Debian has been doing this for 15+ years.  i don't see what's unique here.
https://lists.debian.org/debian-legal/
-mike