SPDX dual-license inconsistency

[diwic]

According to the current SPDX spec, dual-licensing should be done as: (Apache-2.0 OR MIT) (and there's also AND, + and WITH), but our manifest format says one should simply separate licences with / without being 100% clear on whether that means an "AND" or "OR".

This just seems to be an unnecessary inconsistency with the SPDX spec. Can we change the doc to encourage dual-licensing using the (x OR y) syntax instead?

[alexcrichton]

I'd prefer to just remove that clause about multiple licenses. I'm already a little uncomfortable referencing a somewhat-obscure spec and sidestepping the problem altogether would be nice.

[diwic]

To add additional motivation I went to a talk yesterday about fossology and my takeaway from that was, that what you should do as a good citizen is basically to conform to a SPDX tag, to make the license scanners happy. The person I talked to also recommended sprinkling the top of every source file with them, like this:

/*
 * (C) Copyright 2015 Some One <someone@example.com>
 * SPDX-License-Identifier:     GPL-2.0+
 */

[codyps]

I'm also in favor of following SPDX more closely. / doesn't seem necessary.

[bluss]

Rust itself is dual licensed, and this encourages MIT/Apache-2.0 in the ecosystem, so it's not a fringe use case.

[edef1c]

@alexcrichton SPDX isn't exactly "obscure" — it's the Linux Foundation sponsored spec for licensing information, and npm uses it for one (there are probably a bunch of others)
It took a bunch of work to convert the npm ecosystem to SPDX (not done yet, by far), and this is something specifically requested after node started seeing wider commercial adoption.
If we want to make it easy to adopt Rust for companies with any kind of sensible IP auditing policy, "just put whatever the fuck you want in the license field and have a human guess" isn't really helpful.

[SimonSapin]

I’m in favor of warning for / on new crates.io uploads for a while, and later rejecting such uploads. All with a link to an explanation.

Rust’s own license is an OR, right?

[hobofan]

@SimonSapin I think before we can really push for widespread adoption of SPDX in the Rust ecosystem there should be a fully featured SPDX license parser in Rust. The one used for crates.io is missing support for parens.

[posborne]

I too would like to see a push toward following SPDX more closely and additional tooling related to licensing (although that may not be a cargo concern directly).

In my case, I am working on embedded systems where we actually distribute devices with code to users. For cases like this (as opposed to just operating a service accessed via the web), it is important that we be able to correctly report the license information for all packages requiring that we do so. SPDX provides a standard for reporting this information and I think it makes sense to follow it.

In addition...

# If a project is using a nonstandard license, then this key may be specified in
# lieu of the above key and must point to a file relative to this manifest
# (similar to the readme key).
license-file = "..."

I think user's should be encouraged to include a pointer to the license file even in cases where the license is standard (of course in addition to the license field). If you look at the MIT license, for instance, note the text that in addition to the license notice itself that the copyright notice be included. The copyright notice can probably only be included if the actual license file is included.

[joshtriplett]

I'd like to see this improved as well, so that a standard SPDX parser can process the entire license field, rather than having to split it on '/' first and treat that as OR.

[codyps]

I was looking into code for this a few weeks back. It seems like we could transition to this the same way the transition to forbidding "*" versions on crates.io worked:

• add a warning to cargo
• queue up a patch to crates.io that emits an error (cargo didn't do license verification when I was looking, crates.io does all of it. crates.io also didn't have a mechanism to return warnings when I was looking)
• after a grace period, merge error patch to crates.io to forbid new crates with "/" splitting (only allow standard SPDX).