MiloszKrajewski / K4os.Compression.LZ4

LZ4/LH4HC compression for .NET Standard 1.6/2.0 (formerly known as lz4net)
MIT License
675 stars 77 forks source link

The repository contains the code with the incompatible licenses #97

Closed vchekalin closed 6 months ago

vchekalin commented 6 months ago

Hi Milosz, The repository contains the orig folder which contains the content of the original files of the LZ4 algorithm from this repository The problem is, the license of that content (BSD and GPLv2) is not compatible with the license of your code (MIT) Can you please confirm, the files from the original repository are not used to build the .NET assemblies and no content of the original files in the nuget packages? In addition, I would appreciate if you remove the orig folder from the repository.

Thanks.

MiloszKrajewski commented 6 months ago

I don't think BSD 2-clause and MIT are not compatible. They are almost of identical.

K4os.Compression.LZ4 is build with large chunks of code of orig/lib (BSD 2-clause) folder being directly translated from C to C#. In that sense this code was used to build .NET assemblies (but NOT the GPLv2 part).

I'm no lawyer but both BSD and MIT are quite permissive and according to this thread it should not be a problem.

Maybe I should change K4os.Compression.LZ4 license to BSD 2-clause?

Is it preventing you from using it?

vchekalin commented 6 months ago

You are right, it is not too much differences between MIT and BSD, but GPLv2 is the "Red" license. As per your explanation you use only the chunks of the code from the orig/lib to translate them to C# and do not use them directly to build the assembly, this is fine.

The problem is the repository contains the files, which are under the GPL license. The clearance team scans the the entire repository and if they found the "Red", to avoid any risks, it is not allowed to use the components. For example, these files are orig\tests\*.c orig\programs\*.c

As none of the files are used for the build, they can be safely removed from the repo. In the readme file you have a reference to the original repository.

MiloszKrajewski commented 6 months ago

Not sure if it solves your problem, but now orig folder is referenced as git submodule, not embedded.