Adjust licence check to match new requirements

[kre9]

Since certain CC Licences are now allowed to be used (e.g. with citestyles in our case) the licence check does not work correctly anymore.

The is_osi_approved function at src/check/manifest.rs:530 is throwing the error.

Reference to the changes in the packages repo:
typst/packages#1511
typst/packages#1521

[rice8y]

I ran into the same issue in typst/packages#4869 with this mixed-license expression:

license = "MIT AND CC-BY-SA-3.0"

I confirmed that this is not an SPDX parsing problem. For example:

license = "MIT AND CC-BY-SA"

fails with manifest/package/license/invalid, while:

license = "CC-BY-SA-3.0"

and

license = "MIT AND CC-BY-SA-3.0"

are parsed successfully and then fail with manifest/package/license/osi.

The cause appears to be the OSI-only check in src/check/manifest.rs:

if !id.is_osi_approved() {
    diags.emit(
        Diagnostic::error()
            .with_code("manifest/package/license/osi")
            .with_message("The `license` field should be OSI approved")
            .with_labels(vec![Label::primary(manifest_file_id, span.clone())]),
    );
}

The spdx crate does include CC-BY-SA-3.0 as a known license identifier, but it is not marked with IS_OSI_APPROVED:

License {
    name: "CC-BY-SA-3.0",
    full_name: r#"Creative Commons Attribution Share Alike 3.0 Unported"#,
    index: 158,
    flags: IS_COPYLEFT,
},

Similarly, other Creative Commons licenses allowed by the package licensing guidelines are not necessarily OSI-approved in the spdx crate:

License {
    name: "CC-BY-4.0",
    full_name: r#"Creative Commons Attribution 4.0 International"#,
    index: 123,
    flags: IS_FSF_LIBRE,
},

License {
    name: "CC-BY-SA-4.0",
    full_name: r#"Creative Commons Attribution Share Alike 4.0 International"#,
    index: 162,
    flags: IS_FSF_LIBRE | IS_COPYLEFT,
},

License {
    name: "CC0-1.0",
    full_name: r#"Creative Commons Zero v1.0 Universal"#,
    index: 166,
    flags: IS_FSF_LIBRE,
},

So the issue seems to affect all Creative Commons families explicitly allowed by the package licensing guidelines: CC-BY, CC-BY-SA, and CC0, not only CC-BY-SA-3.0.

[saecki]

I think we should still error/warn if a package is purely licensed under a Creative Commons license, but allow dual licensing if the other license is OSI approved.