René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[License Exception Request] [Cozystack] [MPL-2.0] Sidero Labs Go libraries statically linked into talm","articleBody":"### For which CNCF project are you requesting exceptions?\n\nCozystack\n\n### Are you an official maintainer of this project?\n\nYes\n\n### List of components requiring an exception\n\n| Component | Upstream URL | Project Usage URL | License(s) | Purpose |\n|---|---|---|---|---|\n| github.com/siderolabs/talos (incl. pkg/machinery) | https://github.com/siderolabs/talos | https://github.com/cozystack/talm/blob/main/go.mod | MPL-2.0 | Talos API client and machine-config types used by talm to render, apply and upgrade Talos node configuration |\n| github.com/siderolabs/crypto | https://github.com/siderolabs/crypto | https://github.com/cozystack/talm/blob/main/go.mod | MPL-2.0 | PKI helpers used when generating Talos machine secrets |\n| github.com/siderolabs/gen, go-api-signature, go-circular, go-cmd, go-kubeconfig, go-kubernetes, go-pointer, go-procfs, go-retry, go-talos-support, net, proto-codec, protoenc | https://github.com/siderolabs | https://github.com/cozystack/talm/blob/main/go.mod | MPL-2.0 | Transitive Go libraries pulled in by the Talos client packages |\n\n### Distribution and integration model\n\n- [x] **CNCF-Distributed**: The CNCF project will distribute the dependency or the resulting combined artifacts to users.\n- [ ] **User-Fetched Dependency**\n- [ ] **System Component**\n- [ ] **Not Distributed + Not Needed by End User (Internal Project Tooling)**\n\n### Please explain\n\ntalm is a CLI for managing Talos Linux configuration declaratively. Per Cozystack's [GOVERNANCE.md](https://github.com/cozystack/cozystack/blob/main/GOVERNANCE.md) it is independent tooling governed by the project but not part of the Cozystack distribution: adopters can install Cozystack without it. talm itself is Apache-2.0; the libraries listed above are compiled into the talm binaries published on GitHub Releases (https://github.com/cozystack/talm/releases), so they are distributed by the project. We are filing on the side of caution, as advised during Incubation due diligence.\n\n`github.com/hashicorp/go-multierror` and `github.com/hashicorp/errwrap` (MPL-2.0) are also in the dependency tree; they are already covered by the existing all-projects exception and are not part of this request.\n\n### Modification status\n\n- [ ] **Modified Upstream**\n- [ ] **Modified Downstream**\n- [x] **Unmodified**: The CNCF project will use the dependency exactly as provided by the upstream maintainers without any changes to its source code.\n\n### Please explain\n\nAll Sidero Labs modules are consumed at their upstream tagged versions through Go modules with no `replace` directives. talm previously replaced `siderolabs/talos` with a fork for a single client flag; that feature was reimplemented in talm's own Apache-2.0 code against the stock upstream client, and the fork is no longer used.\n\n### Structural separation\n\n- [x] **Separated Component**: The dependency's code will either be (a) kept in a distinct directory or module clearly separated from CNCF project code, or (b) retrieved at build/installation time from a third-party repository and never stored in the CNCF project repository.\n- [ ] **Intermingled Code**\n\n### Please explain\n\nThe dependencies are not stored in the talm repository (no `vendor/` directory); they are fetched from the upstream module proxy at build time and referenced only via `go.mod` / `go.sum`.\n\n### Communication mechanism\n\n- [x] **Static Linking**: The dependency and the CNCF project code will be combined into a single binary or similar type of artifact during the build process.\n- [ ] **Dynamic Linking**\n- [ ] **Separate Process**\n- [ ] **Network Interaction**\n\n### Please explain\n\nAs with any Go program, the imported packages are statically linked into the talm binary. At runtime talm talks to Talos nodes over the network via the Talos gRPC API.\n\n### Data exchange\n\n- [ ] **Tightly Coupled**\n- [x] **Arms-Length Only**: The communication between the dependency and the CNCF project code will be limited to standard serialized data (e.g., JSON, XML, or Protobuf) where data is \"flattened\" for transport and neither component accesses the other's internal memory structures.\n\n### Please explain\n\nWithin the binary, talm calls the libraries' public Go APIs (client constructors, config types). Across the process boundary, all exchange with Talos nodes is Protobuf over gRPC and YAML machine configuration.\n\n### Additional information\n\nMPL-2.0 is file-level copyleft: it does not extend to talm's own Apache-2.0 source files, and the MPL-covered files remain available unmodified from upstream. Related Cozystack requests for Talos components: #1539 (Talos Linux images, CABPT manifests) and #1466. Filed as part of Cozystack's Incubation due diligence (cncf/toc#1916), at the reviewer's suggestion.\n","author":{"url":"https://github.com/tym83","@type":"Person","name":"tym83"},"datePublished":"2026-09-25T23:57:27Z","url":"https://github.com/cncf/foundation/issues/1541"}