Potential license issue with paragonie/sodium_compat

[dvaeversted]

Version(s) affected

3.3.0, 4.0.0

Description

As part of #522 a dependency was introduced on paragonie/sodium_compat.
We utilize the jwt-framework packages in an internal tool, and this new dependency was flagged by our license compliance scanner due to it being licensed under ISC license.

Right now this is blocking updating in our end, and we are wondering if this perhaps was an unintentional change ?

IANAL, so i am not aware if there any actual legal issues with having this license used as a dependency.

How to reproduce

https://github.com/paragonie/sodium_compat/blob/master/LICENSE

Possible Solution

No response

Additional Context

No response

[CRC-Mismatch]

IANAL also, but from reading the license's details, it seems to me that it only requires redistributing the license together with the packages... I'd believe that would already be provided either way if the package under vendor includes it , but if I wanted to be sure, I'd just copy all vendor/**/LICENSE* files to a top-level directory with a LICENSE-<vendor>_<package> pattern when packaging the application (to be sent alongside the PHAR file, if that's the case - otherwise, just keep them there).

I don't know the specifics of your license compliance scanner's settings, but I'd be surprised if it considered ISC a restrictive license by default, and not by custom rules...

[Spomky]

Hi,

Right now this is blocking updating in our end, and we are wondering if this perhaps was an unintentional change ?

The changes in #522 were deliberate, but to be honest I did not noticed the license is ISC.
Other libraries from PIE, such as paragonie/constant_time_encoding, are under the MIT license.

IANAL, so i am not aware if there any actual legal issues with having this license used as a dependency.

According to GitHub, it is very similar to the MIT license used for the framework.

The vendor folder is populated by the packages as is, i.e. the license files (and all other files) remain unchanged.
To me (IANAL as well)

• Conditions are met because the license file and copyright notices are present.
• Private use is authorized and you are therefore authorized to use it in your internal tool

[Spomky]

Closing as answered.
Note that the branch 4.0.x contains a script that will evaluate all licenses and make sure dependencies use one of a curated list (only FLOSS-compatible licenses) that is as follows:

• Apache-2.0
• BSD-2-Clause
• BSD-3-Clause
• ISC
• MIT
• MPL-2.0
• OSL-3.0

This script is called during the usual CI/CD checks.
I hope this helps.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.