Post #4300616
2026-06-28 11:19 UTC
@icing@chaos.social "Affected projects are rebuilt as private, hardened versions available to Athena members through Chainguard Libraries before vulnerabilities are publicly disclosed a month later"
That sounds like a GPL violation...
Replies (1)
-
@gasrios@floss.social 2026-06-28 12:55
@jpl@norden.social @icing@chaos.social I believe the two relevant provisions made by GPL are (1) you have to provide the source code when you provide someone a binary version of the code, and (2) you cannot prevent them from redistributing the code under the GPL. So they can't tell their clients not to redistribute it, but they are under no obligation to make it available to anyone else.