[License Exception Request] [OpenShell] [Unicode-3.0, CC0-1.0, CDLA-Permissive-2.0]

### For which CNCF project are you requesting exceptions?

OpenShell

### Are you an official maintainer of this project?

Yes

### List of components requiring an exception

| Component | Upstream URL | Project Usage URL | License(s) | Purpose |
|-----------|--------------|-------------------|------------|---------|
| icu_collections 2.2.0 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Transitive ICU4X dependency used by the URL and IDNA stack for Unicode-aware domain-name processing. |
| icu_locale_core 2.2.0 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Transitive ICU4X dependency providing locale identifiers used by Unicode processing. |
| icu_normalizer 2.2.0 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Provides Unicode normalization used transitively by IDNA domain-name processing. |
| icu_normalizer_data 2.2.0 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Provides normalization data required by the ICU4X normalization implementation. |
| icu_properties 2.2.0 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Provides Unicode character properties used transitively by IDNA processing. |
| icu_properties_data 2.2.0 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Provides character-property data required by ICU4X. |
| icu_provider 2.2.0 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Provides the data-provider framework used by ICU4X Unicode components. |
| litemap 0.8.2 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Provides compact map structures used internally by ICU4X. |
| potential_utf 0.1.5 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Provides UTF validation and representation used by ICU4X components. |
| tinystr 0.8.3 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Provides compact ASCII and Unicode string types used by ICU4X. |
| writeable 0.6.3 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Provides efficient formatting support used by ICU4X components. |
| yoke 0.8.2 and 0.8.3 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Provides zero-copy data ownership support used internally by ICU4X. |
| yoke-derive 0.8.2 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Supplies derive macros used by the ICU4X yoke component. |
| zerofrom 0.1.7 and 0.1.8 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Provides zero-copy conversion support used internally by ICU4X. |
| zerofrom-derive 0.1.7 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Supplies derive macros for ICU4X zero-copy conversions. |
| zerotrie 0.2.4 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Provides compact trie storage used for ICU4X Unicode data. |
| zerovec 0.11.6 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Provides zero-copy vector storage used by ICU4X data structures. |
| zerovec-derive 0.11.3 | https://github.com/unicode-org/icu4x | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | Unicode-3.0 | Supplies derive macros for ICU4X zero-copy vector types. |
| notify 8.2.0 | https://github.com/notify-rs/notify | https://github.com/NVIDIA/OpenShell/blob/main/crates/openshell-server/Cargo.toml | CC0-1.0 | Watches TLS and Kubernetes-related files so OpenShell can react safely to certificate and configuration changes. |
| webpki-root-certs 1.0.7 | https://github.com/rustls/webpki-roots | https://github.com/NVIDIA/OpenShell/blob/main/Cargo.lock | CDLA-Permissive-2.0 | Provides trusted CA certificate data used transitively for TLS platform verification. |
| webpki-roots 1.0.7 | https://github.com/rustls/webpki-roots | https://github.com/NVIDIA/OpenShell/blob/main/crates/openshell-supervisor-network/Cargo.toml | CDLA-Permissive-2.0 | Provides Mozilla CA roots for validating outbound TLS connections from sandbox supervisors. |

### Distribution and integration model

- [x] **CNCF-Distributed**: The CNCF project will distribute the dependency or the resulting combined artifacts to users.
- [x] **User-Fetched Dependency**: The CNCF project code will cause the user's system to automatically retrieve the dependency from an upstream source at build, install, or runtime.
- [ ] **System Component**: The CNCF project expects that the dependency will either already be present on the user's system or will be installed independently by the user.
- [ ] **Not Distributed + Not Needed by End User (Internal Project Tooling)**: ALL of the following are true:

### Distribution and integration model — explanation

OpenShell distributes prebuilt binaries and container images containing these statically linked Rust dependencies or their data. Users building OpenShell from source retrieve the dependencies from crates.io through Cargo using versions pinned in Cargo.lock. The dependency source is not vendored in the OpenShell repository.

### Modification status

- [ ] **Modified Upstream**: The CNCF project will patch, alter, or otherwise modify the source code of the dependency and contribute upstream.
- [ ] **Modified Downstream**: The CNCF project will patch, alter, or otherwise modify the source code of the dependency and maintain a downstream fork or local copy.
- [x] **Unmodified**: The CNCF project will use the dependency exactly as provided by the upstream maintainers without any changes to its source code.

### Modification status — explanation

OpenShell uses the upstream crates without source modifications, downstream patches, or maintained forks.

### Structural separation

- [x] **Separated Component**: The dependency's code will either be (a) kept in a distinct directory or module clearly separated from CNCF project code, or (b) retrieved at build/installation time from a third-party repository and never stored in the CNCF project repository.
- [ ] **Intermingled Code**: The dependency's code will be "mixed in" with CNCF source files, copied into existing project files, or will otherwise lose its distinct directory/module boundary.

### Structural separation — explanation

The dependencies remain distinct upstream Cargo packages. They are retrieved from crates.io during builds and are not copied into or intermingled with OpenShell source files.

### Communication mechanism

- [x] **Static Linking**: The dependency and the CNCF project code will be combined into a single binary or similar type of artifact during the build process.
- [ ] **Dynamic Linking**: The CNCF project code will interact with the dependency by loading it into the shared address space (memory) at run-time. This includes traditional shared objects compiled into a separate binary, as well as runtime module loading in interpreted or JIT-compiled languages.
- [ ] **Separate Process**: The dependency and the CNCF project code will run as distinct executables and communicate via Inter-Process Communication (e.g., pipes, sockets, or shared files)
- [ ] **Network Interaction**: The dependency and the CNCF project code will be logically and physically separated by a network boundary, with the CNCF project's code acting as a client or consumer of the remote service and interacting with the dependency exclusively via standardized network protocols.

### Communication mechanism — explanation

Cargo compiles these Rust libraries and associated data into OpenShell binaries. They are not separately loaded services or processes.

### Data exchange

- [x] **Tightly Coupled**: The upstream dependency and CNCF project code will exchange complex internal data structures such as shared pointers, class instances, or private memory offsets that require extensive knowledge of the other component's internal memory layout.
- [ ] **Arms-Length Only**: The communication between the dependency and the CNCF project code will be limited to standard serialized data (e.g., JSON, XML, or Protobuf) where data is "flattened" for transport and neither component accesses the other's internal memory structures.

### Data exchange — explanation

OpenShell and its transitive dependencies interact through in-process Rust APIs, types, and compiled data structures within the resulting binaries.

### Additional information — explanation

OpenShell is currently applying for CNCF Sandbox membership at https://github.com/cncf/sandbox/issues/522.

These dependencies use permissive licenses. Unicode-3.0 covers Unicode software and data; CC0-1.0 is a public-domain dedication with a permissive fallback; and CDLA-Permissive-2.0 is a permissive data license. OpenShell does not modify or vendor these components.

The ICU4X components are introduced transitively through the Rust idna and url dependency chain and are broadly used for standards-compliant Unicode domain-name handling. notify is a direct dependency used for filesystem change monitoring. The webpki components supply trusted CA certificate data for TLS verification.

We found a historical blanket exception for webpki-roots under its former MPL-2.0 license, but the current 1.0.7 release declares CDLA-Permissive-2.0. We are therefore requesting approval for the current license rather than assuming that the earlier exception applies.