docs(licenses): list kuberture and ouroboros - #649
Merged
Aleksei Sviridkin (lexfrei) merged 2 commits intoAug 19, 2026
Conversation
Both ship with the platform — ouroboros since v1.3.4, kuberture since v1.4.3 — and both are absent from the page that enumerates what Cozystack ships and under which licence. The omission carries meaning beyond a missing row. The page states that Cozystack-maintained components are Apache-2.0 and are not listed individually, so the list is the set of upstreams. Leaving these two off it left their status to inference at exactly the point where a reader is trying to establish it. Added to next and v1.6; earlier released versions keep their frozen snapshots. Assisted-By: Claude Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
Contributor
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughAdded license cards for the optional ChangesNetworking license documentation
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅ Deploy Preview for cozystack ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Merged
1 task
Andrei Kvapil (kvaps)
marked this pull request as ready for review
August 12, 2026 16:37
Andrei Kvapil (kvaps)
requested review from
Timofei Larkin (lllamnyp),
myasnikovdaniil and
Timur Tukaev (tym83)
as code owners
August 12, 2026 16:37
Timur Tukaev (tym83)
approved these changes
Aug 15, 2026
Aleksei Sviridkin (lexfrei)
approved these changes
Aug 19, 2026
Aleksei Sviridkin (lexfrei)
deleted the
docs/licenses-kuberture-ouroboros
branch
August 19, 2026 09:45
Andrei Kvapil (kvaps)
added a commit
to cozystack/cozystack
that referenced
this pull request
Aug 20, 2026
…3784) ## What this PR does Brings `GOVERNANCE.md` in line with the organisation it describes: what the project governs, and what it ships but does not. ### Sub-projects The `Code Repositories` list named seven repositories and was wrong in both directions. Five of the six sub-projects whose code ships in the distribution were missing from it — `etcd-operator`, `keycloak-kms-proxy`, `local-ccm`, `cozystack-scheduler` and `ingress-nginx-with-protobuf-exporter` — while `talos-bootstrap` and `talos-meta-tool` were listed although an adopter installs neither. Nothing stated what being on the list meant, which is why it drifted. It is replaced by a section organised around the distinction that decides scope: whether a repository's output reaches the artifact an adopter installs. Packaged sub-projects get a table naming what each one contributes, its stability, and its owners — the same handles each repository's `CODEOWNERS` already carries. Independent tooling, project infrastructure and upstream forks are described in a line each, as explicitly outside that scope. Three things an evaluator finds anyway are stated rather than left to be discovered: that one fork (`apimachinery`) is compiled into the product, why, and that the fix is proposed upstream as kubernetes/kubernetes#135537; that four repositories are private, with the reason for each, and that none of them contributes to the distribution; and that telemetry is received by a component adopters do not install, with a link to the opt-out. ### Third-party Dependencies Writes down which shipped components the project does not govern. Cozystack vendors software it does not own, which is ordinary and needs no defence — but the boundary was nowhere stated. This is a Required item on the Incubation checklist ("All project metadata and resources are vendor-neutral"), and an evaluator currently has nothing in the governance document to read it off. The section says two things: what the arrangement is, and where the components are listed. It names nothing itself. The [Licenses](https://cozystack.io/docs/v1.6/operations/configuration/licenses/) page carries the list, and by its own framing carries upstreams only — Cozystack-maintained components are Apache-2.0 and are not listed there individually. Appearing on that page is therefore already the classification, so a second list here would only drift from it. Two components that belong on that page were missing from it despite shipping since v1.3.4 and v1.4.3; cozystack/website#649 adds them. Nothing moves, nothing is relicensed, no mirroring changes. This documents the existing arrangement, which each package's `values.yaml` already describes at its own level. ### Downstream repositories Walked the trigger map in `docs/agents/contributing.md` against the diff. It touches `GOVERNANCE.md` only, and no trigger concerns governance documents — the website triggers are package additions, platform values, variants, components, release assets, `ApplicationDefinition` semantics, the Talos pin and developer tooling. The website PR linked above is a companion, not a consequence of this diff: it fixes a pre-existing gap on the Licenses page that stands on its own. - [x] No downstream repository is affected by this change ### Release note ```release-note NONE ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Added governance guidance for project sub-components, including ownership, licensing, maintenance, and repository classifications. * Documented project infrastructure, upstream forks, private repositories, and telemetry services. * Clarified how third-party software is sourced, governed, mirrored, and versioned. * Linked to a license inventory listing third-party components and their applicable licenses. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does
Adds
kubertureandouroborosto the Licenses page.Both ship with the platform —
ouroborossince Cozystack v1.3.4,kuberturesince v1.4.3 — and neither appears on the page that enumerates what Cozystack ships and under which licence. Both are otherwise documented on this site:kuberturehas its own page under Networking, andouroborosis covered by the hairpin/PROXY-protocol guide.The omission is worth more than a missing row. The page states that Cozystack-maintained components are Apache-2.0 and are not listed individually, which makes this list the set of upstream components. Leaving these two off it left their status to inference — at exactly the point where a reader is trying to establish it. This matters for the Incubation checklist item "All project metadata and resources are vendor-neutral": both are maintained by an individual who is also a Cozystack maintainer, so "is this an upstream or is it project code in a personal account?" is a question an evaluator will actually ask.
Placed in Networking after Hetzner RobotLB, which is the closest neighbour in kind — a third-party component maintained outside the organisation. No logo is passed; the shortcode renders an initials badge when the asset is absent.
Applied to
nextandv1.6. Earlier released versions keep their frozen snapshots.Companion change stating the same boundary in governance: cozystack/cozystack#3784.
Summary by CodeRabbit