licenses: allow mix of multiple SPDX expressions AND/OR multiple named/spdx licenses #454

jkowalleck · 2024-04-29T06:39:20Z

current situation (CDX 1.6):

it is allowed to have EITHER one spdx license expression OR multiple named/spdx licenses. see spec
each license(expression/named/spdx) can have a acknowledgement - none or "declared" or "concluded". see spec

problem

the current situation does not allow the following:

situation A: multiple declared licenses ids (like in python license trove-classifiers) and one concluded expression
- Declared spdx license id "MIT" - as set in the project manifest
- Declared spdx license id "PostgreSQL" - as set in the project manifest
- Declared named license "Apache Software License" - as set in the project manifest
- License evidence from the README file: "chose the license that applies best to you: PostgreSql or MIT or Apache2"
- Concluded spdx license expression license "(MIT OR PostgreSQL OR Apache-2.0)" - (this is just an example for spec reasons, this is not a real-world law case!)
situation B: declared expression and concluded expression
- Delcared spdx expression "MIT OR (GPL-3.0 OR GPL-2.0)"
- Concluded spdx expression "(GPL-3.0-only AND LGPL-2.0-only)" - after some lawyer checked for actual applied situation - (this is just an example for spec reasons, this is not a real-world law case!)
situation C: declared expression and concluded spdx id
- Declared spdx expression "GPL-3.0-or-later OR GPL-2.0"
- Concluded spdx id " GPL-3.0-only" - after some lawyer checked for actual applied situation - (this is just an example for spec reasons, this is not a real-world law case!)

request

allow the following:

multiple SPDX expressions at the same time
allow mix of SPDX expression and other licenses at the same time

possible results

{ 
"bomFormat": "CycloneDX",
"specVersion": "1.x",
// ...
"components": [
 
{
 // ... component properties ...
 "licenses": [
    // situation A -- (this is just an example for spec reasons, this is not a real-world law case!)
    { "license": { 
      "id": "MIT", 
      "acknowledgement": "declared" } },
    { "license": { 
      "id": "PostgreSQL", 
      "acknowledgement": "declared" } },
    { "license": { 
      "name": "Apache Software License", 
      "acknowledgement": "declared" } },
    { "expression": "(MIT OR PostgreSQL OR Apache-2.0)",
      "acknowledgement": "concluded" }
  ]
},

{
 // ... component properties ...
 "licenses": [
    // situation B -- (this is just an example for spec reasons, this is not a real-world law case!)
    { "expression": "MIT OR (GPL-3.0 OR GPL-2.0)", 
      "acknowledgement": "declared" },
    { "expression": "(GPL-2.0-only AND LGPL-2.0-only)",
      "acknowledgement": "concluded" }
  ]
},

{
 // ... component properties ...
 "licenses": [
    // situation C -- (this is just an example for spec reasons, this is not a real-world law case!)
    { "expression": "GPL-3.0+ OR GPL-2.0", 
      "acknowledgement": "declared" },
    { "license": { 
      "id": " GPL-3.0-only", 
      "acknowledgement": "concluded" } }
  ]
},

{
 // ... component properties ...
 "licenses": [
   // example with concluded LicenseRef -- (this is just an example for spec reasons, this is not a real-world law case!)
    { "license": { 
      "id": "MIT", 
      "acknowledgement": "declared" } },
    { "license": { 
      "name": "Amazon Software License", 
      "acknowledgement": "declared" } },
    { "expression": "MIT AND LicenseRef-.amazon.com.-AmznSL-1.0",
      "acknowledgement": "concluded" }
  ]
},


]
}

jkowalleck · 2024-11-08T16:46:36Z

related: CycloneDX/cyclonedx-python#826

villaflaminio · 2024-11-08T16:57:48Z

I agree with the problem, especially case C.
I would like to be able to have a lawyer or some automatic mechanism review the product sbom so that I can identify which licence to "refer" to for each individual component based on my use case.
It is more than reasonable to have two licenses defined for a product, e.g. if the component is used in open source projects then the license is type A, otherwise if it is used for commercial purposes then the license is type B.
This is just an example.
And, of course, in the report I would like to avoid replacing the license expression declared by whoever produced the component in question.
One solution might be to allow to have one license expression and only one license by specifying ‘acknowledgement concluded’, but I don't know whether this would create problems elsewhere.

jkowalleck · 2024-12-14T11:35:38Z

I will be working on a solution for this, planned for CycloneDX 1.7.
All comments, discussions, and any help is welcome.

Joerki · 2024-12-19T08:02:03Z

The example should also mention "LicenseRef-" items to clearly state that such simple expressions are also SPDX expression by definition of SPDX, not only compound expressions.

Situation B:
After discussing the topic "concluded" license with our OSCO (Open Source Compliance Officer) my understanding is that a concluded license must not contain a compound statement with "OR". A decision must be taken.
The example would be the same as "MIT OR GPL-3.0-only OR GPL-2.0-only"
Based on current existing licenses it is compatible with "MIT OR GPL-2.0-or-later" or "MIT OR GPL-2.0+"

Concluded license possiblities:

MIT (MIT)
GPL-2.0 (GPL-2.0-only)
GPL-3.0 (GPL-3.0-only)

Situation C:
"GPL-2.0+" cannot by used as concluded license based on the legal information I have (see also link below). It has an implicit "OR". As a consumer I have the choice to select between GPL-2.0 or a higher version (GPL-3.0) and I have to make a choice in my context. The GPL licenses are not fully compatible, so it is a legal requirement to select what applies for me as concluded license.

Clear statement here (Standard License Header):
https://spdx.org/licenses/GPL-2.0-or-later.html

Another significant reference:
BSI-TR-03183-2 Version 2.0.0 (10.10.2024)
Federal Office for Information Security (BSI)
https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TR03183/BSI-TR-03183-2-2_0_0.html
Chapter 6.1 (License identifiers and expressions)
They refer to SPDX annexes about usage, they also recommend to use the Scancode LicenseDB Aboutcode!

jkowalleck · 2024-12-19T10:22:01Z

re: #454 (comment)

Thanks for pointing that out.
I tried to incorporate your remarks in the description, and also added a section "expected results" to showcase the results.
Could you check whether all your use cases are represented, @Joerki ?

Anyway, the examples exist for showcasing needed options(requirements). As stated

(this is just an example for spec reasons, this is not a real-world law case!)

jkowalleck · 2025-01-20T15:13:55Z

"GPL-2.0+" cannot by used as concluded license based on the legal information I have (see also link below). It has an implicit "OR". As a consumer I have the choice to select between GPL-2.0 or a higher version (GPL-3.0) and I have to make a choice in my context. The GPL licenses are not fully compatible, so it is a legal requirement to select what applies for me as concluded license.

this might be true for OBOM and alike, but not for SBOM.
lets say i am pulling a library from the internet, and i have a lawyer analyzing the license posture, and they conclude "I've analyzed the license's README and other evidences, and i conclude the license to be free to chose from A or B ... -- which one is applied can be decided only after the lib was integrated into a system."

jkowalleck · 2025-01-20T16:04:15Z

please review the proposed implementation changes to enable the features outlined in this very ticket:
#582

pombredanne · 2025-02-10T14:37:09Z

@jkowalleck Since you are tackling licensing, I would suggest considering these:

Deprecate entirely "single SPDX license IDs, and named licenses" and only use license expressions in the future (dropping entirely "single SPDX license IDs, and named licenses" in 1.8 or 1.9. The support of "A list of SPDX licenses and/or named licenses and/or SPDX License Expression." is confusing IMHO. Expressions are enough, especially if combined with 2. and 3. Names and ids are mostly unusable for any kind of automation.
Add explicit support for scancode LicenseRef (they are recommended in Germany and India) and local LicenseRef as per @Joerki
Add support for tracking the actual license text and notices which is missing today and needed for local LicenseRef
Also adopt expressions for the various spec artifacts like this

specification/schema/bom-1.7.schema.json

Line 6 in 3f3873e

"$comment" : "CycloneDX JSON schema is published under the terms of the Apache License 2.0.",

pombredanne · 2025-02-10T14:44:16Z

@Joerki re: #454 (comment)

I have to make a choice in my context. The GPL licenses are not fully compatible, so it is a legal requirement to select what applies for me as concluded license.

Actually the mileage may vary. Some lawyers may prefer to convey the choice, some may prefer to pick one. So I am not sure there is any legal requirement to select a license, except in a few rare case.

One such case is with FreeType https://gitlab.freedesktop.org/freetype/freetype/-/blob/b1f47850878d232eea372ab167e760ccac4c4e32/LICENSE.TXT#L9 ...

This means that you must choose one of the two licenses described
below, then obey all its terms and conditions when using FreeType 2 in
any of your projects or products.

.... but this is a really rare case. Most exceptions allow to keep or drop the exception, and many licensing that allow future versions may not even give you the choice to drop future version (like the Eclipse license).

jkowalleck · 2025-02-10T14:59:34Z

re: #454 (comment)

A friendly reminder: do not mix multiple scopes in one ticket. Deprecating one structure, and enhancing another are two different scopes, and should be handled in separate tickets and separate pull requests.

re topic 1

Deprecate entirely "single SPDX license IDs, and named licenses" and only use license expressions in the future (dropping entirely "single SPDX license IDs, and named licenses" in 1.8 or 1.9. The support of "A list of SPDX licenses and/or named licenses and/or SPDX License Expression." is confusing IMHO. Expressions are enough, especially if combined with 2. and 3. Names and ids are mostly unusable for any kind of automation.

This is not in the scope of this very ticket. I do not intend to switch scopes of this ticket.
I am planning to bring a "fix"/"feature" to CycloneDX that helps users ASAP. I do not intend to drive a years-long discussion about alternatives and such.

Anybody interested in pursuing the goal of deprecating current license structures, while enhancing others is free to do so - I have no problem with that. It all starts with creating a ticket for that and championing/driving the topic. Go ahead. :-)

re topic 2

Add explicit support for scancode LicenseRef

license-refs are anything the SPDX ID is not assigned, right?
this is what named licenses are for.

re topic 3

Add support for tracking the actual license text and notices which is missing today and needed for local LicenseRef

when used in an SPDX expression: this is #554 what is about.
Otherwise: this is what named licenses are for - they have an attachment already

re topic 4:

completely different topic.

PS: feel free to open separate tickets for all the things you mentioned. I will not work on them in this very ticket due to ticket scope.

Joerki · 2025-02-10T17:29:01Z

Add explicit support for scancode LicenseRef

license-refs are anything the SPDX ID is not assigned, right? this is what named licenses are for.

This is confusing for me. The "name" (also considering the example in the CycloneDX definition) is a human readable title (-> see SPDX). I could print it together with the license text in an attribution report for a customer.

jkowalleck added the proposed core enhancement label Apr 29, 2024

jkowalleck added this to the 1.7 milestone May 24, 2024

jkowalleck self-assigned this May 24, 2024

jkowalleck mentioned this issue May 24, 2024

Misalignment in Protobuf Specification with Updated XML and JSON Schemas for LicenseChoice #465

Closed

jkowalleck mentioned this issue Nov 8, 2024

Help with LicenseExpressionAlongWithOthersException CycloneDX/cyclonedx-python#826

Closed

This was referenced Dec 14, 2024

License validity check incompatible with CycloneDX 1.4 CycloneDX/cyclonedx-python-lib#747

Closed

Add clarification on what a list of licenses means #349

Open

jkowalleck changed the title ~~licenses: allow mix of multiple SPDX expressions AND multiple named/spdx licenses~~ licenses: allow mix of multiple SPDX expressions AND/OR multiple named/spdx licenses Jan 20, 2025

jkowalleck linked a pull request Jan 20, 2025 that will close this issue

feat: support multi license mix #582

Open

8 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

licenses: allow mix of multiple SPDX expressions AND/OR multiple named/spdx licenses #454

licenses: allow mix of multiple SPDX expressions AND/OR multiple named/spdx licenses #454

jkowalleck commented Apr 29, 2024 •

edited

Loading

jkowalleck commented Nov 8, 2024

villaflaminio commented Nov 8, 2024 •

edited

Loading

jkowalleck commented Dec 14, 2024

Joerki commented Dec 19, 2024

jkowalleck commented Dec 19, 2024

jkowalleck commented Jan 20, 2025

jkowalleck commented Jan 20, 2025 •

edited

Loading

pombredanne commented Feb 10, 2025

pombredanne commented Feb 10, 2025

jkowalleck commented Feb 10, 2025 •

edited

Loading

Joerki commented Feb 10, 2025

licenses: allow mix of multiple SPDX expressions AND/OR multiple named/spdx licenses #454

licenses: allow mix of multiple SPDX expressions AND/OR multiple named/spdx licenses #454

Comments

jkowalleck commented Apr 29, 2024 • edited Loading

current situation (CDX 1.6):

problem

request

possible results

jkowalleck commented Nov 8, 2024

villaflaminio commented Nov 8, 2024 • edited Loading

jkowalleck commented Dec 14, 2024

Joerki commented Dec 19, 2024

jkowalleck commented Dec 19, 2024

jkowalleck commented Jan 20, 2025

jkowalleck commented Jan 20, 2025 • edited Loading

pombredanne commented Feb 10, 2025

pombredanne commented Feb 10, 2025

jkowalleck commented Feb 10, 2025 • edited Loading

re topic 1

re topic 2

re topic 3

re topic 4:

Joerki commented Feb 10, 2025

jkowalleck commented Apr 29, 2024 •

edited

Loading

villaflaminio commented Nov 8, 2024 •

edited

Loading

jkowalleck commented Jan 20, 2025 •

edited

Loading

jkowalleck commented Feb 10, 2025 •

edited

Loading