transtation
Copyright (c) 2026 sqzer

This project is licensed under the MIT License (see LICENSE).

transtation itself contains no third-party source code. It is a set of shell
scripts and one Dockerfile. The server image redistributes third-party binaries
unmodified; the native server install and the client install download them from
upstream and verify them instead. Their licenses and obligations follow.

================================================================================
Xray-core  --  redistributed in the image; downloaded by the native installer
================================================================================

Xray-core is licensed under the Mozilla Public License, Version 2.0 (MPL-2.0).

  Upstream project : https://github.com/XTLS/Xray-core
  Version shipped  : v26.3.27
  Exact artifact   : https://github.com/XTLS/Xray-core/releases/download/v26.3.27/Xray-linux-64.zip
                     https://github.com/XTLS/Xray-core/releases/download/v26.3.27/Xray-linux-arm64-v8a.zip
  Source Form      : https://github.com/XTLS/Xray-core/tree/v26.3.27

The `xray` binary in our image is the official upstream release artifact,
byte-for-byte unmodified. We do not patch, recompile, or statically link it
into anything. It is copied into the image as-is.

The native install (`install.sh server --native`) does not redistribute it at
all: it downloads the same release artifact from the URL above at install time,
verifies it against the `.dgst` published with that release, and installs it
under /usr/local/lib/transtation.

The Source Code Form of Xray-core is governed by the MPL-2.0. A copy of that
license is available at https://mozilla.org/MPL/2.0/ and is distributed with
the upstream source at the URL above.

The image ships no GeoIP or GeoSite data files. Those carry their own separate
licenses (CC-BY-SA / GPL-3.0 depending on the dataset) and none of them apply
here.

================================================================================
wgcf  --  redistributed in the image; downloaded by the native installer
================================================================================

wgcf is licensed under the MIT License.

  Upstream project : https://github.com/ViRb3/wgcf
  Version shipped  : v2.2.32
  Exact artifact   : https://github.com/ViRb3/wgcf/releases/download/v2.2.32/wgcf_2.2.32_linux_amd64
                     https://github.com/ViRb3/wgcf/releases/download/v2.2.32/wgcf_2.2.32_linux_arm64

The `wgcf` binary is the official upstream release artifact, unmodified. It is
used only once, at first boot, to register a Cloudflare WARP identity. It is
not part of the data path. As with Xray, the native install downloads and
verifies it rather than redistributing it.

Upstream's own disclaimer, reproduced verbatim:

  "This project is in no way affiliated with, authorized, maintained, sponsored
   or endorsed by Cloudflare or any of its affiliates or subsidiaries."

The same applies to transtation. Cloudflare WARP is a Cloudflare service, used
here through its documented client registration flow. Use of it is subject to
Cloudflare's own terms.

================================================================================
sing-box  --  NOT redistributed; downloaded from upstream by the installer
================================================================================

sing-box is licensed under the GNU General Public License, Version 3 or later
(GPL-3.0-or-later).

  Upstream project : https://github.com/SagerNet/sing-box
  Version pinned   : v1.13.16
  Fetched from     : https://github.com/SagerNet/sing-box/releases/download/v1.13.16/sing-box-1.13.16-linux-amd64-musl.tar.gz
                     https://github.com/SagerNet/sing-box/releases/download/v1.13.16/sing-box-1.13.16-linux-arm64-musl.tar.gz
  Source Form      : https://github.com/SagerNet/sing-box/tree/v1.13.16

transtation does not ship sing-box. `install.sh client` downloads the official
release artifact from the URL above, verifies it against a SHA-256 recorded in
this repository, and installs it. Nothing here links against it, embeds it or
derives from it; the client script invokes it as a separate program with a
generated configuration file.

Per upstream's request, transtation is not affiliated with or endorsed by the
sing-box project, and does not use its name to imply endorsement.

================================================================================
Alpine Linux base image
================================================================================

The server image is built FROM alpine:3.23 and installs `ca-certificates`,
`curl`, `jq` and `libqrencode-tools` from the Alpine package repositories. Those packages are distributed under their own licenses; run
`apk info -L <package>` inside the image for per-package details.
