kyverno/NOTICE at main · volantebjb/kyverno · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
Kyverno
Copyright The Kyverno Authors

This product includes software developed by the Kyverno project
(https://kyverno.io) and its contributors.

---

This product bundles third-party software. The full list of dependencies
is declared in go.mod and pinned by content hash in go.sum. License
compliance is audited on every push to main via FOSSA
(https://app.fossa.com/projects/git%2Bgithub.com%2Fkyverno%2Fkyverno).

The dependency summary below was produced from the kyverno module
dependency graph (go-licenses report ./cmd/kyverno/...) and covers the
following license categories:

  Apache-2.0: 197 packages
  MIT:          93 packages
  BSD-3-Clause: 47 packages
  MPL-2.0:      13 packages
  BSD-2-Clause:  4 packages
  ISC:           1 package
  BSD-2-Clause-FreeBSD: 1 package

The full machine-readable license inventory (package, license URL,
SPDX identifier) is available at:

  https://app.fossa.com/projects/git%2Bgithub.com%2Fkyverno%2Fkyverno

---

Notable third-party components and their copyright notices:

Kubernetes (k8s.io/*) — Apache-2.0
Copyright 2014 The Kubernetes Authors.

controller-runtime (sigs.k8s.io/controller-runtime) — Apache-2.0
Copyright 2018 The Kubernetes Authors.

OPA / Rego (github.com/open-policy-agent/opa) — Apache-2.0
Copyright 2016 The OPA Authors. All rights reserved.

cosign / sigstore (github.com/sigstore/*) — Apache-2.0
Copyright 2021 The Sigstore Authors.

Prometheus client (github.com/prometheus/client_golang) — Apache-2.0
Copyright 2012-2015 The Prometheus Authors.

CUE (cuelang.org/go) — Apache-2.0
Copyright 2019 CUE Authors.

Go extended modules (golang.org/x/*) — BSD-3-Clause
Copyright 2009 The Go Authors.

Helm (helm.sh/helm/v3) — Apache-2.0
Copyright The Helm Authors.

---

The Apache License 2.0 (§4(d)) requires that, where an upstream Work
includes a NOTICE file, a readable copy of the attribution notices
contained within it must accompany any redistribution. This NOTICE file
satisfies that requirement for the Kyverno project itself. FOSSA scans
are used to detect upstream NOTICE content from dependencies that may
require propagation.

---

This NOTICE file was last updated: 2026-05-21
To produce a per-package license report: go install github.com/google/go-licenses@v1.6.0 && go-licenses report ./cmd/kyverno/...
This NOTICE is maintained manually; the command above outputs a CSV that can be used to verify or update the counts and notable components above.