To clarify what I mean: the vendor has chosen not to put its software under a copyleft license, which means they have not undertaken a legal obligation to give you source code that matches your binary.

They're also not giving you a means to verify the binary that's in that Google Storage bucket, except using a checksum that is *also* in that bucket. So it would seem like you have no way to tell that the software in the binary has anything to do with the code in the repo.

@zhenech Yes, I know. It's also how proprietary software sucks. 🙂

Now, I fully appreciate that lots of people/orgs out there couldn't care less about that suckage, or don't even consider it suckage. That's why I asked specifically how a company that builds or otherwise relies on FOSS assesses Claude's potential (or real) impact.