You’re right that Bob’s the infringer here and not GitHub. But I’m not sure where that would place the derived work that’s eventually used. Which is the point

You’re right that Bob’s the infringer here and not GitHub. But I’m not sure where that would place the derived work that’s eventually used. Which is the point of the article a bit. GitHub is likely not infringing but it’s also not absolving the end user of any infringement. Neat trick. That being said I think the risk is minimal enough that I’d be pretty comfortable with using it.