Open Source Components
Last updated: September 1, 2026
What this page is for
Kyvenza is a commercial, closed-source application, but it ships a handful of open source programs and libraries alongside it. Some of them are copyleft licensed, which means we owe you their source code, not just their names. This page is where we hand it over.
If anything here is incomplete, or if the sources do not build, that is a bug in our compliance and we want to hear about it: [email protected].
Download the sources
The archive below contains the complete corresponding source code for every copyleft component in Kyvenza 2.0.0, together with the scripts we use to configure, build, lay out, and sign them. GPLv2 section 3 explicitly covers those scripts, so they are part of the delivery, not an extra.
- Sources for Kyvenza 2.0.0 — QEMU and the LGPL libraries, plus our build scripts
- SHA256SUMS — checksums for every file in the archive
- uniation/kyvenza-oss — the build scripts and patches, in git, tagged per release
The two are not alternatives. The archive is the complete delivery, including the upstream tarballs, kept next to the installer so that it stays available even after upstream projects prune their old releases. The repository is the part we wrote: it carries history, so a patch we apply to QEMU shows up as a commit you can read rather than a file with no provenance. Each release's SHA256SUMS is committed there too, so the bytes we delivered can be checked against a record we cannot quietly rewrite.
Sources are published per release, at download.kyvenza.com/source/<version>/. That is deliberate: what we owe you is the source for the exact binary you are running, and different releases can bundle different versions of QEMU and its libraries. Older releases keep their own directory.
You can also request the sources on physical media or by email under GPLv2 section 3(b), and we will honour that offer for at least three years after we stop distributing the release in question.
What Kyvenza bundles
Every row below corresponds to a file that is really inside the application bundle. Components marked source provided are the copyleft ones and are included in the archive above; the rest carry permissive licenses that require attribution but not source delivery, so we link to their upstream projects instead of mirroring copies that would go stale.
| Component | License | Role | Source |
|---|---|---|---|
| QEMU | GPL-2.0 | Runs Windows guests on Apple’s Hypervisor framework | Source provided |
| GLib, GObject, GIO, GModule | LGPL-2.1-or-later | Core libraries QEMU and swtpm link against | Source provided |
| json-glib | LGPL-2.1-or-later | JSON parsing for swtpm | Source provided |
| gettext (libintl) | LGPL-2.1-or-later | Message translation used by GLib | Source provided |
| pixman | MIT | Pixel manipulation for the guest framebuffer | Upstream |
| libslirp | BSD-3-Clause | User-mode networking for guests | Upstream |
| PCRE2 | BSD-3-Clause | Regular expressions used by GLib | Upstream |
| swtpm & libtpms | BSD-3-Clause | The TPM 2.0 that Windows 11 requires | Upstream |
| OpenSSL | Apache-2.0 | Cryptography used by libtpms | Upstream |
| TianoCore EDK II | BSD-2-Clause-Patent | UEFI firmware with Secure Boot that boots Windows guests | Upstream |
| virtio-win drivers | BSD-3-Clause | Display, network, and serial drivers installed into Windows guests | Upstream |
The full text of the GNU General Public License v2 and the GNU Lesser General Public License v2.1 is included with the sources and is also readable inside the app, under About → Open Source Notices.
How QEMU relates to Kyvenza
Kyvenza runs QEMU as a separate process. It is started with fork/exec, it is never linked into the Kyvenza binary, and the only communication between the two is over QEMU's own published protocols: QMP for control and RFB (VNC) for the display, plus command-line arguments and standard I/O. Our RFB client is code we wrote and links no GPL library.
We treat that boundary as a hard architectural rule rather than an implementation detail, and it is enforced by tests in our build. Nothing in Kyvenza's own license terms restricts the rights that the GPL and LGPL grant you over these components.
Replacing a bundled library
The LGPL libraries ship as individual dynamic libraries in Kyvenza.app/Contents/Frameworks, with their install names rewritten to @loader_path. To use your own build of one of them, replace the file and re-sign the bundle:
- codesign --force --deep --sign - /Applications/Kyvenza.app
The same applies to qemu-system-aarch64 in Contents/Helpers. The README in the source archive walks through building each component and dropping it in.
This works with copies of Kyvenza downloaded from this site. Builds distributed through the Mac App Store are re-signed by Apple and validated against a receipt, so a modified bundle will not launch as a Mac App Store app; use the direct download if you intend to swap components.
Components in earlier releases
Releases before 1.1 also bundled the MIT-licensed Lume runtime by the team behind trycua/cua. No Lume code ships in Kyvenza today; the acknowledgment remains in the app's Open Source Notices out of gratitude.