aranja/rakning-c19-app

License violations.

Closed this issue · 4 comments

Deleted user commented

This project claims to be MIT licensed, yet both the Open Sans artefacts under /src/assets/fonts, as well as one or more of the projects dependencies are Apache 2.0 Licensed. This is a problem.

eirikurn commented

Can you expand on what exactly the problem is?

AFAIK we don't need to replicate licenses and notices for NPM dependencies, as long as they all have permissive licenses.

The only dependencies that we are distributing in the repo itself are the Open Sans artifacts, which I guess needs to include the license and copyright notice.

The repo also contains a patch file, or modifications to @mauron/react-native-geolocation-background, which is Apache 2.0 licensed. I'm not sure what conditions are on distributing a stand-alone patch.

I guess we should bring on board a software license lawyer/expert.

Deleted user commented

The problem has to do with the definition of "software" and how you release "software".

By one definition, the code contained by this repo "is" the software. As the code is unarguably MIT licensed and the repo does not contain non-MIT licensed code, then there is no violation.
(Actually, the repo contains Open Sans which is not MIT licensed, that might be a problem.)

By another definition, the build (the one which gets build from the code in this repo and redistributed on Apple and Android app stores) "is" the software. Because that software is linked with redistributed Apache License 2 licensed artefacts then that software can not be said to be MIT licensed -- the MIT license is less restrictive than Apache License 2.

Deleted user commented

I guess we should bring on board a software license lawyer/expert.

Good idea!

eirikurn commented

As I see it, there are three things to address:

  • Include a license for Open Sans somewhere in the repository or link them from node_modules.
  • Make sure the geolocation patch fulfills the Apache 2.0 license conditions.
  • Create an "about" page or screen somewhere for the app that links to this repository and lists all open source dependencies that are distributed with the app including their license and notices.