Hi, I'm a researcher working on binary analysis and software supply chain security.
While running some experiments with my SCA pipeline, I ended up scanning this library and found something that seemed worth bringing up.
Not trying to be alarmist — just figured it's the kind of thing maintainers would want to know about.
The issue
This project is MIT-licensed, but the pre-built libenc.so under library/src/main/jniLibs/ has x264 statically linked into it, and x264 is GPL-2.0.
A few things I found during analysis:
library/src/main/cpp/libx264/COPYING has the full GPL-2.0 text in it
- Binary analysis of the x86
libenc.so matched 491 x264 function signatures (x264_encoder_open_152, x264_encoder_encode, x264_param_default_preset, etc.)
- It's statically linked, not dynamically loaded, so the GPL terms do apply
Why it matters
Anyone shipping a closed-source app with this library is probably in GPL violation without realizing it, since the MIT label doesn't reflect the actual licensing situation of the binary.
Some options
- Relicense the project as GPL-2.0
- Replace x264 with something more permissively licensed (OpenH264 is BSD)
- At minimum, document the GPL obligation clearly in the README
Happy to share more from the analysis if it's helpful.
Hi, I'm a researcher working on binary analysis and software supply chain security.
While running some experiments with my SCA pipeline, I ended up scanning this library and found something that seemed worth bringing up.
Not trying to be alarmist — just figured it's the kind of thing maintainers would want to know about.
The issue
This project is MIT-licensed, but the pre-built
libenc.sounderlibrary/src/main/jniLibs/has x264 statically linked into it, and x264 is GPL-2.0.A few things I found during analysis:
library/src/main/cpp/libx264/COPYINGhas the full GPL-2.0 text in itlibenc.somatched 491 x264 function signatures (x264_encoder_open_152,x264_encoder_encode,x264_param_default_preset, etc.)Why it matters
Anyone shipping a closed-source app with this library is probably in GPL violation without realizing it, since the MIT label doesn't reflect the actual licensing situation of the binary.
Some options
Happy to share more from the analysis if it's helpful.