Skip to content

fix(license): delete the Nextcloud GmbH SPDX residue instead of relabelling it - #2356

Merged
rubenvdlinde merged 1 commit into
developmentfrom
fix/remove-nextcloud-gmbh-spdx-residue
Aug 5, 2026
Merged

fix(license): delete the Nextcloud GmbH SPDX residue instead of relabelling it#2356
rubenvdlinde merged 1 commit into
developmentfrom
fix/remove-nextcloud-gmbh-spdx-residue

Conversation

@rubenvdlinde

Copy link
Copy Markdown
Contributor

What this fixes

PR #2350 (mine) flipped SPDX-License-Identifier: AGPL-3.0-or-laterEUPL-1.2 in 12 files whose adjacent line reads:

 * SPDX-FileCopyrightText: 2024 Nextcloud GmbH and Nextcloud contributors
 * SPDX-License-Identifier: EUPL-1.2      <- what #2350 made it say

That made development assert EUPL-1.2 over Nextcloud GmbH's copyright — a false licence claim over a third party's work, and strictly worse than the AGPL contradiction it replaced. I should have treated the copyright line as a stop sign instead of editing past it.

This PR deletes the residue block rather than relabelling it. No licence value is changed here; the false claim is removed.

Evidence that the block is app-template residue, not a real Nextcloud GmbH copyright

  1. It occurs in exactly 12 source files. The only other Nextcloud GmbH strings in the repo are dependency author fields inside bom-npm-test.cdx.json — an SBOM of genuine Nextcloud npm packages, correctly left untouched.
  2. 11 of the 12 already carry their own Conduction copyright in the same file (@copyright 2024 Conduction B.V., @copyright 2026 Conduction B.V.), directly contradicting the SPDX line.
  3. No Nextcloud GmbH author appears anywhere in the 12 files' history. git log --follow across all of them yields only Conduction people — Barry Brands, Conduction Development Team, Remko, Robert Zondervan, Ruben van der Linde, Thijn — plus the CI bot.
  4. The repo's other ~270 PHP files carry Conduction copyright only, with no SPDX pair at all — this block is exactly the nextcloud/app-template scaffold that the rest of the codebase already shed.

What changed per file

  • 9 × lib/Migration/Version1Date*.php — a standalone /* SPDX… */ comment sitting below an existing full Conduction PHPDoc header; the stray comment is deleted.
  • lib/Db/Webhook.php, lib/Migration/Version002003000Date20251013000000.php — the SPDX pair were the first two lines inside the main PHPDoc, which already carries @author / @copyright / @license; those two lines are removed and the rest of the docblock is untouched.
  • tests/Unit/Controller/SettingsControllerTest.php — this one had no other licence header, so deleting outright would have left it unlicensed. It gains the repo's standard test-file PHPDoc (matching tests/Unit/Activity/FilterTest.php) instead.

Verification

  • Nextcloud GmbH occurrences remaining under lib/ src/ tests/ appinfo/: 0
  • All 12 files still carry @license EUPL-1.2 and @copyright: confirmed file by file
  • php -l clean on all 12
  • 12 files changed, deletions only apart from the one test-file header

A fleet sweep of the other 15 apps found no remaining Nextcloud GmbH copyright line in any app's source, so openregister was the only repo affected.

…ng it

PR #2350 flipped 'SPDX-License-Identifier: AGPL-3.0-or-later' to EUPL-1.2 in
12 files whose adjacent line reads 'SPDX-FileCopyrightText: 2024 Nextcloud
GmbH and Nextcloud contributors'. That asserted EUPL-1.2 over a third party's
copyright — a false licence claim, and worse than the AGPL contradiction it
replaced. This deletes the residue block rather than relabelling it.

Evidence that the block is copy-paste residue from the Nextcloud app
template, not a real Nextcloud GmbH copyright:

- It occurs in exactly 12 source files; the only other 'Nextcloud GmbH'
  strings in the repo are dependency author fields in bom-npm-test.cdx.json,
  which is an SBOM of real Nextcloud npm packages and is left untouched.
- 11 of the 12 already carry their own '@copyright 20xx Conduction B.V.'
  PHPDoc tag in the same file, directly contradicting the SPDX line.
- The full git history of all 12 files contains no Nextcloud GmbH author:
  only Conduction people (Barry Brands, Conduction Development Team, Remko,
  Robert Zondervan, Ruben van der Linde, Thijn) and the CI bot.
- The repo's other ~270 PHP files carry Conduction copyright only, with no
  SPDX pair at all — this is the app-template scaffold the rest shed.

tests/Unit/Controller/SettingsControllerTest.php had no other licence header,
so it gains the repo's standard test-file PHPDoc rather than being left bare.

No licence value is changed by this commit; the false claim is removed.
@github-actions

github-actions Bot commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Quality Report — ConductionNL/openregister @ 6a2ece3

Check PHP Vue Security License Tests
lint
phpcs
phpmd
psalm
phpstan
phpmetrics
eslint
stylelint
build
check-specs
test-l10n
composer ✅ 173/173
npm ✅ 713/713
PHPUnit
Newman
Playwright
Hydra gates

Quality workflow — 2026-08-05 21:07 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde

Copy link
Copy Markdown
Contributor Author

Merging: 27 SUCCESS / 4 SKIPPED / 0 failures.

Hydra Gates ran against a real scope — Scope: diff vs origin/development — 12 changed file(s) — and reported [gate-28] license-triangle: PASS plus RESULT: ALL 59 APPLICABLE GATES PASSED — and all 59 of them ran. Not a vacuous green: the scope is non-empty and every gate declared itself.

This removes a false licence claim that is live on development right now (EUPL-1.2 asserted over Nextcloud GmbH's copyright in 12 files), so it should land promptly.

No conflict with #2345 — that PR is CLOSED, and its 32 files have zero overlap with these 12.

@rubenvdlinde
rubenvdlinde merged commit ca7838f into development Aug 5, 2026
31 checks passed
@rubenvdlinde
rubenvdlinde deleted the fix/remove-nextcloud-gmbh-spdx-residue branch August 5, 2026 21:10
rubenvdlinde added a commit that referenced this pull request Aug 5, 2026
#2356 landed the same 12 Nextcloud GmbH SPDX residue files while this branch was
in flight, deleting the stray block rather than correcting the holder. Both remove
the false third-party licence claim, which is the load-bearing outcome, so this
takes development's version verbatim and drops the duplicate work here.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant