Hi Yuhan, Thanks, this is a thorough first pass, and stating the limitations plainly (FOSSA local mode, the unfingerprinted skill files) is exactly the right way to report it.
A few follow-ups. The scan did find bundled third-party code. The 25 external matches you reviewed as documented MIT or Apache-licensed material need to be reflected in LICENSE, with the licence text or a pointer per ASF licensing policy, before code transfer rather than at first release. Your NOTICE may also need to be updated. The proprietary binary item is the one that needs work. Constants recovered from a proprietary binary can range from interface constants needed for interoperability, which is generally fine, to implementation details derived from decompilation, which is not. When you get answers from the contributors, worse case you may need to remove and reimplement independently. Finally, please put the sanitized report somewhere permanent so it can be referred to. Kind regards, Justin --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
