nv-mtucciarone · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -0,0 +1 @@
+This project is currently not accepting contributions.
diff --git a/Dockerfile b/Dockerfile
@@ -1,3 +1,6 @@
+# Portions derived from github.com/morvencao/kube-sidecar-injector (Apache License 2.0); modified by NVIDIA.
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
 # Build the sidecar-injector binary
 FROM golang:1.26.7 AS builder
 
@@ -16,6 +19,10 @@ COPY pkg/ pkg/
 # Build
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=${BUILDPLATFORM} go build -a -o simple-sidecar ./cmd
 
+# Third-party source for the notices in THIRD-PARTY.txt: vendor the exact module set
+# that was just compiled and pack it (see /usr/share/oss-source in the final stage)
+RUN go mod vendor && tar -czf /workspace/third-party-src.tar.gz -C /workspace vendor
+
 
 # OSRB-approved base; CGO_ENABLED=0 binary needs no libc. Already runs as
 # non-root (uid 1000), so the explicit USER is no longer required.
@@ -29,4 +36,8 @@ WORKDIR /
 # install binary
 COPY --from=builder /workspace/simple-sidecar .
 
+# Third-party notices and the corresponding source (license compliance; MPL-2.0 §3.2)
+COPY THIRD-PARTY.txt /THIRD-PARTY.txt
+COPY --from=builder /workspace/third-party-src.tar.gz /usr/share/oss-source/third-party-src.tar.gz
+
 ENTRYPOINT ["/simple-sidecar"]
diff --git a/LICENSE b/LICENSE
@@ -1,3 +1,6 @@
+Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/

diff --git a/README.md b/README.md
@@ -1,6 +1,6 @@
 # Simple Sidecar (Injector)
 
-This repo was originally forked from [morvencao's kube-sidecar-injector](https://github.com/morvencao/kube-sidecar-injector). It's been productionized and turned into a simple generic Kubernetes sidecar injector (using a [Kubernetes MutatingAdmissionWebhook](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#mutatingadmissionwebhook)).
+This repo was originally forked from [morvencao's kube-sidecar-injector](https://github.com/morvencao/kube-sidecar-injector) (Apache License 2.0; see [THIRD-PARTY.txt](THIRD-PARTY.txt) for the derived files and all third-party notices). It's been productionized and turned into a simple generic Kubernetes sidecar injector (using a [Kubernetes MutatingAdmissionWebhook](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#mutatingadmissionwebhook)).
 
 
 ## Quick Start 
@@ -210,5 +210,12 @@ This let's you leverage functionality that might be provided by your injected co
 
 Follow the documentation related to [installing cert-manager](https://cert-manager.io/docs/) and then using it's [CA Injector functionality](https://cert-manager.io/docs/concepts/ca-injector/. 
 
-Setup a [self signed certificate](https://cert-manager.io/docs/configuration/selfsigned/) which will auto update to the secret location you've configured simple-sidecar to use. 
+Setup a [self signed certificate](https://cert-manager.io/docs/configuration/selfsigned/) which will auto update to the secret location you've configured simple-sidecar to use.
 
+## Contributing
+
+This project is currently not accepting contributions.
+
+## License
+
+Apache License 2.0 — see [LICENSE](LICENSE). Third-party notices: [THIRD-PARTY.txt](THIRD-PARTY.txt).
diff --git a/THIRD-PARTY.txt b/THIRD-PARTY.txt
diff --git a/charts/simple-sidecar/templates/_helpers.tpl b/charts/simple-sidecar/templates/_helpers.tpl
@@ -1,4 +1,8 @@
 {{/*
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{/*
 Expand the name of the chart.
 */}}
 {{- define "simple-sidecar.name" -}}

diff --git a/cmd/cert.go b/cmd/cert.go
@@ -1,3 +1,7 @@
+/*
+Derived unmodified from github.com/morvencao/kube-sidecar-injector (cmd/cert.go), licensed under the Apache License 2.0.
+SPDX-License-Identifier: Apache-2.0
+*/
 package main
 
 import (

diff --git a/cmd/main.go b/cmd/main.go
@@ -1,3 +1,8 @@
+/*
+Portions derived from github.com/morvencao/kube-sidecar-injector (Apache License 2.0); modified by NVIDIA.
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
 package main
 
 import (

diff --git a/examples/certs.sh b/examples/certs.sh
@@ -1,4 +1,6 @@
 #!/bin/bash 
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
 
 # Exit on error
 set -e

diff --git a/pkg/webhook/webhook.go b/pkg/webhook/webhook.go
@@ -1,3 +1,8 @@
+/*
+Portions derived from github.com/morvencao/kube-sidecar-injector (Apache License 2.0); modified by NVIDIA.
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
 package webhook
 
 import (

diff --git a/pkg/webhook/webhook_test.go b/pkg/webhook/webhook_test.go
@@ -1,3 +1,7 @@
+/*
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
 package webhook
 
 import (

diff --git a/tester/tester.go b/tester/tester.go
@@ -1,3 +1,7 @@
+/*
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
 package main
 
 import (
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		This project is currently not accepting contributions.