I have a grey-area issue. The new version of the clementine player
comes bundled with 3rd party source files: sha2 , echoprint-codegen
There are no licensing issues. Unfortunately, neither of the two
upstreams provide their source files as libraries. From the
descriptions in their webpages  and , they seem to me as "take
this code and use it in your project as you wish".
The question is, how do you think this would play with our guidelines?
PS: A similar question arose during the package review of clementine
for the bundled universalchardet source files. At the time, we allowed
it through noting that there were other packages in Fedora bundling