mbeczynski · Nov 3, 2026 · Nov 3, 2026
diff --git a/README.md b/README.md
@@ -26,6 +26,9 @@ Machine destination (`tmutil setdestination` answers error 45), and refuses SMB
 to the Mac's own address. A share served from a machine on the Mac is what Time
 Machine still accepts. Why each layer inside it is there: [`vm/README.md`](vm/README.md).
 
+CloudMachine is an independent project, not affiliated with Apple or Google
+(see [Licence](#licence)).
+
 ---
 
 ## Requirements
@@ -47,9 +50,18 @@ so they read the same whoever sends them to you.
 - **Not notarised.** Releases are signed with a self-signed certificate, not
   with an Apple Developer ID. The Homebrew cask clears the quarantine flag; a
   DMG downloaded by hand gets Gatekeeper's "unidentified developer" warning.
-- **Google's daily upload limit and a full Drive are not named in the app.**
-  rclone's log that says so lives in the machine; what the app does show is
-  the backlog growing and the guard pausing Time Machine.
+- **No client-side encryption.** The backup's bands are stored on Google
+  Drive as they are, unencrypted by CloudMachine: anyone who can read the
+  Google account (and Google itself) can read the backup, which is a copy of
+  the whole Mac. Do not use it for data you may not hand to Google, such as
+  a company's or clients' data on a private Google account. Time Machine's
+  own "Encrypt backups" is not supported yet: `vm-prepare-bundle` refuses an
+  encrypted image.
+- **A full Google Drive is not named as such.** It shows up as an upload
+  that hangs and a growing backlog, with the guard pausing Time Machine.
+  Google's daily upload limit (750 GB) is named: `cloudmachine-agent
+  vm-status` and the backup-health notification say when it stops the
+  upload; the app window shows only the growing backlog.
 
 ---
 
@@ -157,6 +169,16 @@ type *Desktop*. Paste the client ID and secret into the **Google Drive
 Credentials (OAuth 2.0)** card at the bottom of the app window; it stores them
 in the macOS Keychain.
 
+**Publish the consent screen.** On the OAuth consent screen (Google Auth
+Platform → Audience), set the publishing status to **In production**. While
+it says *Testing*, Google issues refresh tokens that expire after 7 days, and
+the backup stops reaching Drive a week after you connect. With only the
+`drive.file` scope, which Google classes as non-sensitive, publishing does not
+require Google's verification. (A Google Workspace project with the
+*Internal* user type has no 7-day limit.) If the token has already expired,
+publish the screen and sign in again with the same credentials: the same
+client ID still sees the backup it created.
+
 They are not optional polish: rclone's shared `client_id` is being retired
 during 2026, and Google rate-limits per `client_id`, so on the shared one you
 compete with every other rclone user.
@@ -195,6 +217,18 @@ repository (`renacode-infra: docs/projekty/cloudmachine/`):
 
 ## Licence
 
-MIT. rclone, Lima and Samba keep their own licences. One file is GPLv2:
-`vm/punchfs/punchfs.c`, based on libfuse's passthrough example (see
-`vm/punchfs/README.md`).
+MIT (see [`LICENSE`](LICENSE)). One file is GPLv2:
+`vm/punchfs/punchfs.c`, based on libfuse's passthrough example; the licence
+text is in [`vm/punchfs/COPYING`](vm/punchfs/COPYING) and the changes are
+described in [`vm/punchfs/README.md`](vm/punchfs/README.md). The third-party
+code CloudMachine contains, and the software it installs without shipping it
+(rclone, Lima, Samba, Ubuntu), are listed with their licences in
+[`THIRD-PARTY-NOTICES.md`](THIRD-PARTY-NOTICES.md).
+
+### Trademarks
+
+Time Machine, Mac and macOS are trademarks of Apple Inc., registered in the
+U.S. and other countries. Google Drive is a trademark of Google LLC.
+CloudMachine is an independent project; it is not affiliated with, endorsed
+or sponsored by Apple or Google. The names are used only to say what
+CloudMachine works with.
diff --git a/THIRD-PARTY-NOTICES.md b/THIRD-PARTY-NOTICES.md
@@ -0,0 +1,88 @@
+# Third-party notices
+
+CloudMachine itself is MIT-licensed (see [`LICENSE`](LICENSE)). This file
+lists the third-party code it contains, and the third-party software it
+installs or downloads on your Mac without shipping it.
+
+## Shipped with CloudMachine
+
+These are in this repository and in `CloudMachine.app`
+(`Contents/Resources/vm/` holds the machine template, sources included).
+
+### punchfs - from libfuse (GPLv2)
+
+- File: [`vm/punchfs/punchfs.c`](vm/punchfs/punchfs.c)
+- Origin: `example/passthrough_ll.c` from
+  [libfuse](https://github.com/libfuse/libfuse) 3.14.0, the version in
+  Ubuntu 24.04.
+- Copyright (C) 2001-2007 Miklos Szeredi.
+- Licence: GNU General Public License, version 2. The full text is in
+  [`vm/punchfs/COPYING`](vm/punchfs/COPYING). This applies to that file
+  only: libfuse ships its examples under the GPLv2 (libfuse `LICENSE`).
+- Modified for CloudMachine in October 2026: `fallocate` falls back to
+  writing zeros, and extended attributes are kept in side files. What
+  changed and why: [`vm/punchfs/README.md`](vm/punchfs/README.md).
+- punchfs is built from this source inside the Linux machine on your Mac and
+  runs there as a separate program; it is not linked into the CloudMachine
+  app or agent.
+
+### passthrough_helpers.h - from libfuse (BSD 2-Clause)
+
+- File: [`vm/punchfs/passthrough_helpers.h`](vm/punchfs/passthrough_helpers.h),
+  unchanged from libfuse 3.14.0 `example/passthrough_helpers.h`.
+- Licence notice, as in the file:
+
+```
+FUSE: Filesystem in Userspace
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1. Redistributions of source code must retain the above copyright
+   notice, this list of conditions and the following disclaimer.
+2. Redistributions in binary form must reproduce the above copyright
+   notice, this list of conditions and the following disclaimer in the
+   documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE
+```
+
+### Swift Argument Parser (Apache-2.0 with Runtime Library Exception)
+
+- [apple/swift-argument-parser](https://github.com/apple/swift-argument-parser)
+  1.8.2 (`mac-app/Package.resolved`), compiled into the `cloudmachine-agent`
+  binary.
+- Copyright (c) 2020 Apple Inc. and the Swift project authors.
+- Licence: Apache License 2.0 with the Runtime Library Exception,
+  <https://github.com/apple/swift-argument-parser/blob/1.8.2/LICENSE.txt>.
+  The project has no `NOTICE` file.
+
+## Installed or downloaded on your Mac, not shipped
+
+CloudMachine does not redistribute these. It downloads them from their
+publishers, or asks you to install them, and each keeps its own licence.
+
+| Software | Licence | How it gets there |
+|---|---|---|
+| [rclone](https://rclone.org) | MIT | downloaded from `downloads.rclone.org` (checked against its published SHA-256 sums), on the Mac and in the machine |
+| [Lima](https://lima-vm.io) | Apache-2.0 | `brew install lima`, by you |
+| [Ubuntu 24.04 cloud image](https://cloud-images.ubuntu.com) | the licences of its packages; Canonical's IP policy | downloaded by Lima from `cloud-images.ubuntu.com` |
+| [Samba](https://www.samba.org) | GPL-3.0-or-later | `apt-get install samba` in the machine |
+| libfuse / fuse3 | library LGPL-2.1, tools GPL-2.0 | `apt-get install fuse3 libfuse3-dev` in the machine (punchfs links against it there) |
+| attr, curl, unzip, pkg-config, build-essential | their Ubuntu package licences | `apt-get install` in the machine |
+
+## Trademarks
+
+Time Machine, Mac and macOS are trademarks of Apple Inc. Google Drive is a
+trademark of Google LLC. CloudMachine is an independent project, not
+affiliated with, endorsed or sponsored by Apple or Google.