Technical Team/Old/Sandbox for Sharing Examples/How to Handle Licenses in SPDX

2010-04-08T17:08:30Z

Bruno Cornec:

Handling of Licenses IDs (Short names)
<ul>
<li>We have proposed using the Fedora short names</li>
<li>We have also looked at the Debian naming scheme</li>
<li>There are a couple of key differences</li>
<li>Version handling</li>
</ul>
1. Fedora builds versions into the short name, but it is done in a non-standardized way that seems to vary from license to license, eg
<ol> </ol>
<ul>
<li>ASL 1.0  (for Apache 1.0)</li>
<li>AGPLv1  (for Affero GPL v1)</li>
<li>CeCill (for both Cecill v1.1 and v2)</li>
</ul>
2. Debian proposes a standard way – “license name-version”, eg
<ol> </ol>
<ul>
<li>GPL-2</li>
<li>Apache-2</li>
</ul>
3. Both Fedora and Debian also use standard way to deal with the “and later” version options by using a “+”, eg
<ol> </ol>
<ul>
<li>GPL-2+ (debian)</li>
<li>GPLv2+ (Fedora)</li>
</ul>
4.    Suggested Solution for SPDX
<ol> </ol>
<ul>
<li>I believe we should have a standard way to handle versions for SPDX.  I would suggest going with the Debian approach or something similar.  This would entail slightly modifying the Fedora short names where they do not follow the standard</li>
<li>I’m not sure if there is some reason why Fedora hasn’t standardized this.</li>
</ul>
Handling of “standard” exceptions is different
<ol>
<li>Fedora just uses a term that is “with exceptions”  They don’t tell you which exceptions.  The result is that a short name “GPLv3 with exceptions”  is used for both the classpath and font exceptions.  This seems to create ambiguity.</li>
<li>Debian proposes naming the common exception – with the following syntax</li>
</ol>
<ul>
<li>GPL-2+ with classpath exception</li>
<li>GPL-2+ with font exception</li>
</ul>
3.    Suggested Solution for SPDX
<ol> </ol>
<ul>
<li>I believe we should use the Debian approach for common “approved” exceptions such as the 2 mentioned for GPL</li>
</ul>
Spaces in short name
<ol>
<li>Fedora has spaces in the short names</li>
<li>Debian does not  (they do have spaces when they do “with exceptions”</li>
</ol>
3.    Suggested Solution for SPDX
<ul>
<li>I would ask the technical people if this will be problematic having spaces when we want to automatically parse these files.  </li>
</ul>
 
Handling of multiple licenses
<ol>
<li>Both Fedora and Debian use “ands” and “ors” when there are multiple licenses associated with a pkg.  </li>
</ol>
<ul>
<li>“and” when you must comply with the terms of all the licenses because parts of the package or file are under difference  licenses
<ul>
<li>artistic-1 and gpl-2</li>
<li>“or” when you get to choose a license
<ul>
<li>artistic-1 or gpl-2</li>
</ul>
</li>
</ul>
</li>
</ul>
2. Both Fedora and Debian address the combining of ors and ands.
<ol> </ol>
<ul>
<li> 
<ul>
<li>Use parentheses when needed </li>
<li>(artistic-1 or gpl-2) and lgpl=1.1</li>
<li>“and” takes precedence</li>
<li>GPL-2+ with font exception
<ul>
</ul>
</li>
</ul>
</li>
</ul>
3.    Suggested Solution for SPDX
<ol> </ol>
<ul>
<li>Follow the same rules</li>
</ul>
 
 
Handling of license variations
<ol>
<li>There are several licenses that have “variations”.  MIT and BSD are examples of this.  These situations are handled differently by Fedora and Debian.</li>
<li>Fedora</li>
</ol>
<ul>
<li>For MIT, Fedora treats a bunch of the MIT variations as “functionally equivalent” and uses the short name “MIT” to refer to all of them.  They have a page listing all of the MIT variants and the actual text. <a href="https://fedoraproject.org/wiki/Licensing/MIT">https://fedoraproject.org/wiki/Licensing/MIT</a> </li>
<li>For BSD, Fedora seems to have different short names for each of the variants, eg
<ul>
<li>BSD License (original) = short name “BSD with advertising”</li>
<li>BSD License (no advertising) which is a 3 clause version and BSD License (two clause)  both = short name of “BSD”</li>
<li>BSD Protection License = short name of “BSD Protection”</li>
<li>Academy of Motion Picture Arts and Sciences BSD = “AMPAS BSD”</li>
</ul>
</li>
</ul>
3. Debian
<ol> </ol>
<ul>
<li>For MIT, Debian says that it is “problematic”  and hasn’t addressed it .  They have no short name for MIT yet.</li>
<li>For BSD, Debian has a short name for BSD, but it’s unclear how the variants are handled</li>
</ul>
4.    Suggested Solution for SPDX
<ol> </ol>
<ul>
<li>This one is a little complicated.  I think for any situation where we have different variants of a license, they should have different short names.  Fedora has done this to some extent, but in some cases (like BSD 2 and 3-clause) they have combined it to use one short name.   This would require us to stray from the short names of Fedora.</li>
<li>The other question is what do you do with “other” variants that don’t have a unique short name.  Some people use “BSD-like” or terms such as that.  I know some people don’t like that.   It seems that for now the most accurate approach would be either to give a variant it’s own short name, or tag it as an “Other” license.</li>
</ul>

SPDX Wiki - User contributions [en]

Technical Team/Old/Sandbox for Sharing Examples/How to Handle Licenses in SPDX