We would like to [contribute](https://github.com/cncf/toc/pull/991) [Flatcar](https://github.com/flatcar/Flatcar/) project to CNCF. However, few repos are licensed under licenses that are not not [CNCF Allowlist License Policy](https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md#cncf-allowlist-license-policy) and are not listed under [License exceptions](https://github.com/cncf/foundation/tree/main/license-exceptions).
We would like to ask for an exception for the following repositories that Flatcar uses:

Repo | Licence | Further information
-- | -- | -----
[flatcar/sysroot-wrappers](https://github.com/flatcar/sysroot-wrappers) | GPL-3.0 | This repository was forked from CoreOS container linux because the upstream repository was archived. It contains a low-level build helper utility which is not distributed with the OS image; the utility is only required at image build time. Sysroot-wrappers works in close relation with the GCC compiler and incorporates sources from the GCC project, which is licensed under GPL 3.0. Hence, the derivative is also GPL 3.0 licensed.
[flatcar/grub](https://github.com/flatcar/grub) | GPL-3.0 | Grub, the GRand Unified Bootloader, is a package shipped with the Flatcar OS image. The bootloader runs at early start-up and is responsible for loading Flatcar’s kernel and initrd. Artifacts built from this repository are distributed with the Flatcar OS image and are not released independently. We do not use the upstream GRUB release sources but maintain our own repository to ease development, which is currently in progress. We are planning to contribute back after development concludes and switch to using upstream sources (with our patches on top if necessary) in the future.
[flatcar/baselayout](https://github.com/flatcar/baselayout) | GPL-2 | Baselayout contains default configuration, filesystem content declarations, and early boot utilities that run at provisioning time to initialise the root file system. It was forked from CoreOS container linux because the upstream repository was archived. Artifacts built from this repository are distributed with the Flatcar OS image and are not released independently.
[flatcar/nss-altfiles](https://github.com/flatcar/nss-altfiles) | LGPL-2.1 | Nss-altfiles is a glibc plugin which enables user and group lookup in paths other than /etc. It was forked from CoreOS container linux because the upstream repository was archived. Artifacts built from this repository are distributed with the Flatcar OS image and are not released independently. We are investigating switching to systemd-userdbd instead. This could lead to the retirement of the nss-altfiles repository at a point in the future – the project would instead use upstream systemd releases directly.
[flatcar/bootengine](https://github.com/flatcar/bootengine) | BSD-2-Clause | This repository contains a number of modules required for building Flatcar’s init-ramdisk, and a number of scripts that run from the initrd. It was forked from CoreOS container linux because the upstream repository was archived. Artifacts built from this repository are distributed with the Flatcar OS image and are not released independently.
[flatcar/shim](https://github.com/flatcar/shim) | BSD 2-Clause | Shim is an UEFI stub that allows a secure, signed boot chain.The repository in the Flatcar org does not contain any changes from upstream Shim and is used for development.
[flatcar/scripts](https://github.com/flatcar/scripts) | BSD-3-Clause | Scripts is the main “distro” repository and contains build automation for CI and for release builds for both the SDK container as well as the OS image. It also contains package build instructions (“ebuilds”) for all packages, including pristine ebuild imports from Gentoo that retain their respective license. It is used for builds and versioning (reproducible builds). Scripts was forked from CoreOS container linux because the upstream repository was archived, and subsequently modified by Flatcar maintainers.
[flatcar/init](https://github.com/flatcar/init) | BSD-3-Clause | Init contains OS configuration and utilities. It was forked from CoreOS container linux because the upstream repository was archived. Artifacts built from this repository are distributed with the Flatcar OS image and are not released independently.
[flatcar/update_engine](https://github.com/flatcar/update_engine) | BSD-3-Clause | Update_engine handles OS updates. It was created for Chromium OS and later extended by CoreOS container Linux. It was forked from CoreOS container linux for Flatcar because the upstream repository was archived. Artifacts built from this repository are distributed with the Flatcar OS image, not released independently. The Flatcar project has started “ue-rs”, a new project under Apache 2.0 license, to eventually replace update_engine.
[flatcar/flatcar-dev-util](https://github.com/flatcar/flatcar-dev-util) | BSD-3-Clause | This repository contains a python script (“emerge-gitclone”) which is shipped with the Flatcar devcontainer. It was forked from CoreOS container linux because the upstream repository was archived. Artifacts built from this repository are distributed with the Flatcar OS image and are not released independently. The Flatcar Sysext initiative aims to replace the devcontainer with a suitable sysext, at which point this repository will be archived.
[flatcar/seismograph](https://github.com/flatcar/seismograph) | BSD-3-Clause | Seismograph contains utilities used at image build and run time to initialise and modify the OS disk image (for example the special GPT attributes for A/B booting). It was forked from CoreOS container linux for Flatcar because the upstream repository was archived.
[flatcar/nomad-on-flatcar](https://github.com/flatcar/nomad-on-flatcar) | MIT | Nomad-on-flatcar is a set of example configurations for running Flatcar Container Linux on Nomad. It serves as hands-on documentation for users; this repository does not generate artifacts and is not shipped in releases. It is based on[ fedora-coreos-nomad](https://github.com/travier/fedora-coreos-nomad) which is MIT licensed.

## Background:
The Flatcar Project consists of a total of 61 active repositories. Most repositories are licensed under the Apache 2.0 license. 12 are licensed differently since they build on existing work.
6 repositories are used for secrets storage, i.e. contain GPG-encrypted infrastructure secrets, and 1 repository contains infrastructure-as-code for the Flatcar build and release infrastructure – these repositories do not use any license.

The breakdown of the 61 active repositories total:
42 repositories are licensed under Apache 2.0
5 repositories are licensed under BSD 3-Clause
2 repositories are licensed under BSD 2-Clause
2 repositories are licensed under GPL-3.0
1 repository is licensed under GPL-2.0
1 repository is licensed under LGPL-2.1
1 repository is licensed under MIT
(and 7 repositories used for infrastructure automation without a license)

Like most Linux distributions, Flatcar Container Linux packages, builds, and ships many upstream projects’ releases that use a[ wide variety of licenses](https://alpha.release.flatcar-linux.net/amd64-usr/current/flatcar_production_image_licenses.json). Most of these releases are shipped without modification; some require amendments to integrate well with Flatcar. These Flatcar-specific changes reside in the “scripts” repo and are applied at build time on top of a pristine upstream source release for most upstreams that need amendments.

These Flatcar-specific changes are a one-time effort and usually do not require continued development - except for very few upstreams. For the upstreams that are under active development – these are very few - the Flatcar project maintains a fork of the upstream repo with Flatcar-specific changes included, and packages/builds reference the Flatcar development fork instead of the upstream repository (or release tarball).

The sole purpose of these forks is to provide a place for maintainers to focus their development. The upstream license is retained with the fork. We always aim to contribute back upstream – after which we switch back to the upstream sources, and the development fork is removed. None of the forked repositories’ projects are released separate from Flatcar; all repos are used as packaging/build sources for Flatcar OS and SDK releases.