Skip to content

License inconsistencies across workspace crates #1540

@spacebear21

Description

@spacebear21

Surfaced while preparing the Dart binding for pub.dev publication.

The workspace declares three different licenses, with a likely-incorrect
Apache-2.0 grant on payjoin-ffi:

Crate Cargo.toml license LICENSE files committed
payjoin MITNFA none
payjoin-cli MITNFA none
payjoin-mailroom MITNFA none
payjoin-test-utils MIT none
payjoin-ffi MIT OR Apache-2.0 LICENSE.md, LICENSE-APACHE, LICENSE-MIT
payjoin-ffi/dart/native MIT OR Apache-2.0 (inherits parent)

Issues

  1. payjoin-ffi cannot relicense upstream as Apache-2.0. It depends on
    payjoin, which is MITNFA. The compiled libpayjoin_ffi statically
    embeds payjoin source. Apache-2.0 introduces grants and obligations
    (notably the patent grant and stricter notice requirements) that downstream
    consumers cannot rely on, because the embedded MITNFA portions don't carry
    those grants. The "OR Apache-2.0" promise is misleading.

  2. payjoin-test-utils is plain MIT rather than MITNFA, dropping the
    no-false-attribs clause that the rest of the workspace carries. Probably an oversight.

  3. The MITNFA crates ship no LICENSE text. Only the SPDX identifier is
    declared in Cargo.toml. crates.io accepts this, but consumers outside
    crates.io (e.g. distros, SBOM scanners) get no canonical text.

Suggested resolution path

  1. Relicense payjoin-ffi to MITNFA and remove LICENSE-APACHE. This is fine because the "OR Apache-2.0" part is being overriden by the compiled payjoin's more restrictive MITNFA already.
  2. Relicense payjoin-test-utils to MITNFA.
  3. Add canonical MITNFA text to a LICENSE file in the top-level repo (and/or individual crates?).

Disclaimer: IANAL and Claude surfaced and wrote this. It all seems reasonable to me though.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions