Allow CC-BY, CC-BY-SA, and CC0 licenses (#1521)

README.md

@@ -29,7 +29,12 @@ Required for submissions to this repository:
   address, homepage, or GitHub handle in angle brackets. The latter must start
   with an `@` character, and URLs must start with `http://` or `https://`.
 - `license`: The package's license. Must contain a valid SPDX-2 expression
-  describing one or multiple [OSI-approved][OSI] licenses.
+  describing one or multiple licenses that are either [OSI-approved][OSI]
+  licenses or a version of CC-BY, CC-BY-SA, or CC0. We recommend you do not
+  license your package using a Creative Commons license unless it is a
+  derivative work of a CC-BY-SA-licensed work or if it is not primarily code,
+  but content or data. In most other cases, [a free/open license specific to
+  software is better suited for Typst packages](https://creativecommons.org/faq/#can-i-apply-a-creative-commons-license-to-software).
 - `description`: A short description of the package. Double-check this for
   grammar and spelling mistakes as it will appear in the [package list][list].
 

bundler/Cargo.toml

@@ -13,6 +13,7 @@ flate2 = "1"
 ignore = "0.4"
 image = { version = "0.24.9", default-features = false, features = ["png", "webp", "webp-encoder"] }
 rayon = "1.0"
+regex = "1.11.1"
 semver = { version = "1", features = ["serde"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"

bundler/src/main.rs

@@ -8,11 +8,13 @@ use std::env::args;
 use std::fs;
 use std::io;
 use std::path::Path;
+use std::sync::LazyLock;
 
 use anyhow::{bail, Context};
 use image::codecs::webp::{WebPEncoder, WebPQuality};
 use image::imageops::FilterType;
 use semver::Version;
+use spdx::LicenseId;
 use typst_syntax::package::{PackageInfo, PackageManifest, TemplateInfo, UnknownFields};
 use unicode_ident::{is_xid_continue, is_xid_start};
 
@@ -106,7 +108,7 @@ fn main() -> anyhow::Result<()> {
         determine_timestamps(&paths, &mut index)?;
 
         // Sort the index.
-        index.sort_by_key(|info| (info.package.name.clone(), info.package.version.clone()));
+        index.sort_by_key(|info| (info.package.name.clone(), info.package.version));
 
         println!("Writing index.");
         fs::write(
@@ -247,8 +249,11 @@ fn parse_manifest(path: &Path, namespace: &str) -> anyhow::Result<PackageManifes
             .id()
             .context("license must not contain a referencer")?;
 
-        if !id.is_osi_approved() {
-            bail!("license is not OSI approved: {}", id.full_name);
+        if !id.is_osi_approved() && !is_allowed_cc(id) {
+            bail!(
+                "license is neither OSI approved nor an allowed CC license: {}",
+                id.full_name
+            );
         }
     }
 
@@ -454,3 +459,11 @@ fn is_id_start(c: char) -> bool {
 fn is_id_continue(c: char) -> bool {
     is_xid_continue(c) || c == '_' || c == '-'
 }
+
+// Check that a license is any version of CC-BY, CC-BY-SA, or CC0.
+fn is_allowed_cc(license: LicenseId) -> bool {
+    static RE: LazyLock<regex::Regex> =
+        LazyLock::new(|| regex::Regex::new(r"^CC(-BY|-BY-SA|0)-[0-9]\.[0-9](-[A-Z]+)?$").unwrap());
+
+    RE.is_match(license.name)
+}