[License Exception Request] [Keycloak] [Functional Source License] #1147
Description
For which CNCF project are you requesting exceptions?
Keycloak
Are you an official maintainer of this project?
Yes
List of components requiring an exception
| Component | Upstream URL | Project Usage URL | License(s) | Purpose |
|---|---|---|---|---|
| Liquibase | https://github.com/liquibase/liquibase | https://github.com/keycloak/keycloak/tree/main/model/jpa/src/main/resources/META-INF | Functional Source License | Incorporated code |
Are all of the components mandatory dependencies for the project to function as intended?
Yes
If no, please explain
No response
How will the components be included in or with the project's code and distributions?
- Incorporated codeVendored componentBuild-time dependencyBuild and test toolingInstall-time dependencyRequired upstream dependenciesOther (please describe below)
If any of the above selections don't apply to all of the components listed in the table above, please explain
No response
Which of the following best describes how the components interact with the project's own code?
- Static linking: e.g., compiled together with project code into a single binaryDynamic linking: e.g., compiled into a separate binary, running together with project code in a single address space at run-timeSeparate process: e.g., separate executable running in a different process space, interacting with project code only via mechanisms such as pipes, sockets, etc.Network interaction only: e.g., logically separated over a network and communicating only via mechanisms such as network API call, exchanging JSON data, etc.Other (please describe below)
If any of the above selections don't apply to all of the components listed in the table above, please explain
No response
Will any of the components be modified?
No
If yes, please specify which components will be modified, and briefly describe the purpose and nature of the modifications.
No response
Will the project be seeking to contribute the modifications back to the upstream project?
Yes
Metadata
Metadata
Assignees
Labels
Type
Projects
Milestone
Relationships
Development
No branches or pull requests
Participants
Activity
stianst commentedon Oct 7, 2025
Liquibase is changing their license from ASL 2.0 to FSL in a new coming major release.
Liquibase (binary) is included in the Keycloak distributions (zip, container) and used to provide DB schema migrations for supported databases. It would be a huge effort to replace Liquibase with something else.
From my understanding of FSL including Liquibase is not prohibited as Keycloak is not a commercial product, nor is it competing with Liquibase. I do find the change problematic from a perspective of the projects future though as that may prevent contributions to the project.
joannalee333 commentedon Oct 9, 2025
Hi @stianst,
FSL is a "source-available", non-open source license. Thus, we don't foresee any possibility that a license exception would be approved by the Governing Board (or recommended for approval by the Legal Committee) for it to be included in CNCF project binary releases. In the past, the GB and Legal Committee have not been willing to grant exceptions for dependencies subject to license terms that don't qualify as open source.
You may want to review the guidance at https://github.com/cncf/foundation/blob/main/policies-guidance/source-available-recommendations.md for more information