Legal

Disclaimer, privacy and complaints

What this project vouches for, what it does not, who is responsible for a package, what data this site processes, and where to send a complaint. Plain statements, not a contract of adhesion.

No warranty, and use at your own risk

Everything here is provided as-is, with no warranty of any kind — express or implied, including merchantability, fitness for a particular purpose and non-infringement. This is the same term the licences already carry: owfeed is Apache-2.0, owlab is GPL-2.0-only, and every package in the feed has its own.

To the maximum extent permitted by applicable law, no liability is accepted for any damage, loss of data, loss of use, device malfunction or any other harm arising from the software, the feed, or these pages. You run this on your own equipment, at your own risk, and you decide whether to trust it.

The tools do not know what your package is

owlab starts test routers and runs assertions. owfeed packages a directory, signs artifacts and builds an index. Neither inspects what a package does, and neither has an opinion about it. They are build and distribution plumbing, in the same sense as tar, make or a web server.

What you build with them, and whether it is lawful where you and your users are, is entirely your decision and your responsibility.

The feed distributes; the author is responsible

owfeed-packages carries software written by other people. It is not rebuilt or modified here: what is distributed is what its author built and signed.

What the feed verifies: that a release came from the repository and tag pinned in this repository, that the author's signature over it checks against a key pinned in keys/, that the bytes match a recorded hash, and that the resulting tree installs on a stock OpenWrt image.

What the feed does not verify: what the code does; whether it is safe; whether it works or is fit for any purpose; whether it is lawful in any jurisdiction, including yours; whether its declared licence, description or other metadata are true.

A feed signature means one thing: these bytes are the ones this feed published, and they came from the author whose key is pinned here. It is a statement about the channel and about provenance — not about content, quality, safety, legality or suitability.

Responsibility for a package's contents, behaviour, security and lawfulness rests with its author, named in the package metadata and readable on the router with apk info <name>. Send questions and bug reports there.

Complaints and takedown

If you believe something distributed here is unlawful or infringes your rights, write to the address in /.well-known/security.txt or open a private advisory on the relevant repository.

What a notice must contain

These are the elements Article 16 of the EU Digital Services Act requires, and they are what makes a notice actionable:

1. a substantiated explanation of why you believe the material is unlawful or infringing;
2. the exact location — package name and version, and the URL under repo.owfeed.org if you have it;
3. your name and an email address, so the outcome can be sent to you;
4. a statement that you believe in good faith the notice is accurate and complete;
5. what right you hold or represent, for a copyright, trademark or licence claim.

Receipt is confirmed by reply. Notices are handled in the order they arrive, by one person.

What happens next

A notice that names a package and states a ground gets that package suspended from the feed while it is looked at. The author is told, with the notice, and given the chance to respond. If the claim holds, or the author does not respond, the package stays out, and the reason goes in the commit that removes it.

Disputes between an author and a claimant are not adjudicated here. A counter-statement is forwarded to the claimant; it does not by itself put the package back.

Repeat claims

An author whose packages are removed on repeated substantiated claims is removed from the feed and their signing key is unpinned. In practice that means two upheld claims, or an author who ignores forwarded notices. The removal is an ordinary commit and is visible in the history.

The same address takes security reports about the site, the feed infrastructure and the tools. For a vulnerability in a package, contact its author first.

Privacy

What this site is

owfeed.org and repo.owfeed.org are static files served by GitHub Pages. There are no accounts, no cookies, no analytics, no trackers, no third-party scripts, no fonts or images loaded from anywhere else. Nothing on these pages profiles you and nothing follows you between visits.

What is processed anyway

Serving a page necessarily involves your IP address and the request your browser makes. That processing is done by GitHub, Inc. as the hosting provider, under its own privacy statement. GitHub records such logs to keep the service running and secure.

The operator of this site has no access to those logs, receives no copy of them and cannot identify visitors. No server-side logging, storage or analysis of visitor data is done by this project.

Installing from the feed

When a router runs apk update or apk add, it makes ordinary HTTPS requests to repo.owfeed.org. The same applies: GitHub sees the request, this project does not receive the logs. No telemetry, phone-home or usage reporting is built into any package published here by this project. What a third-party package does once installed is a matter for its author and its own documentation.

Contributions

Issues, pull requests and commits are public and permanent, and they carry the name and email address you configure in git. That is a property of publishing on GitHub, and it is worth deciding about before you send a contribution rather than after.

Your rights, and who to ask

Where the GDPR applies, the rights of access, rectification, erasure, restriction, objection and portability run against whoever holds the data. For server logs that is GitHub, and requests should go to GitHub. For anything published in this project's repositories — a commit, an issue, an email address in a git trailer — write to the address in security.txt.

Trademarks

OpenWrt is a registered trademark of the Software Freedom Conservancy. ImmortalWrt, GitHub, GitLab and other names are the marks of their respective owners. This project is not affiliated with, endorsed by or sponsored by any of them, and package names carried by the feed belong to their authors.

Export control

owfeed and owlab use cryptography only for digital signatures and hashes — verifying and producing signatures over indexes, packages and manifests — through the Go standard library. Neither implements cryptography, and neither provides confidentiality or encryption of data. Functions limited to authentication, digital signature, data integrity and non-repudiation fall outside Category 5 Part 2 of the US Commerce Control List and the equivalent EU dual-use category.

This is a self-classification recorded so the question does not have to be answered from memory. It is not a determination by any authority. Anyone redistributing these tools, or software carried by the feed, in or into a sanctioned jurisdiction remains responsible for their own compliance.

Not legal advice

This page describes how the project works and what it does and does not claim. It is written by its maintainer, who is not a lawyer, and it is not legal advice to you. If your situation needs an answer that holds up, get one from someone qualified in your jurisdiction.