Lasso is a free software C library aiming to implement the Liberty Alliance standards; it defines processes for federated identities, single sign-on and related protocols. Lasso is built on top of libxml2, XMLSec and OpenSSL and is licensed under the GNU General Public License (with an OpenSSL exception).
We strongly recommend the use of the GNU General Public License each time it is possible.
But for proprietary projects, that wouldn't want to use it, we designed a commercial license.
That's hardly hiding the choice, someone at the telecom company chose not to get a commercial use license.
Edit: So are the links for the GPL and the OpenSSL Exception - https://lasso.entrouvert.org/license
https://dev.entrouvert.org/issues/52569
https://git.entrouvert.org/entrouvert/lasso
For commercial usage, though, the git page and forums are active enough and real live humans can be communicated with.
Orange knows what they are doing.
On that note, we should probably double check our licenses and that we publish them as well.
As a company, it's your responsibility to set and enforce a clear policy on using third party code. License is only one part of the problem.
There must be a clear policy and hoops to go through (decision on choice of library, reviews before integration in code base/product, audits, etc). If that does not exist then the organisation must really step up its game.
By the way, it is the very job of the legal department to know about this and to inform policies, and of the managers to enforce those policies and processes.
Say, if Bertram Gilfoyle lets you live in an apartment he owns as long as you remain a practicing member of the Church of Satan, that's not really "free", now, is it?
Of course, this idea of "freedom" is on a spectrum. By my lights, the MIT license is more free than the GPL because it imposes fewer restrictions on the user.
Personally, I don't let GPL software come anywhere near anything I'm working on. I don't even like using GCC, and was very happy when LLVM appeared on the scene with a less-scary license.
But who will check the licences of those softwares to build the corpus?