Add a LICENSE file and copyright headers

[ruuda]

Before we make the repository public, we should put a license in place and add copyright headers to the source files.

[enriquefynn]

As pointed out by Ruud in #105

IANAL, but if it’s a copy, or even an adaptation, we need to retain the copyright notice of the original code (SPL is Apache2):

You must retain, in the Source form of any Derivative Works that You distribute, all copyright, patent, trademark, and attribution notices from the Source form of the Work, excluding those notices that do not pertain to any part of the Derivative Works

But this is dealing with Lido, it’s not a copy of something in the Solana program library, is it?

Some of the Lido parts are copied/modified from the Stake Pool, We should take this into consideration when deciding which license to use for it

[malikankit]

Checked in with P2P if Apache 2.0 is OK. They redirected me to LEGO Governance.

Pinged Florian (who's in LEGO Governance). He is going to check in with the LEGO group and get back (hopefully today).

[malikankit]

Both P2P and Lego Governance prefer GPL.

Given that Apache 2 software can therefore be included in GPLv3 projects ( https://www.apache.org/licenses/GPL-compatibility.html ), I think it's OK to go ahead with GPL v3.

If anyone has counter-opinions - please lmk. Otherwise, I will close this with a GPL-license-included PR by Wednesday 13 July 2021 :).

[ruuda]

We need to check that all dependencies in Cargo.lock are compatible. There is probably some tool that can print the licenses of each and group them.

[ruuda]

Output of cargo license

``` 0BSD OR Apache-2.0 OR MIT (1): adler Apache-2.0 (56): anchor-attribute-access-control, anchor-attribute-account, anchor-attribute-error, anchor-attribute-event, anchor-attribute-interface, anchor-attribute-program, anchor-attribute-state, anchor-client, anchor-derive-accounts, anchor-lang, anchor-syn, borsh-derive, borsh-derive-internal, borsh-schema-derive-internal, chunked_transfer, gethostname, hmac-drbg, libsecp256k1, openssl, rpassword, solana-account-decoder, solana-banks-client, solana-banks-interface, solana-banks-server, solana-bpf-loader-program, solana-clap-utils, solana-cli-config, solana-client, solana-config-program, solana-crate-features, solana-faucet, solana-frozen-abi, solana-frozen-abi-macro, solana-logger, solana-measure, solana-metrics, solana-net-utils, solana-program, solana-program-test, solana-rayon-threadlimit, solana-remote-wallet, solana-runtime, solana-sdk, solana-sdk-macro, solana-secp256k1-program, solana-stake-program, solana-transaction-status, solana-version, solana-vote-program, solana_rbpf, spl-associated-token-account, spl-math, spl-memo, spl-stake-pool, spl-token, spl-token Apache-2.0 AND BSD-2-Clause OR MIT (1): crossbeam-queue Apache-2.0 OR Apache-2.0 WITH LLVM-exception OR MIT (2): wasi, wasi Apache-2.0 OR BSL-1.0 (1): ryu Apache-2.0 OR CC0-1.0 (1): blake3 Apache-2.0 OR ISC OR MIT (3): hyper-rustls, rustls, sct Apache-2.0 OR MIT (262): addr2line, ahash, anyhow, arrayvec, ascii, ascii, assert_matches, async-trait, autocfg, backtrace, base32, base64, base64, base64, bit-set, bit-vec, bitflags, block-buffer, block-buffer, block-padding, block-padding, borsh, bs58, bs58, bumpalo, bv, byte-tools, bzip2, bzip2-sys, cc, cfg-if, cfg-if, chrono, chrono-humanize, clap, clap_derive, core-foundation, core-foundation-sys, cpuid-bool, crc32fast, crossbeam-channel, crossbeam-channel, crossbeam-deque, crossbeam-deque, crossbeam-epoch, crossbeam-epoch, crossbeam-utils, crossbeam-utils, crypto-mac, crypto-mac, crypto-mac, crypto-mac, derivation-path, derivative, digest, digest, dir-diff, dirs-next, dirs-sys-next, dtoa, ed25519, ed25519-dalek-bip32, either, encode_unicode, encoding_rs, env_logger, failure, failure_derive, fake-simd, feature-probe, filetime, flate2, fnv, foreign-types, foreign-types-shared, form_urlencoded, futures, futures, futures-channel, futures-core, futures-executor, futures-io, futures-macro, futures-sink, futures-task, futures-util, getrandom, getrandom, gimli, glob, hash32, hashbrown, heck, hermit-abi, hex, hmac, hmac, hmac, hmac, http, httparse, httpdate, humantime, idna, indexmap, input_buffer, iovec, ipnet, itertools, itoa, jobserver, js-sys, lazy_static, libc, linked-hash-map, lock_api, lock_api, log, maybe-uninit, memmap2, mime, mio-uds, miow, miow, native-tls, net2, ntapi, num-bigint, num-derive, num-integer, num-traits, num_cpus, object, once_cell, opaque-debug, opaque-debug, openssl-probe, os_str_bytes, ouroboros, ouroboros_macro, parking_lot, parking_lot, parking_lot, parking_lot_core, parking_lot_core, parking_lot_core, pbkdf2, pbkdf2, percent-encoding, pest, pin-project, pin-project-internal, pin-project-lite, pin-utils, pkg-config, plain, ppv-lite86, proc-macro-crate, proc-macro-error, proc-macro-error-attr, proc-macro-hack, proc-macro-nested, proc-macro2, proc-macro2, proptest, quick-error, quote, quote, rand, rand, rand_chacha, rand_chacha, rand_core, rand_core, rand_hc, rand_hc, rand_pcg, rand_xorshift, rayon, rayon-core, regex, regex-syntax, remove_dir_all, reqwest, rustc-demangle, rustc-hash, rustc-hex, rustc_version, rustversion, rusty-fork, scopeguard, security-framework, security-framework-sys, semver, semver, semver-parser, semver-parser, serde, serde_bytes, serde_derive, serde_json, serde_urlencoded, serde_yaml, sha-1, sha2, sha2, sha3, signal-hook-registry, signature, smallvec, smallvec, socket2, socket2, stable_deref_trait, static_assertions, symlink, syn, syn, tar, tempfile, terminal_size, thiserror, thiserror-impl, time, tiny-bip39, tiny_http, tokio-rustls, tokio-serde, toml, tungstenite, typenum, ucd-trie, uint, unicode-bidi, unicode-normalization, unicode-segmentation, unicode-width, unicode-xid, unicode-xid, unreachable, url, utf-8, vcpkg, vec_map, version_check, wait-timeout, wasm-bindgen, wasm-bindgen-backend, wasm-bindgen-futures, wasm-bindgen-macro, wasm-bindgen-macro-support, wasm-bindgen-shared, web-sys, winapi, winapi-i686-pc-windows-gnu, winapi-x86_64-pc-windows-gnu, xattr, yaml-rust, zeroize, zeroize_derive, zstd-safe, zstd-sys Apache-2.0 OR MIT OR Zlib (4): bytemuck, miniz_oxide, tinyvec, tinyvec_macros BSD-2-Clause (3): Inflector, arrayref, cloudabi BSD-3-Clause (10): curve25519-dalek, curve25519-dalek, ed25519-dalek, fuchsia-zircon, fuchsia-zircon-sys, instant, num_enum, num_enum_derive, subtle, subtle CC0-1.0 (2): constant_time_eq, keccak ISC (2): libloading, untrusted MIT (79): ansi_term, atty, bincode, bytes, bytes, bytes, clap, combine, console, console, crunchy, dashmap, dialoguer, educe, enum-ordinalize, generic-array, generic-array, goblin, h2, hidapi, http-body, hyper, indicatif, jsonrpc-core, kernel32-sys, matches, memoffset, memoffset, mio, mio, nix, number_prefix, openssl-sys, qstring, redox_syscall, redox_syscall, redox_users, schannel, scroll, scroll_derive, slab, spin, strsim, strsim, synstructure, tarpc, tarpc-plugins, termios, textwrap, textwrap, tokio, tokio, tokio-codec, tokio-current-thread, tokio-executor, tokio-fs, tokio-io, tokio-macros, tokio-reactor, tokio-stream, tokio-sync, tokio-tcp, tokio-threadpool, tokio-timer, tokio-udp, tokio-uds, tokio-util, tower-service, tracing, tracing-core, try-lock, uriparse, void, want, winapi, winapi-build, winreg, ws2_32-sys, zstd MIT OR Unlicense (7): aho-corasick, byteorder, memchr, same-file, termcolor, walkdir, winapi-util MPL-2.0 (1): webpki-roots N/A (5): lido, multisig, ring, solido-cli, webpki ```

Licenses of dependencies, excluding ones known to be GPL-3 compatible already:

$ cargo license | grep -vE '^[^:]*(Apache-2.0|BSD-3-Clause|BSD-2-Clause|MIT|ISC|MPL-2.0|CC0)[^:]*:'
N/A (5): lido, multisig, ring, solido-cli, webpki

There are our own crates, and then the following two:

• ring, whose license situation is “it’s complicated”.
• webpki, which is ISC-style, which third-party code from Chromium, which is 3-clause BSD. This one should be fine.

It seems that ring is pretty deep in multiple places in our dependency tree, so it’s not easy to avoid. Further investigation is needed. (But that is the case regardless of what license we go with.)

[ruuda]

The FSF lists the OpenSSL license, as GPL-incompatible. ring is a fork of BoringSSL which is a fork of OpenSSL. I don’t know what this means for us. I also found this document that says:

Uses an Original BSD-style license with an announcement clause that makes it "incompatible" with GPL. You are not allowed to ship binaries that link with OpenSSL that includes GPL code (unless that specific GPL code includes an exception for OpenSSL - a habit that is growing more and more common).

In any case, these libraries should not be needed for the on-chain program, so I think we can at least go ahead and license the on-chain program as GPL-3.

For the solido binary, things are more complex. This may also impact the container image, which is a form of redistribution. I am out of my depth here, we should obtain an expert opinion.