Please address these license issues

[ryjones]

Please address these license issues

https://github.com/hyperledger/indy-sdk/blob/ae9f8a252bb99e8b80c6d34c6c985fd95abfadef/vcx/libvcx/build_scripts/android/openssl/make_openssl.sh#L4-L5

https://github.com/hyperledger/indy-sdk/blob/ae9f8a252bb99e8b80c6d34c6c985fd95abfadef/Specs/libzmq/4.2.3/libzmq.podspec.json#L7-L9

https://github.com/hyperledger/indy-sdk/blob/ae9f8a252bb99e8b80c6d34c6c985fd95abfadef/Specs/libzmq-pw/4.2.2/libzmq-pw.podspec.json#L7-L10

[jeffcshapiro]

The main concern here is the LGPLv3 license. The OpenSSL license should not be a concern.

[swcurran]

I can answer the questions posed. I don’t know what is required to “address these license issues”.

AFAIK — libzmq is used within the Indy SDK, and libzmq-pw seems to be a fork of libzmq created by Evernym. From the codebase I found this about libzmq-pw: "ZeroMQ fork with PairwiseCurveCP support”. I don’t see any documentation in the Evernym repo.

I don’t know if it matters, but it looks to me like libzmq is downloaded as binary artifact in builds - e.g. a dll.

[ryjones]

From the linked report:

Priority: High This metadata file indicates it is for components under LGPL-3.0, libzmq / libzmq-pw. Are these two components used by indy, and/or is their code contained anywhere in the repo?

[swcurran]

I saw that. It asks a question and I’ve tried to answer it, but it doesn’t say what to do given the answer I provided.

[ryjones]

Gotcha. @jeffcshapiro ?

[jeffcshapiro]

Sorry, the question should have been worded as a recommendation: If LGPL licensed code is in your repo as source code it can contaminate the codebase. If it is only used as a binary (DLL) then it is OK.

[swcurran]

@brentzundel — can you please confirm that libzmq is only used in binary form in this repo? Same applies for libzmq-pw.

Thanks

[brentzundel]

To my understanding, libzmq and libzmq-pw are only used as binaries.

[swcurran]

Thanks. @jeffcshapiro — now that we know that libzmq and -pw are binary only, what action do we need to take?

[ryjones]

I think @jeffcshapiro makes note of it in his tool and closes the issue

[jeffcshapiro]

Issue resolved, no license conflict - ZeroMQ used as binaries only

[jeffcshapiro]

looks like I can't close the issue, please close

[dhh1128]

Closing as requested.