Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

make it explicit that a license exception, alone, cannot be a valid license expression #873

Closed
alpianon opened this issue Jan 9, 2024 · 6 comments
Labels
profile: licensing Licensing Profile and related matters

Comments

@alpianon
Copy link

alpianon commented Jan 9, 2024

see fsfe/reuse-tool#890 and and spdx/Spdx-Java-Library#227

TL;DR: Qt-GPL-exception-1.0 (or any other "standalone" license exception) is not a valid license expression that can be put in LicenseInfoInFile.

That is implied by what is written in Annex D.1, but it would be better to make it more explicit, to avoid issues like the ones mentioned above

@pmonks
Copy link

pmonks commented Jan 12, 2024

The ABNF grammar in Annex D.1 makes this explicit, and I've always understood the sentence "The exact syntax of license expressions is described below in ABNF." to mean that that grammar is normative.

@alpianon
Copy link
Author

The ABNF grammar in Annex D.1 makes this explicit, and I've always understood the sentence "The exact syntax of license expressions is described below in ABNF." to mean that that grammar is normative.

What about adding something like "For the sake of clarity, a license exception in isolation is not a valid license expression"?

I'm pretty sure there are other tools out there (eg. Fossology) that incur in the same mistake, so make it clearer would do no harm and may help avoiding such mistake

@pmonks
Copy link

pmonks commented Jan 12, 2024

It seems to me that the logical conclusion of that argument would be that the entire ABNF grammar needs to be duplicated and translated to plain English, which I'd argue is inappropriate in a technical specification like the SPDX spec. ABNF is a good choice for describing this kind of thing precisely and succinctly.

@goneall
Copy link
Member

goneall commented Apr 4, 2024

Agree with @pmonks - ABNF should be the "source of truth" for the license expression.

@kestewart - thoughts?

@swinslow
Copy link
Member

swinslow commented Jun 6, 2024

I tend to agree with @pmonks here. I think that between the ABNF, the rest of the annex, and the definitions in the model, it's pretty clear for purposes of the spec that a license exception cannot by itself be a license expression.

For what's currently in the spec, there's at least the following (emphasis added):

  • the formal definition in the ABNF grammar
  • In the License Expression Syntax annex: "A license expression could be a single license identifier found on the SPDX License List; a user defined license reference denoted by the LicenseRef-[idString]; a license identifier combined with an SPDX exception; or some combination of license identifiers, license references and exceptions constructed using a small set of defined operators (e.g., AND, OR, WITH and +)."
  • In the class definition for LicenseAddition: "A LicenseAddition represents text which is intended to be added to a License as additional text, but which is not itself intended to be a standalone License."

All that said: We've been discussing that there should likely be other documentation, not part of the spec itself but published elsewhere by SPDX, to assist users to better understand the spec. I could see something like this being worth raising in e.g. an FAQ.

@swinslow swinslow added the profile: licensing Licensing Profile and related matters label Jun 6, 2024
@goneall
Copy link
Member

goneall commented Aug 11, 2024

Based on the above comments, I'm closing this as resolved. If you disagree, please open a new issue with the reasoning and reference this issue.

@goneall goneall closed this as completed Aug 11, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
profile: licensing Licensing Profile and related matters
Projects
None yet
Development

No branches or pull requests

4 participants