Clarify dependencies

[lizrice]

Following TOC discussion I'm suggesting some clarification around the acceptability of dependencies

[VinodAnandan]

I think it's better to verify the OSS license compliance with all existing CNCF projects and see the practicality. I also think it's better to grant some time for existing and new projects to achieve the license compliance.

Few open questions

• How deep the dependency license check should be carried out?
• What if there are transitive dependencies without any license (unlicensed code)?

[lizrice]

@VinodAnandan this is something the CNCF legal team already do for projects coming into the CNCF

[caniszczyk]

We do an in depth license check every time a project is brought in and most of our projects end up adopting an automated solution like FOSSA/Snyk/etc e.g., https://app.fossa.com/attribution/3fb2fc80-0420-41d8-bd5e-adcaf06f3057

Internally in CNCF our lawyers do in depth license scans and send them to projects at least a couple times of year to resolve issues and/or create an exception/whitelist entry that's approved by the CNCF GB Legal Committee: https://github.com/cncf/foundation/blob/master/whitelist-policy.md