And to add to that @zackw's list: was a lawyer only consulted for compliance questions (sanctions exist, what do we need to do, help?) or also for planning questions (how do we make sure the Rust ecosystem is globally available regardless of what individual countries may want?)
Your questions are valid, but unfortunately I cannot definitively answer any of those without consulting the lawyers on the exact wording to use. I'll try to follow up with the precise answer to these when I can, but that will likely not happen until after RustConf. Thank you for your patience.
You're correct that Rust isn't a legal organization. It refers to the group of individuals who make up various teams listed at https://www.rust-lang.org/governance.
We're trying to be as transparent as we can, which is why we wanted to share the conclusions of this investigation publicly. However, we can't go into this sort of specific detail about the conversations that took place or the legal advice received.
Again, I can't go into that sort of detail about specific conversations that have been had. However, I do want to reiterate that we will continue to monitor situations such as this, and take actions when required to ensure that the Rust ecosystem is available to as many people as possible.
This isn't something I can answer for you. This is a report on some specific details that we wanted to share, but it should not be considered legal advice -- even for those listed on rust-lang.org. If you're concerned about your legal requirements, you will need to speak to legal counsel.
I regret to say that this response leaves me feeling that the community as a whole would be in a better place if you hadn't posted this thread at all.
Specifically, I feel that reporting legal conclusions without sharing the reasoning behind them is worse than useless. It gives us (exclusive us: the people reading this thread, who are not members of the teams covered by the legal advice you got) no way of evaluating whether the conclusions apply to us. For instance, it doesn't help a hypothetical crate maintainer make a decision about whether they can safely merge a patch submitted by a citizen of a sanctioned country. It doesn't even help that hypothetical crate maintainer know whether they need to talk to a lawyer. All it does is raise the level of uncertainty in the community, as we go from a state of blithe ignorance ("well, probably we don't need to worry about this") to knowing that there's something we don't know.
Incidentally, talking to a lawyer involves finding an appropriate lawyer to talk to first; in this hypothetical, finding a lawyer who understands the relevant chunk of international law might be more difficult than scraping together the money to pay them for an opinion.
Come on, that's harsh. Remember that none of this is Rust team's fault.
These sanctions aren't merely some inconvenient policy of Rust or GitHub, but a power-play between nation states owning and allegedly building weapons of mass destruction.
My sentiments also. I for one am glad to have any (competent legal counsel) insight into the matter, whether I have access to the details or not. While ignorance is not an a priori defense under US law, the uncertainty inherent in matters this complex certainly would be a valid argument before a jury.
Indeed it does not. But were you expecting this type of advice in this thread? I can certainly understand why one would want it. But this sounds like exactly the type of general/hypothetical advice that a lawyer would be loathe to give to a general message board.
Unfortunately, from this exchange, it isn't clear to team members, such as myself, whether these consulted lawyers think anything here applies to them either.
I would suggest that the words "we" or "our" be avoided as there will be different legal requirements on different individuals in said teams. For example, as a Swedish citizen (and therefore EU citizen), I have no legal obligations to comply with these specific US sanctions. Neither do I see why it would apply to crates.io team members who are also EU citizens. In fact, it would be illegal for EU citizens to comply with them due to the blocking statue  . These statues are unlikely to have any practical effect because the legal sanctions due to these statues are toothless.
: COUNCIL REGULATION (EC) No 2271/96 of 22 November 1996 protecting against the effects of the extra-territorial application of legislation adopted by a third country, and actions based thereon or resulting therefrom
: Commission Delegated Regulation (EU) 2018/1100 of 6 June 2018 amending the Annex to Council Regulation (EC) No 2271/96 protecting against the effects of extra-territorial application of legislation adopted by a third country, and actions based thereon or resulting therefrom
At any rate, the US government has no means of imposing penalties on me. They cannot arrest me physically because I do not live in the US and an European court would be unlikely to extradite me because these sanction laws are considered null and void in EU countries. (I should also note that there are team members who are themselves citizens of the sanctioned countries.)
I doubt this has anything to do with international law. Under int. law these sanctions are illegal according to the European Commission ...
The Regulation acknowledges that by their extra-territorial application, such instruments violate international law.