metavacua#15
https://github.com/search?q=repo%3Ametavacua%2Flarql-to-sparql%20evalexpr&type=code
Greetings Chris et al,
I've been implementing CI/CD workflows to ensure that credit remains where credit is due and all obligations including licensing obligations are met by my fork.
During the course of this, several undeclared licenses were discovered as documented in PR #15 of my fork of LARQL.
The most significant finding of my audit involves the dependency on evalexpr v12.0.3. While previous iterations of this crate were MIT-licensed, v12.0.3 is licensed under AGPL-3.0-or-later. It is possible this is a false positive given the forks of the evalexpr repository, but I am unfamiliar with the specifics of Rust and its cargo system.
This introduces a strong copyleft requirement, specifically the Section 13 network disclosure clause, which may conflict with the project’s stated Apache 2.0 goals.
Thanks,
Ian Douglas Lawrence Norman McLean
metavacua#15
https://github.com/search?q=repo%3Ametavacua%2Flarql-to-sparql%20evalexpr&type=code
Greetings Chris et al,
I've been implementing CI/CD workflows to ensure that credit remains where credit is due and all obligations including licensing obligations are met by my fork.
During the course of this, several undeclared licenses were discovered as documented in PR #15 of my fork of LARQL.
The most significant finding of my audit involves the dependency on evalexpr v12.0.3. While previous iterations of this crate were MIT-licensed, v12.0.3 is licensed under AGPL-3.0-or-later. It is possible this is a false positive given the forks of the evalexpr repository, but I am unfamiliar with the specifics of Rust and its cargo system.
This introduces a strong copyleft requirement, specifically the Section 13 network disclosure clause, which may conflict with the project’s stated Apache 2.0 goals.
Thanks,
Ian Douglas Lawrence Norman McLean