The `sq` binary package claims `LGPL-2.0-or-later` as its license. However,
the binary statically links Rust dependencies whose licenses are
incompatible
with LGPL-2.0, making the effective license of the distributed binary
incorrect.

Specifically:

1. librust-nettle-dev: licensed `LGPL-3.0 or GPL-2.0 or GPL-3.0`
   The LGPL-3.0 option here is not satisfiable under LGPL-2.0-or-later
   without upgrading to LGPL-3.0, since LGPL-2.0 and LGPL-3.0 are not
   directly compatible (LGPL-3.0 imposes additional requirements).

2. librust-gethostname-dev: licensed `Apache-2.0`
   Apache-2.0 is compatible with LGPL-3.0 but not with LGPL-2.0 (due to
   patent termination and indemnity clauses conflicting with GPLv2-family
   terms). It is compatible starting from GPL-3.0 / LGPL-3.0.

Since the sq binary statically incorporates code from both of these
dependencies, the effective license of the combined work must be
LGPL-3.0 or GPL-3.0 to satisfy all dependency license requirements.

Other Sequoia packages are affected by the same issue, notably sqv,
which also statically links librust-nettle-dev.

Suggested fix: Update the declared license of the binary package(s) to
LGPL-3.0.

Debian does not carry copyright information on built executables, just
of the sources. Or as Pabs put it in the first reply to the referenced
thread below:

Pabs on debian-legal wrote:

https://lists.debian.org/debian-legal/2023/09/msg00001.html

That mostly covered things like missing notices, not transforming
licensing stanzas for situations like the one you describe above.

It still might make sense to change the license upstream to reflect the
de-facto license of what ends up getting distributed in practice, to
avoid confusion.

Fabian