Add EUPL-1.2 to accepted licence identifiers

[rubenvdlinde]

Summary

The Nextcloud appstore rejects apps with <licence>EUPL-1.2</licence> in their info.xml, returning HTTP 400 on the release upload API (POST /api/v1/apps/releases).

EUPL-1.2 (European Union Public License) is a widely used open-source license, especially in European government and public sector projects. It is an OSI-approved and SPDX-listed license.

Current behaviour

The appstore schema (info.xsd) only accepts these licence identifiers:

• SPDX: AGPL-3.0-only, AGPL-3.0-or-later, Apache-2.0, GPL-3.0-only, GPL-3.0-or-later, MIT, MPL-2.0
• Deprecated aliases: agpl, mit, mpl, apache, gpl3

Any other SPDX identifier (including EUPL-1.2) causes the release API to return 400.

Expected behaviour

EUPL-1.2 should be accepted as a valid licence identifier, since it is:

• A valid SPDX identifier
• OSI-approved
• Compatible with AGPL-3.0 (EUPL 1.2 Appendix lists AGPLv3 as a compatible licence)
• Increasingly required for EU public sector software projects

Steps to reproduce

1. Set <licence>EUPL-1.2</licence> in an app's appinfo/info.xml
2. Push a release using nextcloud-releases/nextcloud-appstore-push-action
3. The upload step fails with curl: (22) The requested URL returned error: 400

Workaround

Use <licence>agpl</licence> in info.xml while keeping the actual LICENSE file as EUPL-1.2. This works but misrepresents the licence in the appstore.

[AndyScherzinger]

So EUPL 1.2+ is fine, given its compatibility, see https://interoperable-europe.ec.europa.eu/collection/eupl/news/eupl-or-gplv3-comparison-t especially Chapter 5. Freedom and Copyleft effect:

Free software freedoms are given by the licence.

The licence is copyleft, meaning that once software is licensed under EUPL, it is “forever”. However, the EUPL has a compatibility list: when it is necessary for avoiding licence conflicts, developers have the freedom to license a composed work under another “similar” copyleft licence: GPLv2, Eclipse, OSL, CeCILL, Common Public Licence.

The EUPL v1.2 (May 2017) has extended the list to the GPLv3, to the AGPL and also to the MPL and LGPL.

This is the “compatibility” answer provided by the EUPL to solve the proliferation of copyleft licences. The compatibility list will be extended if there is a need to do so. For example, you can merge or combine GPLv3 software into EUPL software and – in order to avoid licence conflicts – you will licence the composed work (or the merged software) as a whole under the provision of the GPLv3.

[clawdney]

Hi! I'm interested in helping with this. Could you share more context about the use case?

[AndyScherzinger]

Hi @clawdney

The use case is to allow for apps installed on a Nextcloud server to mark their license as EUPL-1.2. In order to allow for this the appstore (this repository) as well as the server (https://github.com/nextcloud/server) need to be extended. You can search for the PR that added the formerly added new SPDX-Identifiers like AGPL-3.0-or-later on both repository and apply the same implementation logic to add EUPL-1.2. The PRs need to target the main branches of each repository only. Backports will be done by the maintainers.
AS a bonus you can also add a comment to the PR, not the code which further licenses would be compliant to AGPL-3.0-only and AGPL-3.0-or-later and could be added later. Adding them is a decision of the maintainers though.

If you pick up this task comment here first so people are aware of you working on it.

[clawdney]

I'd be happy to work on this! I'll:

1. Find the PR that added AGPL-3.0-or-later support
2. Apply the same implementation for EUPL-1.2
3. Create PRs for both appstore and server

Let me start working on this.