make parsed license to be less like tobe a stringy license #677

jopejoe1 · 2025-10-18T22:41:44Z

I'm working on removing all stringy licenses in nixpkgs, and currently the only ones left are the ones in haskellPackages and node2nix packages. This change fixes the ones for Haskell packages.

sternenseemann

Please also add a changelog entry, ideally noting when nixpkgs added support for lib.licensesSpdx.

cabal2nix/src/Distribution/Nixpkgs/Haskell/FromCabal/License.hs

sternenseemann · 2025-10-18T22:54:02Z

cabal2nix/src/Distribution/Nixpkgs/Haskell/FromCabal/License.hs


 fromCabalLicense :: Distribution.License.License -> Distribution.Nixpkgs.License.License
-fromCabalLicense (GPL Nothing)                             = Unknown (Just "GPL")
+fromCabalLicense (GPL Nothing)                             = Known "lib.licenses.gpl2Plus"


These cases are intentional as there is not enough information to conclude what variant of the license in question is used.

I do realize they were intentional, but they can't stay in their current form. I'm currently working towards disallowing stringy licenses in nixpkgs, and those are pretty much the only ones left. Other options would be to make it even less informational with lib.licenses.free or to add a new custom license (not really a fan of this).

I looked at a few packages in more detail and I think we can reasonably do two things:

interpret GPL as gpl2Plus as done here. That's because they could have used GPL-2 or GPL-3 if they wanted to be more specific.

just use free as fallback for this.

For me, both are fine.

free as a fallback seems reasonable for GPL without further specification, that is a good idea. (But not in general as a fallback for unknown, see #677 (comment)).

cabal2nix/src/Distribution/Nixpkgs/Haskell/FromCabal/License.hs

Hackage requires open source licenses so this should always be a free license

wolfgangwalther · 2025-10-23T09:47:51Z

cabal2nix/src/Distribution/Nixpkgs/Haskell/FromCabal/License.hs

+    -- Not handed: the '+' suffix and user-defined licences references.
+    -- Use the SPDX expression as a free-form license string.
+    Unknown (Just $ DPretty.prettyShow simpl)
+fromSPDXLicenseExpression (SPDX.ELicense simpl (Just excep)) =
+  case simpl of
+  SPDX.ELicenseId lid -> Known ("lib.licensesSpdx.\"" ++ DPretty.prettyShow lid ++ "\" lib.licensesSpdx.\"" ++  DPretty.prettyShow excep ++ "\"")
+  _ ->
+    -- Not handed: the '+' suffix and user-defined licences references.


Suggested change

-- Not handed: the '+' suffix and user-defined licences references.

-- Use the SPDX expression as a free-form license string.

Unknown (Just $ DPretty.prettyShow simpl)

fromSPDXLicenseExpression (SPDX.ELicense simpl (Just excep)) =

case simpl of

SPDX.ELicenseId lid -> Known ("lib.licensesSpdx.\"" ++ DPretty.prettyShow lid ++ "\" lib.licensesSpdx.\"" ++ DPretty.prettyShow excep ++ "\"")

_ ->

-- Not handed: the '+' suffix and user-defined licences references.

-- Not handled: the '+' suffix and user-defined licences references.

-- Use the SPDX expression as a free-form license string.

Unknown (Just $ DPretty.prettyShow simpl)

fromSPDXLicenseExpression (SPDX.ELicense simpl (Just excep)) =

case simpl of

SPDX.ELicenseId lid -> Known ("lib.licensesSpdx.\"" ++ DPretty.prettyShow lid ++ "\" lib.licensesSpdx.\"" ++ DPretty.prettyShow excep ++ "\"")

_ ->

-- Not handled: the '+' suffix and user-defined licences references.

There is also a typo in the commit message.

Why is this comment repeated?

wolfgangwalther · 2025-10-23T09:49:54Z

cabal2nix/test/golden-test-cases/incremental-parser.nix.golden

  homepage = "https://github.com/blamario/incremental-parser";
  description = "Generic parser library capable of providing partial results from partial input";
-  license = "GPL";
+  license = lib.licenses.gpl2Plus;


Upstream has changed to GPL-3 by now.

It is probably fine to update these test expressions to newer versions of the cabal file, but some of them may test something specific that has since been removed.

wolfgangwalther · 2025-10-23T09:51:56Z

cabal2nix/test/golden-test-cases/highlighting-kate.nix.golden

  homepage = "http://github.com/jgm/highlighting-kate";
  description = "Syntax highlighting";
-  license = "GPL";
+  license = lib.licenses.gpl2Plus;


Upstream still uses GPL, and has gpl2Only, I think: https://github.com/jgm/highlighting-kate/blob/master/LICENSE

wolfgangwalther · 2025-10-23T09:57:02Z

cabal2nix/test/golden-test-cases/HTF.nix.golden

  homepage = "https://github.com/skogsbaer/HTF/";
  description = "The Haskell Test Framework";
-  license = "LGPL";
+  license = lib.licenses.lgpl2Plus;


Upstream has now LGPL-2.1, which renders as LGPL-2.1-only on hackage.

wolfgangwalther · 2025-10-23T10:00:34Z

cabal2nix/test/golden-test-cases/lambdabot-social-plugins.nix.golden

  homepage = "https://wiki.haskell.org/Lambdabot";
  description = "Social plugins for Lambdabot";
-  license = "GPL";
+  license = lib.licenses.gpl2Plus;


lambdabot-social-plugins has GPL, but.. the license looks like BSD/MIT: https://github.com/lambdabot/lambdabot/blob/master/lambdabot-social-plugins/LICENSE

wolfgangwalther · 2025-10-23T10:02:42Z

cabal2nix/test/golden-test-cases/texmath.nix.golden

  homepage = "http://github.com/jgm/texmath";
  description = "Conversion between formats used to represent mathematics";
-  license = "GPL";
+  license = lib.licenses.gpl2Plus;


texmath has updated to GPL-2, which renders as GPL-2.0-only on hackage.

wolfgangwalther · 2025-10-23T10:05:07Z

cabal2nix/src/Distribution/Nixpkgs/Haskell/FromCabal/License.hs


 fromCabalLicense :: Distribution.License.License -> Distribution.Nixpkgs.License.License
-fromCabalLicense (GPL Nothing)                             = Unknown (Just "GPL")
+fromCabalLicense (GPL Nothing)                             = Known "lib.licenses.gpl2Plus"


I looked at a few packages in more detail and I think we can reasonably do two things:

interpret GPL as gpl2Plus as done here. That's because they could have used GPL-2 or GPL-3 if they wanted to be more specific.

just use free as fallback for this.

For me, both are fine.

sternenseemann · 2025-10-24T19:30:51Z

For context, see also #520.

One thing to keep in mind is that while cabal2nix mostly deals with Hackage, it may also process arbitrary cabal files. We can make some assumptions in Nixpkgs since additions of unfree packages would always have to be manual, but it does not seem wise to have such assumptions leak into cabal2nix which may be used in arbitrary ways on arbitrary inputs.

In particular,

I don't like mapping ambiguous licenses to something we reckon is probably right. If we don't have enough information to accurately determine the license from metadata, we should not guess. Instead, such information needs to be set manually via overrides in Nixpkgs. This gets the desired effect (no stringy licenses) without requiring questionable behavior. Also, it creates an incentive to get upstream maintainers to update their meta data. (Edit: Mapping GPL to free as suggested in make parsed license to be less like tobe a stringy license #677 (comment) is correct, so we could do that.)
We also should not map anything to lib.licenses.free because it only holds for Hackage packages. cabal2nix can't tell a package descriptions origin in all cases, so this is an exercise in futility. If license information is missing, I would propose we just do not set license and change haskellPackages.mkDerivation to allow for this.

Apologies for the inconsistent messages. Some of my earlier comments were informed by an incorrect assumption how we decide on free/nonfree.

(Note that prior to #520, cabal2nix would prevent “unfree” packages from being built on Hydra, but Nixpkgs seems to consider stringy licenses as free by default (?). So from cabal2nix's perspective, we are currently always reporting the license accurately without any illegitimate transformations and letting Nixpkgs decide whether it is free or unfree. This should be preserved, in my opinion.)

sternenseemann · 2025-10-24T19:43:37Z

cabal2nix/src/Distribution/Nixpkgs/Haskell/FromCabal/License.hs

+    -- Not handed: the '+' suffix and user-defined licences references.
+    -- Use the SPDX expression as a free-form license string.
+    Unknown (Just $ DPretty.prettyShow simpl)
+fromSPDXLicenseExpression (SPDX.ELicense simpl (Just excep)) =
+  case simpl of
+  SPDX.ELicenseId lid -> Known ("lib.licensesSpdx.\"" ++ DPretty.prettyShow lid ++ "\" lib.licensesSpdx.\"" ++  DPretty.prettyShow excep ++ "\"")
+  _ ->
+    -- Not handed: the '+' suffix and user-defined licences references.


There is also a typo in the commit message.

sternenseemann · 2025-10-24T20:59:28Z

cabal2nix/src/Distribution/Nixpkgs/Haskell/FromCabal/License.hs

+    Unknown (Just $ DPretty.prettyShow simpl)
+fromSPDXLicenseExpression (SPDX.ELicense simpl (Just excep)) =
+  case simpl of
+  SPDX.ELicenseId lid -> Known ("lib.licensesSpdx.\"" ++ DPretty.prettyShow lid ++ "\" lib.licensesSpdx.\"" ++  DPretty.prettyShow excep ++ "\"")


In spirit, License holds a Nix expression, so we should not output fragments of one here, but instead make sure it is individually a valid Nix expression. As such the [ … ] should be added in this function and not fromSPDXLicense.

Or we don't return a License here to make clear what's going on. In general, it may be wise to move this into a where since it is not really something that should be called except from fromSPDXLicense.

sternenseemann · 2025-10-24T21:01:29Z

cabal2nix/src/Distribution/Nixpkgs/Haskell/FromCabal/License.hs

+    -- Not handed: the '+' suffix and user-defined licences references.
+    -- Use the SPDX expression as a free-form license string.
+    Unknown (Just $ DPretty.prettyShow simpl)
+fromSPDXLicenseExpression (SPDX.ELicense simpl (Just excep)) =
+  case simpl of
+  SPDX.ELicenseId lid -> Known ("lib.licensesSpdx.\"" ++ DPretty.prettyShow lid ++ "\" lib.licensesSpdx.\"" ++  DPretty.prettyShow excep ++ "\"")
+  _ ->
+    -- Not handed: the '+' suffix and user-defined licences references.


Why is this comment repeated?

sternenseemann · 2025-10-24T21:03:37Z

Cherry picked 7a5af01 onto master.

sternenseemann · 2025-10-26T11:21:44Z

We currently have about 250 packages with a string license we actually are building and distributing. In total, haskellPackages contains about 1000 packages with a stringy license, about 75% of those are currently marked as broken or depend on a broken dependency.

`stdenv.mkDerivation` does not require meta.license to be passed, so there is no reason `haskellPackages.mkDerivation` needs to enforce this. This would free up cabal2nix to not report a license if it is not sure. As I have argued in NixOS/cabal2nix#677 (comment), it is better not to report a license than reporting an inaccurate one. This would also allow to stop generating arbitrary strings as licenses in cabal2nix to remove string values to facilitate more cleanliness in the spirit of #445672, though the question is whether it is wise to remove the meta data altogether.

fromSPDXLicense: make use of lib.licensesSpdx

a02dea3

sternenseemann requested changes Oct 18, 2025

View reviewed changes

jopejoe1 added 3 commits October 19, 2025 02:07

fromSPDXLicense: handel compound licenses

3acaa74

fromSPDXLicense: mark SPDX.NONE as generic free

3994038

Hackage requires open source licenses so this should always be a free license

fromCabalLicense: don't return stringy licenses

1a2e97e

jopejoe1 force-pushed the licenses branch from c3b971c to 1a2e97e Compare October 19, 2025 00:09

wolfgangwalther reviewed Oct 23, 2025

View reviewed changes

sternenseemann reviewed Oct 24, 2025

View reviewed changes

sternenseemann mentioned this pull request Oct 26, 2025

haskellPackages.mkDerivation: make license optional NixOS/nixpkgs#455796

Merged

13 tasks

Uh oh!

Uh oh!

make parsed license to be less like tobe a stringy license #677

Are you sure you want to change the base?

make parsed license to be less like tobe a stringy license #677

Uh oh!

Conversation

jopejoe1 commented Oct 18, 2025

Uh oh!

sternenseemann left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sternenseemann commented Oct 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sternenseemann commented Oct 24, 2025

Uh oh!

sternenseemann commented Oct 26, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

sternenseemann commented Oct 24, 2025 •

edited

Loading