NZ Govt's COVID-19 tracing app using libphonenumber with no attribution
kaisparkle opened this issue · 4 comments
Hi there,
I've been looking into the New Zealand Government's COVID-19 tracing app, which was released today. After decompiling the main classes.dex, I noticed io.michaelrocks.libphonenumber.android in the package.
I haven't been able to find any attribution notices for any libraries being used - their attribution and copyright page only covers attribution of images taken through the app, and shouts-out their development team. I additionally noticed at least 4 other Apache 2.0-licensed libraries in use.
Not sure if this is a concern to you or not, but figured I should let you know.
Rather than repeatedly creating issues along the same lines, I figured it'd be better to ping users here.
Here's a list of non-attributed libraries being used.
@square's okhttp and okio
@FutureMind's recyclerviewfastscroll
@hbb20's CountryCodePicker
@JakeWharton's ThreeTenABP
@orhanobut's logger
@kaisparkle There's no NOTICE in this repo, or any of the others. What part of the Apache 2.0 licence do you believe is being violated?
Noting that most of the requirements to preserve copyright apply to source distribution, which a decompiled DEX isn't.
MoH has added attribution for all libraries in use. https://tracing.covid19.govt.nz/help/copyright