René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[License Exception Request] [wasmCloud] [CDLA-Permissive-2.0] webpki-roots","articleBody":"### For which CNCF project are you requesting exceptions?\n\nwasmCloud\n\n### Are you an official maintainer of this project?\n\nYes\n\n### List of components requiring an exception\n\n| Component | Upstream URL | Project Usage URL | License(s) | Purpose |\n|-----------|-----------|-----------|-----------|-----------|\n| webpki-roots 1.0.10 | https://github.com/rustls/webpki-roots | https://github.com/wasmCloud/wasmCloud/blob/main/crates/wash-runtime/Cargo.toml | CDLA-Permissive-2.0 | Mozilla's CA root certificate set, used as the TLS trust store for outbound connections (HTTP egress, OCI registries, Postgres, OTLP export) |\n\n\n### Distribution and integration model\n\n- [x] **CNCF-Distributed**: The CNCF project will distribute the dependency or the resulting combined artifacts to users.\n- [ ] **User-Fetched Dependency**: The CNCF project code will cause the user's system to automatically retrieve the dependency from an upstream source at build, install, or runtime.\n- [ ] **System Component**: The CNCF project expects that the dependency will either already be present on the user's system or will be installed independently by the user.\n- [ ] **Not Distributed + Not Needed by End User (Internal Project Tooling)**: ALL of the following are true:\n\n### Distribution and integration model — explanation\n\n`webpki-roots` is a direct dependency of the Apache-2.0 `wash-runtime` crate (the wasmCloud host runtime) and also arrives through `hyper-rustls` and `reqwest`. It is compiled into the `wash` binary, which wasmCloud publishes on GitHub Releases and in the wasmCloud host container images. The bundled root set lets the host verify TLS servers the same way on every platform, independent of the operating system's trust store.\n\n\n### Modification status\n\n- [ ] **Modified Upstream**: The CNCF project will patch, alter, or otherwise modify the source code of the dependency and contribute upstream.\n- [ ] **Modified Downstream**: The CNCF project will patch, alter, or otherwise modify the source code of the dependency and maintain a downstream fork or local copy.\n- [x] **Unmodified**: The CNCF project will use the dependency exactly as provided by the upstream maintainers without any changes to its source code.\n\n### Modification status — explanation\n\nThe crate is consumed at its published crates.io version with no `[patch]` override or local copy.\n\n\n### Structural separation\n\n- [x] **Separated Component**: The dependency's code will either be (a) kept in a distinct directory or module clearly separated from CNCF project code, or (b) retrieved at build/installation time from a third-party repository and never stored in the CNCF project repository.\n- [ ] **Intermingled Code**: The dependency's code will be \"mixed in\" with CNCF source files, copied into existing project files, or will otherwise lose its distinct directory/module boundary.\n\n### Structural separation — explanation\n\nThe crate is not vendored. Cargo fetches it from crates.io at build time; the repository references it only through `Cargo.toml` and `Cargo.lock`.\n\n\n### Communication mechanism\n\n- [x] **Static Linking**: The dependency and the CNCF project code will be combined into a single binary or similar type of artifact during the build process.\n- [ ] **Dynamic Linking**: The CNCF project code will interact with the dependency by loading it into the shared address space (memory) at run-time. This includes traditional shared objects compiled into a separate binary, as well as runtime module loading in interpreted or JIT-compiled languages.\n- [ ] **Separate Process**: The dependency and the CNCF project code will run as distinct executables and communicate via Inter-Process Communication (e.g., pipes, sockets, or shared files)\n- [ ] **Network Interaction**: The dependency and the CNCF project code will be logically and physically separated by a network boundary, with the CNCF project's code acting as a client or consumer of the remote service and interacting with the dependency exclusively via standardized network protocols.\n\n### Communication mechanism — explanation\n\nAs with any Rust crate dependency, the crate is compiled and statically linked into the `wash` binary.\n\n\n### Data exchange\n\n- [x] **Tightly Coupled**: The upstream dependency and CNCF project code will exchange  complex internal data structures such as shared pointers, class instances, or private memory offsets that require extensive knowledge of the other component's internal memory layout.\n- [ ] **Arms-Length Only**: The communication between the dependency and the CNCF project code will be limited to standard serialized data (e.g., JSON, XML, or Protobuf) where data is \"flattened\" for transport and neither component accesses the other's internal memory structures.\n\n### Data exchange — explanation\n\nwasmCloud reads the crate's public `TLS_SERVER_ROOTS` constant in-process and passes it to rustls as a root certificate store. The crate is a static table of certificate data with no behavior of its own.\n\n\n### Additional information — explanation\n\nThe Governing Board approved this same component for OpenTelemetry on June 25, 2025 (https://github.com/cncf/foundation/issues/1007). The CDLA-Permissive-2.0 license covers the certificate data, which `webpki-roots` derives from Mozilla's CA program.\n\nWe would also like confirmation on one license that the audit could not resolve. Wasmtime, Cranelift and related crates (42 crates in the `wash` binary, including `wasmtime`, `cranelift-codegen`, `regalloc2` and `wasm-pkg-client`) are licensed only as `Apache-2.0 WITH LLVM-exception`. The LLVM exception adds permissions to Apache-2.0 and removes none, so we believe no exception is needed, but the expression is not on the allowlist and we found no prior guidance in this repository. Could staff confirm whether these components need an exception request?","author":{"url":"https://github.com/ricochet","@type":"Person","name":"ricochet"},"datePublished":"2026-10-21T14:06:19Z","url":"https://github.com/cncf/foundation/issues/1582"}