Repository navigation
Restore the LGPL licence (this fork is EPPlus 4.5.3.3 code, LGPL-2.1-or-later) - #8
davidnmbond wants to merge 1 commit into
Conversation
…LGPL-2.1-or-later 550 of the 678 source files carry Jan Källman's LGPL v2.1-or-later header. The fork derives from EPPlus 4.5.3.3, the final LGPL release, and contains no code from EPPlus 5 or later (Polyform Noncommercial). The MIT LICENSE added in 1a8baa1 and the MIT-only PackageLicenseExpression from #5 relabelled that code, which the LGPL does not permit; published 9.x/10.x packages were correctly labelled LGPL. - LICENSE is now the LGPL 2.1 text; NOTICE.md records lineage and authorship - PackageLicenseExpression is LGPL-2.1-or-later (still expression-only, so the NU5033 fix from #5 stands); LICENSE and NOTICE.md are packed - Authors and copyright credit Jan Källman, Mats Alm and Rimland - PackageProjectUrl points at this repo instead of rimland/EPPlus - README badge and CONTRIBUTING contribution terms say LGPL
Up to standards ✅🟢 Issues
|
![codacy-production[bot]](https://avatars.githubusercontent.com/in/56611?s=60&v=4){kind=small}
There was a problem hiding this comment.
Pull Request Overview
NOTICE.md contains licensing guidance that could incorrectly imply static linking is prohibited. This should be corrected to accurately reflect LGPL section 6 obligations.
Packaging, metadata, and documentation verification scenarios remain unautomated. The dependency-audit failure noted by the intent review is outside this change’s licensing scope and is not treated as a merge-blocking finding here.
Test suggestions
- Verify the generated NuGet package declares LGPL-2.1-or-later and contains LICENSE, NOTICE.md, and lgpl-3.0.txt
- Verify README and CONTRIBUTING.md no longer identify the project or contributions as MIT-licensed
- Verify package authors, copyright, and project URL match the documented lineage
Prompt proposal for missing tests
Consider implementing these tests if applicable:
1. Verify the generated NuGet package declares LGPL-2.1-or-later and contains LICENSE, NOTICE.md, and lgpl-3.0.txt
2. Verify README and CONTRIBUTING.md no longer identify the project or contributions as MIT-licensed
3. Verify package authors, copyright, and project URL match the documented lineage
TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback
| The LGPL permits this library to be used from software under any licence, including | ||
| proprietary software, provided that the library remains a separate, replaceable | ||
| assembly (for example, referenced as a NuGet package rather than merged or | ||
| statically linked) and that this notice and the licence accompany any | ||
| redistribution of it. Changes to the library itself must be released under the LGPL. |
There was a problem hiding this comment.
🟡 MEDIUM RISK
Rewrite this paragraph to accurately describe both dynamic and static linking, including the applicable LGPL section 6 obligations, rather than imposing a separate-assembly requirement.
Why
PanoramicData.EPPlus is a fork of EPPlus 4.5.3.3, Jan Källman's final LGPL release, continued via rimland/EPPlus. 550 of the 678
.csfiles carry the header "GNU Lesser General Public License ... version 2.1 of the License, or (at your option) any later version".mainhas been relabelled MIT:LICENSE(© Panoramic Data Limited only) was added in 1a8baa1PackageLicenseExpressionMIT-onlyThe next publish from
mainwould declare LGPL code as MIT, which the LGPL does not allow. The published 9.x and 10.x packages are correctly labelled LGPL, so the problem exists only onmain.No Polyform Noncommercial (EPPlus 5 and later) code was found: no EPPlus Software AB headers appear in any source file.
What changes
LICENSENOTICE.md(new)PackageLicenseExpressionis nowLGPL-2.1-or-later. It is still expression-only, so the NU5033 fix from #5 is kept. LICENSE and NOTICE.md are packed. Authors and copyright credit Jan Källman, Mats Alm and Rimland.PackageProjectUrlpoints at this repo.lgpl-3.0.txtis still packed, which "or any later version" permits.Verification
Running
dotnet packlocally produced this nuspec:The package contains
LICENSE,NOTICE.md,lgpl-3.0.txtandREADME.md.Separate issue on
main, not fixed hereThe restore fails with NU1902/NU1903 because
System.Security.Cryptography.Pkcs9.0.0 has known moderate and high severity vulnerabilities, and those warnings are treated as errors. I verified this PR with-p:NuGetAudit=false. That package needs bumping before anything can be published frommain.Consumers
MagicSuite references this library as a NuGet package, so it is a separate, replaceable assembly. That is permitted under the LGPL.
Follow-up
The
fix/mit-licence-expressionbranch can be deleted once this is merged.