Editions & licensing
Open-core model — what's in the Community core vs. licensed Enterprise components, and how licensing works.
Open core
kvellman is open core. The platform — including multi-user accounts with roles and the approval workflow — is open source under Apache-2.0. A small number of components are licensed plugins that activate only with a valid Enterprise entitlement.
Community · Apache-2.0
Everything you need to run a production origin: the winget Source API, manifests, overlays and upstream import, multi-user accounts with viewer/reviewer/admin roles, the approval workflow and audit log, and air-gapped operation.
Enterprise
Adds SSO (OIDC) and MFA (TOTP) as licensed auth plugins, and the edge node component for serving additional locations from a local cache.
| Community | Enterprise | |
|---|---|---|
| License | Apache-2.0 | Commercial subscription |
| Accounts | Multi-user, roles (viewer/reviewer/admin) | Same, plus SSO (OIDC) & MFA (TOTP) |
| Approval workflow & audit log | Included | Included |
| Additional locations | — | Edge node component |
| Air-gapped operation | Included | Included |
See pricing for the full comparison.
How licensing works
Enterprise features are gated by an offline, signature-based license — no activation server, so it works air-gapped:
- A license is an Ed25519-signed token issued by the vendor.
- The product ships only the public key and verifies the token locally.
- The token lists the customer and the active entitlements (e.g.
sso,mfa) and an expiry. - An admin pastes the token in the UI; matching plugins activate immediately — no restart, no internet required.
Because verification is local, even the full open-source code cannot forge a valid license without the vendor's private key.
Developer packages
The shared, public building blocks are on npm under Apache-2.0:
@kvellman/winget-contract— the winget REST/types contract shared by origin and nodes.@kvellman/plugin-sdk— types for building auth/entitlement plugins.