On Mon, Sep 25, 2023 at 7:28 AM Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay) <[email protected]> wrote:
> Hi Gary, > > > > Yes, I would support having a warning when the “+” operator follows an ID > ending in a “-or-later”, or “-only”. > > > > But many other licenses have no meaning when followed by “+”. > > For example, “MIT+” makes no sense. > I think it makes sense on some level -- it would correctly represent, on a "just the facts" principle, a license grant like "You are permitted to copy, modify and redistribute this code under the terms of the MIT license or any later version". It doesn't make further sense because there happens to be no license steward of the MIT license with the recognized authority to promulgate later versions, but I'm not sure that sort of social fact should be built in to SPDX. Not entirely unrelatedly, an issue has come up in Fedora involving recognition of the `+` operator in connection with MPL-2.0 (IIRC, there is a Rust crate that uses "MPL-2.0 or any later version"). MPL-2.0 contains an internal permission to use later versions (see sec. 10.2) so it could be argued that `MPL-2.0+` is inappropriate because of redundancy. - Richard > > > *De : *[email protected] <[email protected]> de la part de Gary > O'Neall via lists.spdx.org <[email protected]> > *Date : *mardi, 19 septembre 2023 à 09:12 > *À : *[email protected] <[email protected]> > *Objet : *Re: [spdx] Catching Up on License IDs Ending in "+" > > > > *CAUTION:* This is an external email. Please be very careful when > clicking links or opening attachments. See the URL nok.it/ext for > additional information. > > > > Hi Kyle, > > > > The “+” operator is still supported in the license expression syntax. > > > The “GPL-2.0+” license ID was introduced before the “+” and all ID’s that > end in “+” are now deprecated. > > > > Per the request of the license stewards, we introduced ID’s ending in > “-or-later” and “-only”. > > > > Per the syntax spec, adding the “+” operator after any of these licenses > are allowed, but as you mentioned they do not make much sense semantically. > > > > In the license expression parsers I maintain, I do not issue a warning > when the “+” operator follows an ID ending in a “-or-later”, or “-only”. > Since all the ID’s ending in “+” are deprecated, I issue warnings that a > deprecated license ID is used. > > > > I’m open to feedback from the rest of the community if we should issue a > validation warning when a “+” follows the ID’s ending in “-or-later” or > “-only”. > > > > Gary > > > > *From:* [email protected] <[email protected]> *On Behalf Of *Kyle > Mitchell > *Sent:* Tuesday, September 19, 2023 3:26 AM > *To:* [email protected] > *Subject:* [spdx] Catching Up on License IDs Ending in "+" > > > > I maintain a few packages packaging and implementing bits of SPDX, > especially the license list and expression syntax, for the JavaScript npm > package system. I'm seeing some changes in recent > https://spdx.org/licenses/licenses.json and would like to make sure I > understand them before updating packages or automation to update them. > > > > Do I correctly understand that "+" now appears at the end of some listed > license IDs *only *to express that some expressions using the "+" > operator, like GPL-2.0+, are now deprecated in favor of "-or-later" IDs, > like GPL-2.0-or-later? In other words, SPDX does *not* plan to add more > licenses with identifiers ending in "+" going forward? > > > > I see that the "+" suffix remains valid in the simple-expression > production rule of the expression syntax grammar. But I take it "GPL-2.0++" > should *not* be considered a valid license expression. > > > > Many thanks for any helping hand. > > > > -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#1770): https://lists.spdx.org/g/spdx/message/1770 Mute This Topic: https://lists.spdx.org/mt/101448004/21656 Group Owner: [email protected] Unsubscribe: https://lists.spdx.org/g/spdx/leave/2655439/21656/1698928721/xyzzy [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
