non-free NIST data
decathorpe opened this issue · comments
We are packaging this crate for Fedora Linux as a dependency of some other applications. During technical and legal review, it was discovered that this crate redistributes part of some NIST data set - which appears to be covered by a license that makes it not freely redistributable.
We are not able to distribute this data as part of the package for the statrs crate, so we need to repackage a "cleaned" version of this crate, and cannot use the version published on crates.io directly.
It is likely also not allowed for this crate to redistribute this dataset by publishing it on crates.io (or even here on GitHub). It might be a good idea to at least exclude the NIST data files from published crates.
For reference, the discussion thread on the Fedora "legal" mailing list is here:
https://lists.fedoraproject.org/archives/list/legal%40lists.fedoraproject.org/thread/LSM6MO6TAHTIDNF5COCA6UWQDHWRF3AH/
Two things:
-
Do you have alternatives to suggest? Would there be any issues downloading it and using it in our CI so that we're not distributing it?
-
Also, noticed that Apache Commons (link to folder) is also using this dataset, didn't see anything regarding licensure in the commit history. Would you happen to know enough about licenses to know if I should let them know?
Two things:
- Do you have alternatives to suggest? Would there be any issues downloading it and using it in our CI so that we're not distributing it?
I think this would be a good solution, yes.
- Also, noticed that Apache Commons (link to folder) is also using this dataset, didn't see anything regarding licensure in the commit history. Would you happen to know enough about licenses to know if I should let them know?
Based on the information I have (the legal review in the mailing list thread I linked above), yes, that would probably be a good idea.
#214 dropped this from the crate, so the 0.17.0 release will not distribute the data from crates.io
I'll close this and open an issue to run tests on NISTs datasets without needing the data distributed in this repo.
Update: added link to NIST's StRD archives
Thank you!