Hi Vladimir,
See https://wiki.spdx.org/view/Legal_Team/or-later-vs-unclear-disambiguation and https://wiki.spdx.org/view/Legal_Team/Minutes/2017-11-09 for the legal team background on this. Very brief summary/background: FSF requested we make changes to how we treat the GPL license identifiers after we created the “+” operator. In satisfying the requests, we had to compromise clarity for compatibility and meeting FSF’s request. The unary operator is still a valid syntax, although the semantics in some situations (like GPL-2.0-only+) may need more specification. With this as the background, feel free to one or more issues related to improving the clarity against the spec at https://github.com/spdx/spdx-spec/issues Gary From: [email protected] <[email protected]> On Behalf Of Vladimir Sitnikov Sent: Thursday, June 13, 2019 12:41 AM To: [email protected] Subject: [spdx-tech] "Or later" operator is not well defined Hi, I tried to implement SPDX License Expression, and it turns out "or later" operator semantics is not defined. Here are some quotes from SPDX 2.1 > SPDX 2.1 A single license is represented by using the short identifier from > SPDX license list, optionally with a unary "+" operator following it to > indicate "or later" versions may be applicable. >An SPDX License List Short Form Identifier with a unary"+" operator suffix to >represent the current version of the license or any later version. For >example: GPL-2.0+ 1) GPL-2.0 is deprecated (even though it is extensively used in the doc which is sad). There are GPL-2.0-only and GPL-2.0-or-later Then there's a question: is GPL-2.0-only+ valid syntax? Is GPL-2.0-only+ the same as GPL-2.0-or-later? How can one tell that those two expressions are the same? Is GPL-2.0-or-later+ valid expression? What does it mean? Does GPL-2.0-or-later include GPL-3.0-or-later 2) Does Apache-1.0+ include Apache-2.0? So far I cannot tell where "version" of the license is represented in the spec. There's just a "short form identifier", and there's no relation between Apache-1.0 and Apache-2.0. Is that intentional that SPDX omits metadata on "license" and "version"? 3) There are licenses like MPL-1.0 (or CC-BY-*) that specifically enable users to apply never versions of the license as they appear. Does MPL-1.0+ differ from MPL-1.0? Vladimir Sitnikov -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#3708): https://lists.spdx.org/g/Spdx-tech/message/3708 Mute This Topic: https://lists.spdx.org/mt/32049933/21656 Group Owner: [email protected] Unsubscribe: https://lists.spdx.org/g/Spdx-tech/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
