Hi, current maintainer of Lasso here; Orange bundled Lasso (a GPL library) with their internal authentication system at the time (called IDMP, itself made as an Apache module) to give it support for SAML then sold a license of the bundled software to the French state; they never distributed the source of the whole package, and they did not distribute the whole package under a GPL compatible license. Clear violation.