A community member discovered that Tendermint's Merkle tree code (distributed under Apache 2.0) was derived from a GPL v2-licensed library, potentially GPL-contaminating the entire Tendermint/Cosmos blockchain codebase and all derivative works.
Sources: GitHub issue
LICENSE_RESTRICTION_DERIVATIVE_WORK_COPYLEFT.
| Tool | Verdict | Details |
|---|---|---|
| OSS Risk Guard | Caught | LICENSE_RESTRICTION_DERIVATIVE_WORK_COPYLEFT. |
| Socket | Partial | Has license scanning but not primary focus |
| Snyk | Caught | License compliance scanning |
| Sonatype (Nexus) | Caught | License compliance in Lifecycle product |
| Black Duck | Caught | Industry-leading license compliance; largest knowledge base |
| Endor Labs | Caught | License compliance scanning |