fix: correct link and add notice file

CONTRIBUTING.md

@@ -2,4 +2,4 @@
 
 We welcome many different types of contributions.
 
-Please refer to the [Contributing Guide in the Community repository](https://github.com/open-component-model/community/blob/main/CONTRIBUTING.md) for more information on how to get support from maintainers, find work to contribute, the Pull Request checklist, the Pull Request process, and other useful information on how to contribute to OCM.
+Please refer to the [Contributing Guide in the Community repository](https://github.com/open-component-model/.github/blob/main/CONTRIBUTING.md) for more information on how to get support from maintainers, find work to contribute, the Pull Request checklist, the Pull Request process, and other useful information on how to contribute to OCM.

NOTICE

@@ -0,0 +1,18 @@
+# THIRD-PARTY LIBRARIES
+
+## MPL-2.0
+
+This project statically links the following [Mozilla Public License 2.0 (MPL-2.0)](https://www.mozilla.org/en-US/MPL/2.0/) libraries.
+The list contains the Go module path and the version of the library used.
+
+- github.com/hashicorp/errwrap-v1.1.0
+- github.com/hashicorp/go-cleanhttp-v0.5.2
+- github.com/hashicorp/go-multierror-v1.1.1
+- github.com/hashicorp/go-retryablehttp-v0.7.7
+- github.com/hashicorp/go-rootcerts-v1.0.2
+- github.com/hashicorp/go-secure-stdlib/strutil-configutil/v0.1.5
+- github.com/hashicorp/hcl-v1.0.1-vault-5
+- github.com/hashicorp/vault-client-go-v0.4.3
+- github.com/letsencrypt/boulder-v0.0.0-20241010192615-6692160cedfa
+
+Modifications to original MPL-2.0 files will be documented and made available.

README.md

@@ -53,10 +53,9 @@ Install the latest release with
 - [Homebrew](#homebrew)
 - [NixOS](#nixos)
 - [AUR](#aur)
-- [Container](#container)
+- [Docker and Podman](#container)
 - [Chocolatey](#chocolatey)
 - [Winget](#winget)
-- [GitHub Releases](https://github.com/open-component-model/ocm/releases/latest)
 
 ### Bash