CryptoSwift dependency license need clarification

[hendrikebbers]

As written in #3 we have the direct dependency https://github.com/krzyzanowskim/[email protected] that has a license that needs clarification.

[nathanklick]

License: https://github.com/krzyzanowskim/CryptoSwift?tab=License-1-ov-file#readme

License Text

Copyright (C) 2014-3099 Marcin Krzyżanowski <[email protected]>
This software is provided 'as-is', without any express or implied warranty.

In no event will the authors be held liable for any damages arising from the use of this software.

Permission is granted to anyone to use this software for any purpose,including commercial applications, and to alter it and redistribute it freely, subject to the following restrictions:

- The origin of this software must not be misrepresented; you must not claim that you wrote the original software. If you use this software in a product, an acknowledgment in the product documentation is required.
- Altered source versions must be plainly marked as such, and must not be misrepresented as being the original software.
- This notice may not be removed or altered from any source or binary distribution.
- Redistributions of any form whatsoever must retain the following acknowledgment: 'This product includes software developed by the "Marcin Krzyzanowski" (http://krzyzanowskim.com/).'

[hendrikebbers]

The license appears to be a modification of the Zlib license, which takes the suggested but not required attribution requirements of Zlib and makes them mandatory and additionally adds various requirements concerning attribution in both source and binary form. We need to carefully review the strict attribution requirements and should also have a plan for how attribution and the other statements the license requires will be maintained in source and binary form. It might be worth considering alternatives that do not contain such strict attribution requirements.

[RickyLB]

@hendrikebbers So there are other Crypto libraries for Swift that have less license restrictions but none that offer the wide range of functionality that CryptoSwift does. Would it be appropriate to add a NOTICE in the Swift SDK acknowledging CryptoSwift license for now, or do alternatives need to be incorporated in order to transition to Hiero?

[hendrikebbers]

@RickyLB "none that offer the wide range of functionality" does that mean that we need to replace it with like 2 libs? Because I assume the license will be a problem when moving it to Linux Foundation.

[RickyLB]

@hendrikebbers Correct— this will require an overhaul of the key implementations in the SDK. In the meantime, i'll start looking into other options. When would this change need to take effect?

[hendrikebbers]

In January as far as I know