[BUG] license "CC0-1.0" no longer recognized

[jkowalleck]

Description

First of all, thank you for your bug report. Please fill out below sections (if applicable) to help us fix the issue as good and fast as possible.

Steps for reproduction

Since v1.3.0, the license "CC0-1.0" is not supported

$ pip install flict==1.3.0
$ flict display-compatibility CC0-1.0 MIT
ERROR:flict:License expression "CC0-1.0" is not supported.

Expected behavior

The license "CC0-1.0" is not supported, like it was before

$ pip install flict==1.2.14
$ flict display-compatibility CC0-1.0 MIT
{"compatibilities": [{"license": "CC0-1.0", "licenses": [{"license": "CC0-1.0", "compatible_right": "true", "compatible_left": "true"}, {"license": "MIT", "compatible_right": "true", "compatible_left": "true"}]}, {"license": "MIT", "licenses": [{"license": "CC0-1.0", "compatible_right": "true", "compatible_left": "true"}, {"license": "MIT", "compatible_right": "true", "compatible_left": "true"}]}]}

Actual behavior

What do you see instead?

Environment

tool	version	how to get it
flict	1.3.0	flict --version
python3	!!enter here!!	python3 --version
os	!!enter here!!	n.a.

add additional tools you used and their versions here

Additional logs

$ pip freeze
attrs==24.2.0
boolean.py==4.0
flict==1.3.0
foss-flame==0.20.6
jsonschema==4.23.0
jsonschema-specifications==2024.10.1
license-expression==30.4.0
osadl-matrix==2024.5.22.10535
PyYAML==6.0.2
referencing==0.35.1
rpds-py==0.20.1
spdx-license-list==3.25.0

[jkowalleck]

issue seams to be caused by a bump of direct dependency osadl-matrix==2024.5.7.50556 -> ==2024.5.22.10535

see
https://github.com/priv-kweihmann/osadl-matrix/blob/a9840dcb941d8e87cac0e1772532a3c4bdc4d871/DATALOG.md?plain=1#L95

Changes in 2024-05-21T02:14:00+00:00

[...]

• CC0-1.0: got removed

[hesa]

I am afraid this is out of flict's control. We, currently, rely on the latest version of OSADL's matrix.

You can take the old matrix (e.g. from flict 1.2.14) and use that version with newer flict versions.

Or, if you are only interested in compatibility between two licenses only and not an expression (e.g. MIT OR Apache-2.0) or the licenses of all the dependencies of a project, then you can look at https://github.com/hesa/licomp-toolkit. Let's say you want to check if you can use MIT as inbound license with CC0-1.0 as outbound:

pip install licomp-toolkit
licomp-toolkit --local verify -ol CC0-1.0 -il MIT | jq .summary

[jkowalleck]

I am afraid this is out of flict's control. We, currently, rely on the latest version of OSADL's matrix.

Is the matrix not utterly broken since osadl-matrix==2024.5.7.50556 -> ==2024.5.22.10535 ?
I mean, https://github.com/priv-kweihmann/osadl-matrix/blob/a9840dcb941d8e87cac0e1772532a3c4bdc4d871/DATALOG.md#changes-in-2024-05-21t0214000000 basically removed so many licences, that it renders the whole tool unusable.

Anyway, I'd encourage to implement integration tests to prevent such backwards incompatible dependency changes.
Dropping entire support of certain licences should be detected and documented somewhere.

PS: I sont think adding new integration tests make any sense, since the osadl-matrix was deprecated and probably will not receive any updates.

PS: since the 2024.5.x release, major flaws seam to happen:

• No new version with wrong data priv-kweihmann/osadl-matrix#184
• Deprecation of the library priv-kweihmann/osadl-matrix#209

[jkowalleck]

You can take the old matrix (e.g. from flict 1.2.14) and use that version with newer flict versions.

how?
I mean, the flict-1.3.0-py3-none-any.whl clearly depends on the specific version of that matrix:

Metadata-Version: 2.1
Name: flict
Version: 1.3.0
Summary: FOSS License Compatibility Tool
[...]
Requires-Dist: osadl-matrix==2024.5.22.10535

I could imagine you are referring to a custom license_matrix-file.
Well, that is probably not what I want, I do not have the legal expertise to maintain such a list.

[hesa]

Is the matrix not utterly broken since osadl-matrix==2024.5.7.50556 -> ==2024.5.22.10535 ?
I mean, https://github.com/priv-kweihmann/osadl-matrix/blob/a9840dcb941d8e87cac0e1772532a3c4bdc4d871/DATALOG.md#changes-in-2024-05-21t0214000000 basically removed so many licences, that it renders the whole tool unusable.

An update for a valid reason is OK IMO. I prefer that over keeping a faulty compatibility status.

I do not know why the data in the canonical compatibility data was updated/removed. I would assume it was done for a good reason (e.g. an error was found).

When it comes to CC0-1.0 my guess is the phrase including all related and neighboring rights, to the extent allowed by law. that is problematic

Anyway, I'd encourage to implement integration tests to prevent such backwards incompatible dependency changes.

agree

Dropping entire support of certain licences should be detected and documented somewhere.

agree

PS: I sont think adding new integration tests make any sense, since the osadl-matrix was deprecated and probably will not receive any updates.

I think flict needs to move to use https://github.com/hesa/licomp-toolkit instead.

Adding regression tests will make sense once that is done.

[hesa]

how?

$ mkdir ~/.osadl_matrix/

$ cd ~/.osadl_matrix/

$ curl -LJO https://raw.githubusercontent.com/priv-kweihmann/osadl-matrix/7cddb98427b8fbb1963559e55b581949c2f133aa/osadl_matrix/osadl-matrix.json

$ flict --license-matrix-file ~/.osadl_matrix/osadl-matrix.json display-compatibility CC0-1.0 MIT
{"compatibilities": [{"license": "CC0-1.0", "licenses": [{"license": "CC0-1.0", "compatible_right": "true", "compatible_left": "true"}, {"license": "MIT", "compatible_right": "true", "compatible_left": "true"}]}, {"license": "MIT", "licenses": [{"license": "CC0-1.0", "compatible_right": "true", "compatible_left": "true"}, {"license": "MIT", "compatible_right": "true", "compatible_left": "true"}]}]}