hackage rejects cabal 2.2-supported open source licenses

[l29ah]

A package containing

cabal-version:       2.2
license:             WTFPL
license-file:        LICENSE

got kicked out with

This server does not accept packages with 'license' field set to e.g.
AllRightsReserved. See https://hackage.haskell.org/upload for more information
about accepted licenses.

even though cabal check reports it's correct.

[l29ah]

So it makes it impossible to upload a WTFPL-licensed package that uses cabal-2.2 or later format, as OtherLicense option is gone in 2.2.

[gbaz]

@phadej since wtfpl is a valid spdx license, shouldn't we be accepting it? https://www.haskell.org/cabal/release/cabal-latest/doc/API/Cabal/Distribution-SPDX-LicenseId.html#t:LicenseId

[phadej]

This is duplicate of #745

(EDIT: I personally cannot care less about license which I'm no sure whether it's a joke, and have a curse word in its name, but it's haskell.org committee or/and haskell admins to decide).

[phadej]

To clarify, the check is in hackage-server code base. Not somewhere in Cabal.

hackage-server/Distribution/Server/Packages/Unpack.hs

Lines 478 to 509 in f59acf0

	-- | Licence acceptance predicate (only used on central-server)
	--
	-- * NONE is rejected
	--
	-- * "or later" syntax (+ postfix) is rejected
	--
	-- * "WITH exc" exceptions are rejected
	--
	-- * There should be a way to interpert license as (conjunction of)
	-- OSI-accepted licenses or CC0
	--
	isAcceptableLicense :: PackageDescription -> Bool
	isAcceptableLicense = either goSpdx goLegacy . licenseRaw
	where
	-- `cabal-version: 2.2` and later
	goSpdx :: SPDX.License -> Bool
	goSpdx SPDX.NONE = False
	goSpdx (SPDX.License expr) = goExpr expr
	where
	goExpr (SPDX.EAnd a b) = goExpr a && goExpr b
	goExpr (SPDX.EOr a b) = goExpr a || goExpr b
	goExpr (SPDX.ELicense _ (Just _)) = False -- Don't allow exceptions
	goExpr (SPDX.ELicense s Nothing) = goSimple s
	goSimple (SPDX.ELicenseRef _) = False -- don't allow referenced licenses
	goSimple (SPDX.ELicenseIdPlus _) = False -- don't allow + licenses (use GPL-3.0-or-later e.g.)
	goSimple (SPDX.ELicenseId SPDX.CC0_1_0) = True -- CC0 isn't OSI approved, but we allow it as "PublicDomain", this is eg. PublicDomain in http://hackage.haskell.org/package/string-qq-0.0.2/src/LICENSE
	goSimple (SPDX.ELicenseId lid) = SPDX.licenseIsOsiApproved lid -- allow only OSI approved licenses.
	-- pre `cabal-version: 2.2`
	goLegacy License.AllRightsReserved = False
	goLegacy _ = True

[gbaz]

Thanks oleg. I think I'll close this as a dup. We should probably change policy to explicitly say OSI approved licenses going forward, to keep things simple.

[gbaz]

actually, nice, with haskell/cabal#6878 we can then move to osi or fsf/libre and that'll cover a wider variety of cases.

[phadej]

(Note that the patch is will only be released with Cabal-3.4 at the end of Summer, + hackage-server migration to use Cabal-3.4. If someone feels it needs to be backported, be my guest, make a PR).