License compliance for binary builds at Releases
- Dominant language
- C++
- Stars
- 123k
- Forks
- 17.5k
- Avg merge
- 14h 22m
- Merged PRs (30d)
- 873
Description
I'm trying to find corresponding source code and complete attributions for binary builds at [Releases](). For example https://github.com/electron/electron/releases/download/v18.2.3/electron-v18.2.3-darwin-x64.zip has an `ffmpeg.dylib` and FFmpeg has, at a minimum, an LGPL-2.1 license, which would require also distributing the "complete corresponding machine-readable source code" ([§4 of LGPL-2.1](https://www.gnu.org/licenses/old-licenses/lgpl-2.1.en.html#:~:text=it%20with%20the-,complete%20corresponding%20machine%2Dreadable%20source%20code,-%2C%20which%20must%20be)) but I don't see this source code elsewhere in the Releases section (under Assets is where I'd expect to find it).
It looks like with sufficient sleuthing I might be able to piece it all together and find what is *likely* the complete corresponding source code, but it's much better when the organization that builds the software provides this so that we *know* that it's complete, and that it includes "the scripts used to control compilation and installation of the library." (§1, definition of "Source code"). That also ensures that the organization distributing the binaries is compliant with the license conditions.
Attributions (copyright statements and licenses) are also required by the licenses. I see most of those, for example I see `LICENSE` and `LICENSES.chromium.html` in the .zip packages, but I don't see anything for Squirrel and Mantle for example.
Contributor guide
Assessment
This issue has not been assessed yet.