not used to imply endorsement of, or
affiliation with, Northern.tech AS or the Mender project.

--------------------------------------------------------------------------
Modifications
--------------------------------------------------------------------------

Portions of this repository are original work, Copyright 2024-2026 the
OTA-Pulse project contributors, distributed under the same Apache License,
Version 2.0 as the rest of this project (see LICENSE). Where a file
originates from, or is a derivative of, upstream Mender source, it carries
its own in-file or directory-level notice; this NOTICE file is the
project-level attribution required by Section 4(d) and does not itself
enumerate every such file.

The on-device artifact format (`.otapulse`, historically `.mender`) and the
underlying `mender-artifact` tool are unmodified from upstream Mender --
see soc-ota-agent/third_party_licenses/ below.

--------------------------------------------------------------------------
Third-party components (soc-ota-agent, direct + transitive dependencies)
--------------------------------------------------------------------------

Full license texts for every third-party Go module compiled into
soc-ota-agent are checked in at soc-ota-agent/third_party_licenses/ (a
snapshot generated by soc-ota-agent/scripts/generate-third-party-licenses.sh
via `go-licenses`; regenerate after any go.mod change) and summarized in
soc-ota-agent/third_party_licenses.csv. All are permissive (Apache-2.0,
MIT, BSD-2-Clause, BSD-3-Clause, ISC) -- no copyleft/GPL-family license
appears in this dependency graph, as of the last regeneration. Directly
vendored Mender-originated modules:

  github.com/mendersoftware/mender-artifact   Apache-2.0
  github.com/mendersoftware/openssl           Apache-2.0
  github.com/mendersoftware/progressbar       Apache-2.0

This is the part of the NOTICE file covering attribution and third-party modules. The complete file, including its device-image section, is in the source repository.

Artifact format compatibility

OTA-Pulse artifacts use the Mender artifact format v3 container on disk. We did not create a new container format. The container is still Mender-v3-derived and still under Apache-2.0.

What changed is the format identifier. Artifacts written by otapulse-artifact 3.11.2-op2 and later carry {"format":"otapulse","version":3} in their internal version member. Earlier tool builds write {"format":"mender","version":3}. The version number stays 3. The member names, their order, the manifest, the signature, and the payload layout are all unchanged.

tar -xOf firmware-v1.0.0.otapulse version
# {"format":"otapulse","version":3}   (written by op2 and later)
# {"format":"mender","version":3}     (written by earlier tool builds)

Artifacts that report {"format":"mender","version":3} remain valid. The OTA-Pulse agent and the server accept both identifiers. The --format flag exists only on otapulse-artifact 3.11.2-op2 and later. On those builds, otapulse-artifact write --format mender produces an artifact with the old identifier. Earlier builds have no --format flag and always write mender.

The identifier is the only thing that differs. Inspecting an old artifact and a new one will show the same structure.

Go dependencies of the device agent

The table below is the full, machine-generated dependency list for soc-ota-agent — every package compiled into the binary, produced by go-licenses from soc-ota-agent/go.mod and checked in at soc-ota-agent/third_party_licenses.csv (regenerate via soc-ota-agent/scripts/generate-third-party-licenses.sh after any go.mod change; full license texts ship at soc-ota-agent/third_party_licenses/). All are permissive — no copyleft/GPL-family license appears in this dependency graph, as of the last regeneration. Versions come from soc-ota-agent/go.mod; the urfave/cli/v2 module is replaced by a Mender-maintained fork, shown at its replacement version.

Package	Version	License (SPDX)	License text
`github.com/bmatsuo/lmdb-go`	`v1.6.1-0.20160816100615-69ad631904c9`	BSD-3-Clause	source
`github.com/creack/pty`	`v1.1.9`	MIT	source
`github.com/davecgh/go-spew/spew`	`v1.1.2-0.20180830191138-d8f796af33cc`	ISC	source
`github.com/gorilla/websocket`	`v1.4.3-0.20220104015952-9111bb834a68`	BSD-2-Clause	source
`github.com/klauspost/compress`	`v1.15.9`	Apache-2.0	source
`github.com/klauspost/compress/internal/snapref`	`v1.15.9`	BSD-3-Clause	source
`github.com/klauspost/compress/zstd/internal/xxhash`	`v1.15.9`	MIT	source
`github.com/klauspost/cpuid/v2`	`v2.0.4`	MIT	source
`github.com/klauspost/pgzip`	`v1.2.5`	MIT	source
`github.com/mattn/go-isatty`	`v0.0.12`	MIT	source
`github.com/mendersoftware/mender-artifact`	`v0.0.0-20230721111244-48a9eb08b04f`	Apache-2.0	source
`github.com/mendersoftware/openssl`	`v1.1.1-0.20221101131127-8797d18baf1a`	Apache-2.0	source
`github.com/mendersoftware/progressbar`	`v0.0.3`	Apache-2.0	source
`github.com/minio/sha256-simd`	`v1.0.0`	Apache-2.0	source
`github.com/pkg/errors`	`v0.9.1`	BSD-2-Clause	source
`github.com/pmezard/go-difflib/difflib`	`v1.0.0`	BSD-3-Clause	source
`github.com/remyoudompheng/go-liblzma`	`v0.0.0-20190506200333-81bf2d431b96`	BSD-3-Clause	source
`github.com/sirupsen/logrus`	`v1.9.3`	MIT	source
`github.com/stretchr/objx`	`v0.5.0`	MIT	source
`github.com/stretchr/testify`	`v1.8.1`	MIT	source
`github.com/ungerik/go-sysfs`	`v0.0.0-20190613143942-7f098ddb67a6`	MIT	source
`github.com/urfave/cli/v2`	`v2.1.1-minimal`	MIT	source
`golang.org/x/sys`	`v0.0.0-20220728004956-3c1f35247d10`	BSD-3-Clause	source
`golang.org/x/term`	`v0.0.0-20210927222741-03fcf44c2211`	BSD-3-Clause	source
`gopkg.in/yaml.v3`	`v3.0.1`	MIT	source

Device images

Images built from the meta-otapulse Yocto layer include additional open-source components beyond the agent, for example the Linux kernel, U-Boot, BusyBox and systemd. Many are licensed under the GPL, LGPL or other licenses. Yocto generates a license manifest for each image build, under deploy/licenses.

Bootloader compatibility layers

OTA-Pulse bootloader compatibility mode builds device images on top of board-integration Yocto layers from the Mender open-source project by Northern.tech AS. They are included unmodified in the OTA-Pulse source tree, each with its own LICENSE and a record of the exact upstream commit.

Component	Upstream project	Copyright	License
`meta-mender-core`, `meta-mender-qemu`	meta-mender (tag `scarthgap-v2026.09`)	Copyright Northern.tech AS	Apache-2.0
`meta-mender-raspberrypi`, `meta-mender-nxp`	meta-mender-community (commit `57f10880a166`)	Copyright Northern.tech AS and contributors	Apache-2.0
`grub-mender-grubenv`	grub-mender-grubenv (commit `6eabae13042a`)	Copyright Northern.tech AS	Apache-2.0

These layers also carry patch files that are applied to other projects at build time. Those patches use the license of the project they patch, not Apache-2.0. The U-Boot patches, for example the boot-code integration patches, are GPL-2.0-or-later. The GRUB patches are GPL-3.0-or-later. The systemd-boot patch is LGPL-2.1-or-later. The rng-tools patch used for QEMU images is GPL-2.0. The one Linux kernel patch used for QEMU images is GPL-2.0. The corresponding U-Boot, GRUB, systemd, rng-tools and kernel source is available from the upstream projects.

The commercial Mender layer is not included.

otapulse-convert is a modified copy of the image conversion tool mender-convert, tag 5.3.0. Our changes are a checked-in series of patch files in the OTA-Pulse source tree. They rename the options and messages, remove the upstream update client, and install the OTA-Pulse packages instead. The tool keeps the upstream LICENSE (Apache-2.0) and carries a NOTICE file with the attribution.

Names you may see in build logs and on devices

Bootloader compatibility mode and otapulse-convert are built on open-source board support from the Mender project. Some recipe, file, variable and unit names of that code carry the upstream name. We do not rename them, because the build system, the bootloader and the agent read them by name. Renaming one would break the image.

Nothing in the OTA-Pulse instructions asks you to run a tool with one of these names. If a message names one, fix the OTAPULSE_* variable the message points to. This list is here so you can recognize a name when you see it.

In BitBake output

Name	Where you see it
`grub-mender-grubenv-<version>`	The recipe that builds the GRUB boot configuration. Errors from a GRUB build start with it, for example `ERROR: grub-mender-grubenv-1.3.0+git6eabae13042a0f4128b15d9a7416cbf200f0853b-r0 do_compile: OTAPULSE_PANIC_TIMEOUT_S: the generated GRUB boot configuration sets panic=0 ...`. The recipe file is `meta-otapulse-bsp/core/recipes-bsp/grub-mender-grubenv/grub-mender-grubenv_git.bb`.
`meta-otapulse-bsp/...` class files, such as `mender-setup.bbclass`, `mender-part-images.bbclass`, `mender-helpers.bbclass`	File paths in BitBake warnings and tracebacks. The layer directory itself is `meta-otapulse-bsp`.
`mender`, `mender-qemu`, `mender-raspberrypi`, `mender-nxp`	Internal layer collection names of the board support layers.
Variables that start with `MENDER_`, for example `MENDER_FEATURES`, `MENDER_DEVICE_TYPE`, `MENDER_STORAGE_DEVICE`, `MENDER_ROOTFS_PART_A`	Build variables of the board support. Do not set them. Use the `OTAPULSE_*` variable instead.
Feature names `mender-image`, `mender-uboot`, `mender-grub`, `mender-image-sd`, `mender-image-uefi`, `mender-image-gpt`, `mender-auth-install`, `mender-update-install`	Derived from `OTAPULSE_BOOTLOADER` and `OTAPULSE_IMAGE_TYPE`. Never enable the two `-install` features. OTA-Pulse updates are always done by the OTA-Pulse agent.

Messages that carry these names, word for word:

MENDER_FEATURES is assigned directly at <file>:<line> (...). Do not set it. In bootloader mode the feature set is derived from OTAPULSE_BOOTLOADER and OTAPULSE_IMAGE_TYPE; remove the assignment.

Remove the MENDER_FEATURES line from your configuration.

OTAPULSE_BOOT_MODE = "bootloader" never installs a device-side update client, but your configuration enable(s) mender-auth-install via MENDER_FEATURES_ENABLE. OTA-Pulse updates are always performed by the OTA-Pulse agent. Remove it from your configuration and use the OTAPULSE_* variables instead ...

Remove the feature from MENDER_FEATURES_ENABLE. The same message appears for mender-update-install.

OTAPULSE_DEVICE_TYPE ("...") conflicts with MENDER_DEVICE_TYPE ("..."). Set OTAPULSE_DEVICE_TYPE only.

Set OTAPULSE_DEVICE_TYPE and remove the other.

soc-ota-agent: bootloader mode requires the root filesystem partition A to be defined by the board integration layer (MENDER_ROOTFS_PART_A is empty or unset); is the vendored board-integration layer (meta-otapulse-bsp/core) in bblayers.conf?

Add meta-otapulse-bsp/core to bblayers.conf.

On the device

Name	What it is
`mender_boot_part`	The U-Boot or GRUB environment variable that holds the active root partition number. `fw_printenv` lists it on a U-Boot device.
`mender_altbootcmd`, `mender_setup`, `mender_kernel_root`	U-Boot commands and variables of the boot script. U-Boot runs `altbootcmd` (`run mender_altbootcmd; run bootcmd`) when the boot limit is exceeded.
`/boot/efi/grub-mender-grubenv/`	The directory of the GRUB environment scripts on the EFI partition. It holds the two environment copies `mender_grubenv1` and `mender_grubenv2`.
`grub-mender-grubenv-print`, `grub-mender-grubenv-set`	The GRUB environment tools in `/usr/bin`. They read and write the GRUB environment.
`/etc/grub.d/mender`, `/etc/default/grub.d/mender`	GRUB configuration fragments on images made by `otapulse-convert`.
`/data/otapulse/mender-store*`	The files of the agent’s local state database. The agent code names its database this way, and the files are not renamed yet. Leave them alone.
`/etc/mender/scripts/version`	A version marker for the update state scripts.
`/usr/share/otapulse/identity/mender-device-identity`	A compatibility link to the OTA-Pulse device identity script.
`/usr/bin/mender`	A compatibility link to the agent. It exists on native images only.

In the log of `otapulse-convert`

The tool prints no upstream name in its command line, its messages, its option names or its file names. The debug log it writes (logs/convert.log.<time>) is the exception. It records every command and the shell trace of the bootloader scripts. So you can see names such as grub-mender-grubenv (a directory on the boot partition), mender_grubenv_defines (a file the bootloader scripts read) and 50_mender_default.cfg (an installed GRUB fragment). They are the real names of files on the image, so we do not filter or rewrite them. A failing bootloader step also prints these file names.

Web console and sites

The web console and the marketing and documentation sites are built with open-source JavaScript packages. Each package is distributed under its own license, listed in that package’s own metadata.

Other components

Component	License
Go standard library and toolchain	BSD-3-Clause
OpenSSL 3	Apache-2.0
liblzma / XZ Utils	0BSD (public domain)
PostgreSQL	PostgreSQL License
Grafana	AGPL-3.0
frp	Apache-2.0

Where to find license texts

Full license texts for the Go modules above are in the agent source distribution at soc-ota-agent/third_party_licenses/, and the source links in the table point to each upstream license. The agent package does not currently install these texts on the device. If you need license texts for any component listed here, contact binaryblack21@gmail.com.