BSD-3-Clause license "violation"

[kapouer]

Hi,

the BSD-3-Clause license states:

- Redistributions of source code must retain the above copyright notice...

which is for sqlite3:

Copyright (c) MapBox
All rights reserved.

which isn't in

sqlcipher/LICENSE

Lines 1 to 2 in fda4c68

	Copyright (c) 2008, ZETETIC LLC
	All rights reserved.

The proper way to fix this is to simply retain the original copyright line below or above your copyright line.

[sjlombardo]

Hello @kapouer, thanks for getting in touch. I'm somewhat confused by this issue. SQLCipher has no dependencies on MapBox at all. If MapBox is using SQLCipher (which it seems like they might be), then their project should be including our SQLCipher copyright statement, not the other way around. In that case, this Issue should be filed against their project, since they would be the ones in violation of the license.

In the event that you meant SQLite instead of MapBox, that situation is different. SQLite is not distributed under the BSD-3 clause license, it is in the public domain. As a result, there is no license to abide by. Even so, we do extensively communicate that SQLCipher is based on SQLite in all project documentation (e.g. the project website, README, Open Source Legal Notices.

So, to summarize, SQLCipher is licensed under the 3-clause BSD, but SQLite is not. Projects that use SQLCipher Community Edition under that license are require to adhere to SQLCipher license and attribute SQLCipher accordingly. Projects implementing SQLCipher (or SQLite) are not required to attribute SQLite since it is public domain. However, SQLCIpher does extensively credit SQLite outside of the license text in recognition of the importance of that project as the core library that SQLCipher is based on.

Let me know if that clears things up, or if there is something that we are missing.

[kapouer]

Oops ! I had an ongoing issue about node-sqlite and confused that one with sqlite3. Sorry !