licenses: allow mix of multiple SPDX expressions AND/OR multiple named/spdx licenses #454
Description
current situation (CDX 1.6):
- it is allowed to have EITHER one spdx license expression OR multiple named/spdx licenses. see spec
- each license(expression/named/spdx) can have a acknowledgement - none or "declared" or "concluded". see spec
problem
the current situation does not allow the following:
- situation A: multiple declared licenses ids (like in python license trove-classifiers) and one concluded expression
- Declared spdx license id "MIT" - as set in the project manifest
- Declared spdx license id "PostgreSQL" - as set in the project manifest
- Declared named license "Apache Software License" - as set in the project manifest
- License evidence from the README file: "chose the license that applies best to you: PostgreSql or MIT or Apache2"
- Concluded spdx license expression license "(MIT OR PostgreSQL OR Apache-2.0)" - (this is just an example for spec reasons, this is not a real-world law case!)
- situation B: declared expression and concluded expression
- Delcared spdx expression "MIT OR (GPL-3.0 OR GPL-2.0)"
- Concluded spdx expression "(GPL-3.0-only AND LGPL-2.0-only)" - after some lawyer checked for actual applied situation - (this is just an example for spec reasons, this is not a real-world law case!)
- situation C: declared expression and concluded spdx id
- Declared spdx expression "GPL-3.0-or-later OR GPL-2.0"
- Concluded spdx id " GPL-3.0-only" - after some lawyer checked for actual applied situation - (this is just an example for spec reasons, this is not a real-world law case!)
▶ more regarding reasons and practical use cases here: #454 (comment)
▶ more practical examples to justify this feature can be found in the examples:
https://github.com/CycloneDX/specification/blob/feat/licenses-multi-mix-all/tools/src/test/resources/1.7/valid-license-declared-concluded-mix-1.7.xml
request
allow the following:
- multiple SPDX expressions at the same time
- allow mix of SPDX expression and other licenses at the same time
possible results
clickhere to uncollapse the example
{
"bomFormat": "CycloneDX",
"specVersion": "1.x",
// ...
"components": [
{
// ... component properties ...
"licenses": [
// situation A -- (this is just an example for spec reasons, this is not a real-world law case!)
{ "license": {
"id": "MIT",
"acknowledgement": "declared" } },
{ "license": {
"id": "PostgreSQL",
"acknowledgement": "declared" } },
{ "license": {
"name": "Apache Software License",
"acknowledgement": "declared" } },
{ "expression": "(MIT OR PostgreSQL OR Apache-2.0)",
"acknowledgement": "concluded" }
]
},
{
// ... component properties ...
"licenses": [
// situation B -- (this is just an example for spec reasons, this is not a real-world law case!)
{ "expression": "MIT OR (GPL-3.0 OR GPL-2.0)",
"acknowledgement": "declared" },
{ "expression": "(GPL-2.0-only AND LGPL-2.0-only)",
"acknowledgement": "concluded" }
]
},
{
// ... component properties ...
"licenses": [
// situation C -- (this is just an example for spec reasons, this is not a real-world law case!)
{ "expression": "GPL-3.0+ OR GPL-2.0",
"acknowledgement": "declared" },
{ "license": {
"id": " GPL-3.0-only",
"acknowledgement": "concluded" } }
]
},
{
// ... component properties ...
"licenses": [
// example with concluded LicenseRef -- (this is just an example for spec reasons, this is not a real-world law case!)
{ "license": {
"id": "MIT",
"acknowledgement": "declared" } },
{ "license": {
"name": "Amazon Software License",
"acknowledgement": "declared" } },
{ "expression": "MIT AND LicenseRef-.amazon.com.-AmznSL-1.0",
"acknowledgement": "concluded" }
]
},
]
}