[License Exception Request] [Backstage] [Remix Icon License v1.0]

[Rugvip]

For which CNCF project are you requesting exceptions?

Backstage

Are you an official maintainer of this project?

Yes

List of components requiring an exception

Component	Upstream URL	Project Usage URL	License(s)	Purpose
RemixIcon	https://remixicon.com/	https://github.com/Remix-Design/RemixIcon	Remix Icon License v1.0	Icon library for Web UI

Distribution and integration model

• CNCF-Distributed: The CNCF project will distribute the dependency or the resulting combined artifacts to users.
• User-Fetched Dependency: The CNCF project code will cause the user's system to automatically retrieve the dependency from an upstream source at build, install, or runtime.
• System Component: The CNCF project expects that the dependency will either already be present on the user's system or will be installed independently by the user.
• Not Distributed + Not Needed by End User (Internal Project Tooling): ALL of the following are true:

Please explain

The library is installed as an NPM dependency in projects built using the Backstage framework.

Modification status

• Modified Upstream: The CNCF project will patch, alter, or otherwise modify the source code of the dependency and contribute upstream.
• Modified Downstream: The CNCF project will patch, alter, or otherwise modify the source code of the dependency and maintain a downstream fork or local copy.
• Unmodified: The CNCF project will use the dependency exactly as provided by the upstream maintainers without any changes to its source code.

Please explain

No modifications are made, it can be used directly as is.

Structural separation

• Separated Component: The dependency's code will either be (a) kept in a distinct directory or module clearly separated from CNCF project code, or (b) retrieved at build/installation time from a third-party repository and never stored in the CNCF project repository.
• Intermingled Code: The dependency's code will be "mixed in" with CNCF source files, copied into existing project files, or will otherwise lose its distinct directory/module boundary.

Please explain

The dependency is retreived at installation time from the NPM package registry.

Communication mechanism

• Static Linking: The dependency and the CNCF project code will be combined into a single binary or similar type of artifact during the build process.
• Dynamic Linking: The CNCF project code will interact with the dependency by loading it into the shared address space (memory) at run-time. This includes traditional shared objects compiled into a separate binary, as well as runtime module loading in interpreted or JIT-compiled languages.
• Separate Process: The dependency and the CNCF project code will run as distinct executables and communicate via Inter-Process Communication (e.g., pipes, sockets, or shared files)
• Network Interaction: The dependency and the CNCF project code will be logically and physically separated by a network boundary, with the CNCF project's code acting as a client or consumer of the remote service and interacting with the dependency exclusively via standardized network protocols.

Please explain

Resulting Backstage web apps will be compiled into bundles of minified JavaScript code with the imports from the RemixIcon library becoming embedded within the object-like output similar to a statically linked binary. This is done by adopters of Backstage, the object form is not provided by the Backstage project itself.

Data exchange

• Tightly Coupled: The upstream dependency and CNCF project code will exchange complex internal data structures such as shared pointers, class instances, or private memory offsets that require extensive knowledge of the other component's internal memory layout.
• Arms-Length Only: The communication between the dependency and the CNCF project code will be limited to standard serialized data (e.g., JSON, XML, or Protobuf) where data is "flattened" for transport and neither component accesses the other's internal memory structures.

Please explain

The interaction is limited to importing and rendering SVG icons in the form of React components.

Please explain

The license of this library was recently changed, and we are currently limiting usage to previous version that were under Apache 2.0. We would of course prefer to be able to use newer versions as the library keeps evolving.

[github-actions]

Automated Triage Summary

Project: Backstage
Components Requested: 1

---

This issue will be reviewed by the CNCF staff and Legal Committee. See process documentation.

[joannalee333]

Hello @Rugvip. Thanks for opening this request. Because the Remix Icon License License is not an open source license (specifically, it contains restrictions on competitive uses), this is not eligible for exception approval. Thus, although Backstage is welcome to continue using prior versions licensed under Apache-2.0, you will not be able to use the versions that are licensed under the Remix Icon License. Please see our Source Available Guidance Document (section entitled "Exception Requests")