As Jilayne wrote, the “+” operator in license expressions was intended for licenses that have this option.
You should treat expressions like “MIT+” as syntactically correct (as they have a valid short identifier and the “+” operator) but semantically meaningless, as the MIT license does not provide for an “or any later version” clause. I suppose that a similar example in the Unicode domain you brought up would be characters like the [U+0301 COMBINING ACUTE ACCENT]. We all know that combining “e” with this character should result in “é”, but what about combining “b” with it? Or, even worse, “π”? As the standard says: “All combining characters can be applied to any base character and can, in principle, be used with any script. As with other characters, the allocation of a combining character to one block or another identifies only its primary usage; it is not intended to define or limit the range of characters to which it may be applied. In the Unicode Standard, all sequences of character codes are permitted.” [emphasis in the original] The same way that in Unicode the sequence of [U+03C0 GREEK SMALL LETTER PI] and [U+0301 COMBINING ACUTE ACCENT] is permitted (syntactically valid) but meaningless (semantically invalid), in SPDX license expression grammar you can have “MIT+”. In general, I don’t think that is part of the SPDX spec mandate to determine the legal validity (semantic meaning) of license expressions. If you’re start disallowing “MIT+”, where will you stop? Is “GPL-2.0-only AND GPL-3.0-only” a semantically meaningful expression? Other combinations definitely fall into the realm of legal interpretations. BTW, following to your Unicode example, Unicode since 2008 does include the character for uppercase Eszett (which is U+1E9E ẞ) and the current standard already specifies that it can be used as upper case of the lowercase Eszett (The Unicode Standard v12.0, p. 912). Finally, if your last question was about the definition of the “+” operator, the current SPDX Specification (v2.1) clearly states in “Appendix IV: SPDX License Expressions” that a simple expression may be: “An SPDX License List Short Form Identifier with a unary"+" operator suffix to represent the current version of the license or any later version.” If your question was specifically about the equivalence of “GPL-2.0+” and “GPL-2.0-or-later”, this is not stated explicitly anywhere, since it is implied by the definition of the operator. -- zvr From: [email protected] <[email protected]> On Behalf Of Vladimir Sitnikov Sent: Friday, 21 June, 2019 14:05 To: J Lovejoy <[email protected]> Cc: [email protected] Subject: Re: [spdx-tech] "Or later" operator is not well defined J Lovejoy>The + operator to indicate "or any later version" was only intended to be used with licenses that allow this option. There is no "test" or "validation" to reject an improper use of the + operator What I'm saying is when standard declares an operation (e.g. "or later"), then it should describe its inputs, and outputs. Currently SPDX declares "or later" operation, however it NEVER specifies how that operation really works. Note: the standard pretends to be machine-readable, so the rules should be machine-readable as well. J Lovejoy>We have not choice but to take and record the licenses as we find them - with or J Lovejoy>without version numbering (and sometimes with version numbering that is not necessarily sequential.) The same thing: SPDX standard reads "or any later version", however it does NOT specify what that means. That is very very weak standard. As I said, there's a prior art in the similar field: Unicode (see https://en.wikipedia.org/wiki/Unicode ) It goes over the characters/scripts and tries to make a standard representation, and it makes operations like case folding and collation standard as well. For example, Unicode standard declares various ways to do "case mapping". https://unicode.org/faq/casemap_charprop.html Let me pick an example: German alphabet has letter ß which is typically converted to SS when upper-cased. Unicode does specify that "uppercase of ß is SS", so every developer gets that "for free" when using unicode-compliant libraries/languages. Of course human languages are evolving, and it might be that at some point in future there will be a dedicated letter for "capital ß" in German. Then it would be just included into an updated Unicode standard with the appropriate casing/comparison rules. Well, that was regarding Unicode. Why am I describing all of that? As for me, SPDX for licenses looks pretty much like Unicode for characters. Both domains have lots of exceptions, and both domains need some sort of machine processing. That is why I expect SPDX to properly declare the meaning behind "or later". Possible options are: 1) Explicitly disable certain uses of "or later". For instance, SPDX 4.0 might explicitly disable "MIT+" and specify that that expression is invalid. 2) Explicitly specify which licenses are equivalent. For instance, SPDX 4.0 might explicitly describe that "GPL-2.0-or-later" is equivalent to "GPL-2.0-only+". 3) Explicitly specify that license A is considered to be "a later version of" license B. For instance, SPDX 4.0 might explicitly describe that "Apache 2.0 is a later version of Apache 1.1" 4) Split licenseid to licensefamily and version fields. Then "or later" operation would mean "all licenses with same licensefamily and greater or equal version". If that approach is taken, it would require to specify the collation rules for versions. 5) Other suggestions I really see no way of proceeding with current "SPDX declares <<or later>> in the standard, however it misses to define what that means" J Lovejoy>GPL-2.0-or-later would be the current SPDX identifier; GPL-2.0+ would be the old SPDX identifier (from SPDX License List pre-3.0 versions) - J Lovejoy>either way, it means the same thing. Can you pin-point the part of SPDX that declares that "GPL-2.0+ means the same thing as GPL-2.0-or-later"? Spoiler: there's no such statement in the SPDX standard. Vladimir Intel Deutschland GmbH Registered Address: Am Campeon 10-12, 85579 Neubiberg, Germany Tel: +49 89 99 8853-0, www.intel.de Managing Directors: Christin Eisenschmid, Gary Kershaw Chairperson of the Supervisory Board: Nicole Lau Registered Office: Munich Commercial Register: Amtsgericht Muenchen HRB 186928 -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#3721): https://lists.spdx.org/g/Spdx-tech/message/3721 Mute This Topic: https://lists.spdx.org/mt/32049933/21656 Group Owner: [email protected] Unsubscribe: https://lists.spdx.org/g/Spdx-tech/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
