On Tue, Oct 22, 2013 at 6:01 PM, Gisi, Mark <mark.g...@windriver.com> wrote: > In the last SPDX Legal meeting we discussed whether the current SPDX license > representation syntax is sufficient to represent the licensing terms of most > files (e.g., source, library and binary programs). For example, is the > combination of the SPDX license list + current binary operands (AND and OR) > sufficient to describe the licensing of most programs derived from multiple > source and library files, where each is potentially under a different > license.
Let me bring my 2 cents to the discussion. A while back I wrote down this little language to compose licenses. The point was to : - make this easy enough for humans and machines to read, write and understand. - have a terse yet expressive way to represent actual licensing in one statement, eventually expressing the complex licenses composition of whole packages. - support factual licenses statements as well as interpretations such as selection from a choice, the fact that some license may apply that were not asserted originally, etc. PS: For most of it there is nothing new there, SPDX does it alright. PPS: Some of this may not mesh entirely well with the current SPDX licenses list state (such as expressing "or later versions" generically or how we deal with exceptions). Here are the basic examples updated to SPDX: * lgpl-2.0 : a single license applies. * apache-2.0 lgpl-2.0 : All the licenses listed apply, space-separated list. (AND is implied as the default operator, CONJUNCTION) * mit & lgpl-2.0 : All licenses listed apply, ampersand-separated list. (explicit AND, CONJUNCTION) * mit | gpl-2.0 : a license choice: either one of the licenses can apply, the choice does not have to be made and can be passed downstream. (CHOICE, OR) * mit ? gpl-2.0 : a disjunctive license choice of mit or gpl-2.0. A choice must be made. (CHOICE, EXCLUSIVE OR, DISJUNCTION) * gpl-2.0 ^ classpath : a license exception or supplemental terms: here, the classpath exception to the gpl-2.0. nb: here we have a slight change with the SPDX license list, where the exception would be just the exception and not the whole gpl-and-classpath taken together as one license.(EXTRA TERMS, EXCEPTION) * gpl-1.0 + : this license version or a later version applies: i.e. gpl-1.0 or later. nb: here the plus sign is not part of the license id, but part of the syntax which is also different from SPDX (OR LATER version) * (apache-1.1 mit gpl-2.0) : a grouping of licenses. This is useful for explicit grouping in complex statements, rather than relying only on eventual operators precedence (GROUP) * ftl [ftl ? gpl-2.0]: a license selection expressed with brackets: here I picked ftl from the disjunctive choice of ftl or gpl. (SELECTION using brackets) * apache-2.0 {mit bsd-3-clause lgpl-3.0} : I think that the primary license is overall apache-2.0 and that other secondary license apply. This is handy to express composite licenses at a package level. (PRIMARY and SECONDARY using braces) * gpl-2.0 < mit: I think that the license that applies here is gpl-2.0, despite being asserted originally as MIT-licensed (possibly because of linking, dependencies, code reuse or else). (INTERPRETATION, INTERACTION) * gpl-2.0 ! commercial : I think that the gpl applies and that the commercial the license id CANNOT apply. Negations are usually aberrations with conflicting terms but I see vendors releasing dual GPL/proprietary making this type of interpretation in supplemental terms often enough. Some proprietary licenses state the opposite explicitly too: this is commercial and cannot be gpl. This rarely of a practical use but may be needed for completeness (NOT, NEGATION) And more complex examples: * apache-1.1 ( mit | gpl-2.0) : apache AND mit or gpl using a grouping of licenses choice. * mpl-1.1 [gpl-2.0 | lgpl-2.1 | mpl-1.1 ]: I picked mpl-1.1 from the choice of mpl, lgpl or gpl. * gpl-2.0 < (mpl-1.1 [gpl-2.0 ? lgpl-2.1 ? mpl-1.1 ]): I think gpl-2.0 applies here despite a selection of mpl-1.1 from a disjunctive choice. * apache 1.1 & bsd-3-clause & (openssl ^ gpl-exception) : apache AND bsd AND (openssl with a gpl-exception taken together) apply. * gpl-2.0 [gpl-2.0 ^ gpl-2.0-with-classpath-exception | cddl-1.0] : I picked gpl-2.0 from a choice of gpl with classpath exception or cddl. * proprietary & {mit bsd-3-clause apache-2.0 gpl-2.0-with-bison-exception}: My primary license is proprietary with MIT, BSD, GPL with bison exception and Apache-licensed code as secondary * lgpl-2.0 [lgpl +] : I picked the v2 of the lgpl out of a choice of any LGPL versions. * gpl-2.0 < (gpl-2.0 | mpl-1.1): I think that the license that applies here is only gpl-2.0, despite being asserted originally as choice of gpl or mpl may be because this code is running in kernel space. I hope this helps fueling the discussion. Cheers -- Philippe Ombredanne +1 650 799 0949 | pombreda...@nexb.com DejaCode Enterprise at http://www.dejacode.com | What's in your software? (sm) nexB Inc. at http://www.nexb.com _______________________________________________ Spdx-legal mailing list Spdx-legal@lists.spdx.org https://lists.spdx.org/mailman/listinfo/spdx-legal