Control: severity -1 important The RSA-MD license is gone from cyrus-sasl's binaries now, so derivative works can ignore it. For BSD-3-Clause-Attribution, the incompatibility case is not as strong, so I am lowering the severity.