Re: GPL vX or later issue

Jilayne Lovejoy <Jlovejoy@...>

Hi All,

I think I created a bit of a mess with what was intended to be a simple question, but sort of opened a can or worms!  Let me try to re-center a bit, if possible…

I think it can be said that everyone agrees that there must be a clear way to capture the difference between code that is licensed under GPL v2 and code that is licensed under GPL v2 or later (for example).  The former situation is a straight forward, single license situation, whereas the latter provide a choice of licenses, the choice being among various versions of the GPL license.

I started out by asking how, if at all, this difference should be reflected on the actual license list.  However, the subsequent discussion seems to illustrate that we must first determine how to capture this in the SPDX file, which will then dictate what is listed on the actual license list.  From a broader perspective, we need to decide how SPDX will accurately capture any licensing situation that involves multiple licenses.  Perhaps the answer to this question is really more aptly left up to the technical team.

To be clear, I think we have identified two different multiple licensing situations:

1)      Where the licensee has a choice.  This is sometimes referred to as disjunctive licensing and creates an “OR” situation, in that the code is licensed under one of the choices, but not multiple licenses.  Examples of this include:

a.      Code is licensed under GPL v2 or later – this essentially creates a licensing choice of GPL v2 OR GPL v3
b.      Code is licensed under MPL/GPL/LGPL – this creates a licensing choice of one of the three licenses (or if the GPL and LGPL options indicate “or later,” then the choice would be among 5 different licenses)

i.      In either situation, this information is usually indicated in the header, but the actual license text itself remains the same.  In other words, there is no MPL/GPL/LGPL license but only these individual licenses and a way to indicate the choice of one of them. 

ii.     GPL v2 or later creates the same scenario in that there is a licensing choice.  In this case, the individual licenses are GPL v2, GPL v3 (and perhaps one day, GPL v4, etc.)

iii.    There is potentially the further distinction of where there is a default license if no “choice” is affirmatively identified, but in this case as well, each license remains an individual license.

2)      Where multiple licenses cover the same code.  This is sometimes referred to as dual (or tri, etc.) licensing and creates an “AND” situation.  For example:

a.      Code is licensed under Apache and BSD.  In this case, there is no choice; the licensee must comply with both licenses for that code.

(if there is another licensing scenario that involves more than one license (or license version) or anything else I missed here, please add)

This then begs the question of not only how will an SPDX file denote multiple licenses, but also how it differentiates between the above two scenarios (OR, AND)?

Once this has been determined (probably by the more technical folks in the group), I presume the license list protocol will follow.   

Sorry for not realizing this proper order of events!  In the meantime, I’ll leave the license list as is as regards to those licenses.


Jilayne Lovejoy  |  Corporate Counsel



720 240 4545  |  phone

720 240 4556  |  fax

1 888 OpenLogic  |  toll free


OpenLogic, Inc.

Headquarters, Broomfield, Colorado 80021

-----Original Message-----
From: Bruno Cornec [mailto:Bruno.Cornec@...]
Sent: Tuesday, November 09, 2010 4:34 PM
To: Radcliffe, Mark
Cc: Jilayne Lovejoy; Peter Williams; spdx@...
Subject: Re: GPL vX or later issue

Radcliffe, Mark said on Tue, Nov 09, 2010 at 10:28:17AM -0800:

> I think that this approach will create confusion. First, I estimate that 99.9% of all GPL licenses are version or later, so most users of SPDX will assume that GPLv2 is GPLv2 or later. Unless we can make this very clear, it will be very confusing. I am open to other ways of solving this problem. Second, I think that this distinction is very important now and will increase in importance as GPLv3 becomes more important and some GPLv2 and later programs are forked to GPLv3.

I can confirm I'm the maintainer of a project which is mostly GPLv2 (and

not or later). So that does exist and should be differentiated (Linux is

a more famous example ;-)



Open Source & Linux Profession Lead EMEA           /

HP/Intel/Red Hat Open Source Solutions Initiative  /

La musique ancienne?

Join { to automatically receive all group messages.