Relicense natrium from GPL-3.0 to EUPL-1.2

.gitignore

@@ -590,4 +590,6 @@ FodyWeavers.xsd
 
 # macOS
 .DS_Store
-**/.DS_Store
+**/.DS_Store
+
+**/ignore/**

.ort.yml

@@ -25,19 +25,31 @@ excludes:
 
 resolutions:
   rule_violations:
+    - message: ".*(kalium|com\\.wire:logic|schwarz\\.opensource\\.natrium:logic).*GPL-3\\.0.*"
+      reason: "LICENSE_ACQUIRED_EXCEPTION"
+      comment: |
+        Natrium wrapper code is distributed under EUPL-1.2. The Kalium SDK
+        remains GPL-3.0 (or commercially licensed by Wire Swiss GmbH) and is
+        not relicensed under the EUPL. A commercial licence from Wire
+        authorises this combination without GPL copyleft extending to Natrium.
+        See NOTICE and README.
     - message: ".*core-crypto.*GPL-3\\.0-only.*"
       reason: "LICENSE_ACQUIRED_EXCEPTION"
       comment: |
-        natrium is distributed under GPL-3.0-only. The Wire core-crypto
-        family of libraries is GPL-3.0-only by design and required for
-        end-to-end encryption. This includes both the official Wire
+        Natrium wrapper code is distributed under EUPL-1.2. The Wire
+        core-crypto family of libraries is GPL-3.0-only by design and required
+        for end-to-end encryption. This includes both the official Wire
         releases (com.wire:core-crypto-jvm, com.wire:core-crypto-android)
         and the io.github.mohamadjaara:core-crypto-kmp-* multiplatform
         wrapper used by KMP targets (kmp, android, iosarm64, macosarm64).
-        Inbound and outbound licenses match.
+        These components ship with Kalium, remain GPL-3.0, and are not
+        relicensed under the EUPL. A commercial licence from Wire authorises
+        this combination without GPL copyleft extending to Natrium.
     - message: ".*com\\.wire:avs.*GPL-3\\.0-only.*"
       reason: "LICENSE_ACQUIRED_EXCEPTION"
       comment: |
-        natrium is distributed under GPL-3.0-only. The Wire AVS
+        Natrium wrapper code is distributed under EUPL-1.2. The Wire AVS
         (audio-video-signaling) library is GPL-3.0-only by design and
-        required for calling functionality.
+        required for calling functionality. It remains GPL-3.0 and is not
+        relicensed under the EUPL. A commercial licence from Wire authorises
+        this combination without GPL copyleft extending to Natrium.

NOTICE

@@ -0,0 +1,41 @@
+Natrium SDK
+Copyright (C) 2026 Schwarz Digits KG
+
+The Natrium SDK (the wrapper code in this repository) is licensed under the
+European Union Public Licence v. 1.2 only (EUPL-1.2). See the LICENSE file.
+
+----------------------------------------------------------------------
+Kalium SDK — not licensed under the EUPL
+
+Kalium SDK
+Copyright (C) Wire Swiss GmbH
+
+Natrium depends on the Kalium SDK developed by Wire Swiss GmbH
+(https://github.com/wireapp/kalium). In this project Kalium is consumed as a
+build dependency (currently published as schwarz.opensource.natrium:logic).
+
+No portion of the Kalium SDK is licensed under the EUPL-1.2, either as a
+standalone component or as incorporated in the Natrium SDK.
+
+The Kalium SDK may only be used under:
+
+  (a) the GNU General Public License Version 3 (GPL-3.0), as published by
+      Wire in the Wire Upstream Repository; or
+  (b) a commercial licence obtained from Wire Swiss GmbH.
+
+Linking or combining the Natrium SDK with the Kalium SDK does not cause
+any copyleft effect of the EUPL-1.2 to extend to the Kalium SDK.
+
+Recipients who use the Kalium SDK without a commercial licence from Wire
+remain subject to the GPL-3.0 and to the licences of Kalium’s third-party
+dependencies.
+
+----------------------------------------------------------------------
+Third-party dependencies
+
+Third-party components incorporated into the Kalium SDK remain subject to
+their respective original licence terms, independently of the EUPL-1.2
+licence of Natrium and independently of any commercial licence for Kalium.
+A list of these components and their applicable licences is provided by
+Wire Swiss GmbH as a Software Bill of Materials (SBOM); see the
+THIRD-PARTY-NOTICES file.

README.md

@@ -53,5 +53,29 @@ See [`natrium-core/README.md`](natrium-core/README.md) for the complete document
 
 ## License
 
-This project is licensed under the GNU General Public License v3.0.
-See [LICENSE](LICENSE) for details.
+The Natrium SDK (the wrapper code in this repository) is licensed under the
+**European Union Public Licence v. 1.2 only** (EUPL-1.2).
+See [LICENSE](LICENSE) for the full licence text and [NOTICE](NOTICE) for
+attribution.
+
+### Kalium SDK — not licensed under the EUPL
+
+Natrium depends on Wire’s [Kalium SDK](https://github.com/wireapp/kalium)
+(currently the Maven artifact `schwarz.opensource.natrium:logic`). **No portion
+of the Kalium SDK is licensed under the EUPL-1.2**, either as a standalone
+component or as incorporated in Natrium.
+
+The Kalium SDK may only be used under:
+
+- the [GNU General Public License v3.0](https://www.gnu.org/licenses/gpl-3.0.html),
+  as published by Wire; or
+- a commercial licence obtained from Wire Swiss GmbH.
+
+Linking or combining Natrium with the Kalium SDK does not cause any copyleft
+effect of the EUPL-1.2 to extend to Kalium. Recipients who use Kalium without a
+commercial licence from Wire remain subject to the GPL-3.0 and to the licences
+of Kalium’s third-party dependencies.
+
+Publication of Natrium under the EUPL-1.2 is authorised by a commercial licence
+agreement between Schwarz Digits and Wire Swiss GmbH. That agreement does not
+grant any Kalium rights to recipients of Natrium.

THIRD-PARTY-NOTICES

@@ -0,0 +1,103 @@
+Third-Party Notices for the Natrium SDK
+=======================================
+
+The Natrium SDK (the wrapper code in this repository) is licensed under the
+European Union Public Licence v. 1.2 only (EUPL-1.2); see LICENSE.
+
+This file lists the components that the published `natrium-core` artifact
+depends on. It was generated from the Gradle dependency graph (JVM target,
+2026-08-24) and is to be reconciled with the Software Bill of Materials
+(SBOM) provided by Wire Swiss GmbH, which is the authoritative source for
+the components shipped with the Kalium SDK.
+
+Note for application developers: `natrium-core` does not bundle these
+components; they are resolved as Maven dependencies by your build.
+Applications that ship Natrium (and thereby these components) to end users
+must reproduce the attribution notices and licence texts that the
+respective licences require (e.g. the Apache-2.0 licence text and NOTICE
+file contents, and the MIT copyright and permission notices).
+
+Kalium SDK
+----------
+
+Kalium SDK
+Copyright (C) Wire Swiss GmbH
+https://github.com/wireapp/kalium
+
+Consumed as the Maven artifacts `schwarz.opensource.natrium:logic` and its
+`schwarz.opensource.natrium:*` submodules, version 0.0.2-fork.1, built from
+the public fork https://github.com/schwarzdigits/kalium.
+
+The Kalium SDK is NOT licensed under the EUPL-1.2. It may only be used under
+the GNU General Public License Version 3 (GPL-3.0) or a commercial licence
+obtained from Wire Swiss GmbH. See NOTICE.
+
+Components licensed under the GPL-3.0
+-------------------------------------
+
+These ship with the Kalium SDK, remain GPL-3.0, and are not relicensed
+under the EUPL (see NOTICE):
+
+- io.github.mohamadjaara:core-crypto-kmp 9.3.0.1-kmp — Wire CoreCrypto
+  (Kotlin Multiplatform packaging), Copyright (C) Wire Swiss GmbH — GPL-3.0
+
+Components licensed under the Apache License 2.0
+------------------------------------------------
+
+- androidx.annotation:annotation 1.1.0; androidx.arch.core:core-common
+  2.1.0; androidx.paging:paging-common 3.1.1 — The Android Open Source
+  Project / Google LLC
+- app.cash.paging:paging-common 3.1.1-0.3.1 — Cash App / Block, Inc.
+- app.cash.sqldelight (runtime, jdbc-driver, sqlite-driver,
+  coroutines-extensions, async-extensions, androidx-paging3-extensions,
+  primitive-adapters) 2.2.1 — Cash App / Block, Inc.
+- aws.sdk.kotlin (s3, aws-config, aws-core, aws-endpoint, aws-http) 1.5.89
+  and aws.smithy.kotlin (runtime modules) 1.5.20 — Amazon.com, Inc.
+- co.touchlab:kermit 2.0.3 and co.touchlab:stately 2.1.0 — Touchlab, Inc.
+- com.ionspin.kotlin:multiplatform-crypto-libsodium-bindings 0.9.5 —
+  Ugljesa Jovanovic (bindings; the bundled libsodium library itself is
+  ISC-licensed, Copyright (C) Frank Denis)
+- com.russhwolf:multiplatform-settings 1.3.0 — Russell Wolf
+- com.squareup.okhttp3:okhttp 5.3.2 (and okhttp-coroutines 5.1.0) —
+  Square, Inc. / Block, Inc.
+- com.squareup.okio:okio 3.16.4 (and okio-fakefilesystem 3.9.0) —
+  Square, Inc. / Block, Inc.
+- com.wire:cells-sdk-kmp 0.1.1-alpha17 — Wire Swiss GmbH (Apache-2.0)
+- commons-io:commons-io 2.18.0 — The Apache Software Foundation
+- org.apache.tika:tika-core 3.1.0 — The Apache Software Foundation
+- io.ktor (client and serialization modules) 3.4.0 — JetBrains s.r.o.
+- org.jetbrains:annotations 23.0.0 — JetBrains s.r.o.
+- org.jetbrains.kotlin:kotlin-stdlib 2.3.0, kotlin-reflect 2.2.21 —
+  JetBrains s.r.o. / Kotlin Foundation
+- org.jetbrains.kotlinx: atomicfu 0.26.1, kotlinx-coroutines 1.10.2,
+  kotlinx-datetime 0.6.1, kotlinx-io 0.8.2, kotlinx-serialization 1.9.0 —
+  JetBrains s.r.o.
+- org.objenesis:objenesis 3.3 — Joe Walnes, Henri Tremblay, Leonardo Mesquita
+- org.xerial:sqlite-jdbc 3.51.0.0 — Taro L. Saito / xerial.org (bundles
+  SQLite, which is public domain)
+
+Components licensed under the MIT License
+-----------------------------------------
+
+- com.goterl:resource-loader 2.0.2 — Terl Tech Ltd
+- io.github.mohamadjaara:mockative 3.1.4 — Mockative contributors
+- org.slf4j:slf4j-api 2.0.17 — Copyright (C) 2004-2022 QOS.ch Sarl
+- pro.streem.pbandk (pbandk-runtime, pbandk-protos) 0.15.0 — Streem, Inc.
+  and pbandk contributors
+
+Multi-licensed components
+-------------------------
+
+- net.java.dev.jna:jna 5.18.1 — dual-licensed LGPL-2.1-or-later OR
+  Apache-2.0; used here under the Apache License 2.0
+- org.javassist:javassist 3.29.2-GA — tri-licensed MPL 1.1 / LGPL 2.1 /
+  Apache-2.0; used here under the Apache License 2.0
+
+Other targets
+-------------
+
+The list above reflects the JVM target. The Android and iOS targets of
+`natrium-core` pull additional platform-specific components shipped with
+the Kalium SDK (for example com.wire:avs, GPL-3.0, and platform packagings
+of CoreCrypto and libsodium). These are to be completed from the SBOM
+provided by Wire Swiss GmbH.

build.gradle.kts

@@ -1,18 +1,18 @@
 /*
  * Copyright (C) 2026 Schwarz Digits KG
  *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
+ * Licensed under the EUPL v. 1.2 only.
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
  *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ * implied. See the Licence for the specific language governing
+ * permissions and limitations under the Licence.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ * SPDX-License-Identifier: EUPL-1.2
  */
 
 // Root build script — declare plugins here so sibling projects share a classloader

natrium-cli/README.md

@@ -382,3 +382,11 @@ Natrium/Kalium stores accounts and session data under:
 ```text
 ~/.natrium
 ```
+
+## License
+
+Natrium wrapper code is licensed under the **EUPL v. 1.2 only**. The Kalium SDK
+used internally is **not** licensed under the EUPL; it may only be used under
+the GPL-3.0 or a commercial licence from Wire Swiss GmbH. See the
+[root README](../README.md#license), [LICENSE](../LICENSE), and
+[NOTICE](../NOTICE).

natrium-cli/build.gradle.kts

@@ -1,18 +1,18 @@
 /*
  * Copyright (C) 2026 Schwarz Digits KG
  *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
+ * Licensed under the EUPL v. 1.2 only.
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
  *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ * implied. See the Licence for the specific language governing
+ * permissions and limitations under the Licence.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ * SPDX-License-Identifier: EUPL-1.2
  */
 
 import java.util.Properties

natrium-cli/src/main/kotlin/schwarz/digits/natrium/cli/Main.kt

@@ -1,18 +1,18 @@
 /*
  * Copyright (C) 2026 Schwarz Digits KG
  *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
+ * Licensed under the EUPL v. 1.2 only.
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
  *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ * implied. See the Licence for the specific language governing
+ * permissions and limitations under the Licence.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ * SPDX-License-Identifier: EUPL-1.2
  */
 
 package schwarz.digits.natrium.cli

natrium-cli/src/main/kotlin/schwarz/digits/natrium/cli/NatriumCLI.kt

@@ -1,18 +1,18 @@
 /*
  * Copyright (C) 2026 Schwarz Digits KG
  *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
+ * Licensed under the EUPL v. 1.2 only.
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
  *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ * implied. See the Licence for the specific language governing
+ * permissions and limitations under the Licence.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ * SPDX-License-Identifier: EUPL-1.2
  */
 
 package schwarz.digits.natrium.cli

natrium-cli/src/main/kotlin/schwarz/digits/natrium/cli/commands/AuthEventsCommand.kt

@@ -1,18 +1,18 @@
 /*
  * Copyright (C) 2026 Schwarz Digits KG
  *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation, either version 3 of the License, or
- * (at your option) any later version.
+ * Licensed under the EUPL v. 1.2 only.
+ * You may not use this work except in compliance with the Licence.
+ * You may obtain a copy of the Licence at:
+ * https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12
  *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU General Public License for more details.
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the Licence is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+ * implied. See the Licence for the specific language governing
+ * permissions and limitations under the Licence.
  *
- * You should have received a copy of the GNU General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ * SPDX-License-Identifier: EUPL-1.2
  */
 
 package schwarz.digits.natrium.cli.commands