nv-mtucciarone · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026 · Sep 23, 2026
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -0,0 +1 @@
+This project is currently not accepting contributions.
diff --git a/Dockerfile b/Dockerfile
@@ -1,3 +1,5 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
 # Build the sidecar-injector binary
 FROM golang:1.26.7 AS builder
 
@@ -18,6 +20,10 @@ COPY pkg/ pkg/
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=${BUILDPLATFORM} go build -a -o ecr-anywhere-webhook ./cmd/webhook
 RUN CGO_ENABLED=0 GOOS=linux GOARCH=${BUILDPLATFORM} go build -a -o ecr-anywhere-refresher ./cmd/refresher
 
+# Third-party source for the notices in THIRD-PARTY.txt: vendor the exact module set
+# that was just compiled and pack it (see /usr/share/oss-source in the final stage)
+RUN go mod vendor && tar -czf /workspace/third-party-src.tar.gz -C /workspace vendor
+
 # OSRB-approved base; CGO_ENABLED=0 binaries need no libc. Already runs as
 # non-root (uid 1000), so the explicit USER is no longer required.
 FROM nvcr.io/nvidia/distroless/static:v4.0.0
@@ -28,5 +34,9 @@ WORKDIR /
 COPY --from=builder /workspace/ecr-anywhere-webhook .
 COPY --from=builder /workspace/ecr-anywhere-refresher .
 
+# Third-party notices and the corresponding source (license compliance; MPL-2.0 §3.2)
+COPY THIRD-PARTY.txt /THIRD-PARTY.txt
+COPY --from=builder /workspace/third-party-src.tar.gz /usr/share/oss-source/third-party-src.tar.gz
+
 # webhook is the default entrypoint
 ENTRYPOINT ["/ecr-anywhere-webhook"]
diff --git a/LICENSE b/LICENSE
@@ -1,3 +1,6 @@
+Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/

diff --git a/README.md b/README.md
@@ -104,3 +104,11 @@ spec:
   imagePullSecrets:
   - name: ecr-secret
 ```yaml
+
+## Contributing
+
+This project is currently not accepting contributions.
+
+## License
+
+Apache License 2.0 — see [LICENSE](LICENSE). Third-party notices: [THIRD-PARTY.txt](THIRD-PARTY.txt).
diff --git a/THIRD-PARTY.txt b/THIRD-PARTY.txt
diff --git a/charts/ecr-anywhere/templates/_helpers.tpl b/charts/ecr-anywhere/templates/_helpers.tpl
@@ -1,4 +1,8 @@
 {{/*
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+*/}}
+{{/*
 Expand the name of the chart.
 */}}
 {{- define "ecr-anywhere.name" -}}

diff --git a/cmd/refresher/main.go b/cmd/refresher/main.go
@@ -1,3 +1,7 @@
+/*
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
 package main
 
 import (

diff --git a/cmd/webhook/main.go b/cmd/webhook/main.go
@@ -1,3 +1,7 @@
+/*
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
 package main
 
 import (

diff --git a/pkg/credentials/credentials.go b/pkg/credentials/credentials.go
@@ -1,3 +1,7 @@
+/*
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
 package credentials
 
 import (

diff --git a/pkg/credentials/credentials_test.go b/pkg/credentials/credentials_test.go
@@ -1,3 +1,7 @@
+/*
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
 package credentials
 
 import (

diff --git a/pkg/loggers/loggers.go b/pkg/loggers/loggers.go
@@ -1,3 +1,7 @@
+/*
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
 package loggers
 
 import "log"

diff --git a/pkg/patching/main.go b/pkg/patching/main.go
@@ -1,3 +1,7 @@
+/*
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
 package patching
 
 type Operation struct {

diff --git a/pkg/webhook/webhook.go b/pkg/webhook/webhook.go
@@ -1,3 +1,7 @@
+/*
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
 package webhook
 
 import (

diff --git a/pkg/webhook/webhook_test.go b/pkg/webhook/webhook_test.go
@@ -1,3 +1,7 @@
+/*
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0
+*/
 package webhook
 
 import (
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		This project is currently not accepting contributions.