Что-то как-то в рунете тишина по поводу поста от Linux Foundation, который касается санкций и Open Source, а он реально важный. Ни OpenNet, ни LOR ничего о нём не рассказали в новостях своих.

Navigating Global Regulations and Open Source: US OFAC Sanctions
https://www.linuxfoundation.org/blog/navigating-global-regulations-and-open-source-us-ofac-sanctions

Если кратко, то пока не будет конкретных разъяснений от compliance, то лучше с патчами от подозрительных контрибьюторов не связываться

Sanctioned entities might try to contribute indirectly through third parties or developers acting "individually." Developers should understand other contributors' affiliations and raise any concerns with their community and legal counsel. For example, if in the prior example, AcmeSDN paid a developer in a country not subject to sanctions to make the driver contribution enabling AcmeSDN’s processor, that would still likely be an issue. A common pattern is that an SDN’s developer is blocked from making a contribution, but then a very similar (or the same) patch is submitted to the project from another account or email address. It could be an anonymous email account. Just because the contributor has been obfuscated does not change an assessment of the situation.

Очень рекомендую всем интересующимся прочитать пост полностью, это практически "документ эпохи".