Non SPDX compliant license expressions (and license identifiers)
Metadata
Current evaluation
Maintainer-scoped SPDX normalization remains unimplemented: licensecheck still emits invalid and/or expressions, and a current test explicitly expects that output.
Suggested action: keep open
Reason: utils/file_utils.go still returns licensecheck output unchanged except for an Expat substitution, while inspectors/deb/deb_test.go expects the invalid expression "GFDL-1.3-or-later and/or GPL-3.0-or-later", confirming the defect persists. A maintainer explicitly scoped an incremental fix to normalize identifiers, convert GNU + suffixes to -or-later, and join multiple licenses with AND, but no implementation is present.
Evaluated by: mr-cal-bot
Impact:
50
Quick Win:
13
Complexity:
64
Confidence:
92
Actionability:
70
Issue body
### Bug Description
The following are some of the license expressions provided by the fetch service:
```
[
"",
"(GFDL-1.3+ and/or GPL-2+) with Autoconf-data exception",
"(MIT and/or GPL-2 and/or GPL-3+) with Autoconf-data exception",
"BSD-2-Clause-NetBSD and/or BSD-4-clause and/or ISC",
"BSD-2-clause",
"BSD-2-clause and/or BSD-3-Clause-Attribution and/or BSD-3-clause and/or GPL-3",
"BSD-2-clause and/or BSD-3-clause and/or MIT and/or FSFULLR",
"BSD-2-clause and/or ISC and/or public-domain",
"BSD-2-clause and/or MIT",
"BSD-2-clause and/or public-domain",
"BSD-3-clause",
"BSD-3-clause and/or FSFULLR and/or GPL-2 and/or GPL-3 and/or X11",
"BSD-3-clause and/or GPL-3 and/or LGPL-2.1",
"BSD-3-clause and/or GPL-3+ and/or ISC",
"BSD-3-clause and/or LGPL-2.1+ and/or Zlib",
"BSD-3-clause and/or MIT and/or X11",
"BSD-3-clause and/or OPL-1.0",
"CC-BY-SA-4.0 and/or MIT",
"FSFULLR and/or GPL-2 and/or LGPL-2.1 and/or LGPL-3",
"GFDL and/or GPL",
"GFDL and/or GPL-2 and/or GPL-3+",
"GFDL and/or GPL-2+ and/or GPL-3+",
"GFDL and/or GPL-3 and/or LGPL-2.1+ and/or LGPL-3",
"GFDL-1.2+ and/or GPL-3+",
"GFDL-1.2+ and/or LGPL",
"GFDL-1.3+ and/or GPL-3+",
"GPL",
"GPL-2",
"GPL-2 and/or GPL-3 and/or LGPL-2 and/or LGPL-2.1 and/or LGPL-3+",
"GPL-2 and/or LGPL-2",
"GPL-2 and/or LGPL-3 and/or X11",
"GPL-2+",
"GPL-2+ and/or GPL-3+",
"GPL-2+ and/or GPL-3+ and/or LGPL-3",
"GPL-2+ and/or LGPL-2.1+",
"GPL-2+ and/or LGPL-3",
"GPL-3",
"GPL-3 and/or LGPL-2+",
"GPL-3 and/or LGPL-2.1",
"GPL-3+",
"GPL-3+ and/or LGPL-2.1+",
"GPL-3+ with Autoconf-data exception",
"LGPL-2.1+",
"LGPL-3+",
"MIT",
"MIT and/or GPL-3",
"MIT and/or GPL-3 and/or LGPL-2.1 and/or LGPL-3",
"MIT and/or GPL-3 and/or OFL-1.1-RFN and/or Zlib",
"MIT and/or GPL-3.0-only and/or IJG",
"MIT and/or ISC",
"MIT and/or Unicode-DFS-2016",
"MIT~Boehm",
"OLDAP-2.8",
"UNKNOWN",
"Zlib"
]
[
"",
"(GFDL-1.3+ and/or GPL-2+) with Autoconf-data exception",
"(MIT and/or GPL-2 and/or GPL-3+) with Autoconf-data exception",
"BSD-2-Clause-NetBSD and/or BSD-4-clause and/or ISC",
"BSD-2-clause",
"BSD-2-clause and/or BSD-3-Clause-Attribution and/or BSD-3-clause and/or GPL-3",
"BSD-2-clause and/or BSD-3-clause and/or MIT and/or FSFULLR",
"BSD-2-clause and/or ISC and/or public-domain",
"BSD-2-clause and/or MIT",
"BSD-2-clause and/or public-domain",
"BSD-3-clause",
"BSD-3-clause and/or FSFULLR and/or GPL-2 and/or GPL-3 and/or X11",
"BSD-3-clause and/or GPL-3 and/or LGPL-2.1",
"BSD-3-clause and/or GPL-3+ and/or ISC",
"BSD-3-clause and/or LGPL-2.1+ and/or Zlib",
"BSD-3-clause and/or MIT and/or X11",
"BSD-3-clause and/or OPL-1.0",
"CC-BY-SA-4.0 and/or MIT",
"FSFULLR and/or GPL-2 and/or LGPL-2.1 and/or LGPL-3",
"GFDL and/or GPL",
"GFDL and/or GPL-2 and/or GPL-3+",
"GFDL and/or GPL-2+ and/or GPL-3+",
"GFDL and/or GPL-3 and/or LGPL-2.1+ and/or LGPL-3",
"GFDL-1.2+ and/or GPL-3+",
"GFDL-1.2+ and/or LGPL",
"GFDL-1.3+ and/or GPL-3+",
"GPL",
"GPL-2",
"GPL-2 and/or GPL-3 and/or LGPL-2 and/or LGPL-2.1 and/or LGPL-3+",
"GPL-2 and/or LGPL-2",
"GPL-2 and/or LGPL-3 and/or X11",
"GPL-2+",
"GPL-2+ and/or GPL-3+",
"GPL-2+ and/or GPL-3+ and/or LGPL-3",
"GPL-2+ and/or LGPL-2.1+",
"GPL-2+ and/or LGPL-3",
"GPL-3",
"GPL-3 and/or LGPL-2+",
"GPL-3 and/or LGPL-2.1",
"GPL-3+",
"GPL-3+ and/or LGPL-2.1+",
"GPL-3+ with Autoconf-data exception",
"LGPL-2.1+",
"LGPL-3+",
"MIT",
"MIT and/or GPL-3",
"MIT and/or GPL-3 and/or LGPL-2.1 and/or LGPL-3",
"MIT and/or GPL-3 and/or OFL-1.1-RFN and/or Zlib",
"MIT and/or GPL-3.0-only and/or IJG",
"MIT and/or ISC",
"MIT and/or Unicode-DFS-2016",
"MIT~Boehm",
"OLDAP-2.8",
"UNKNOWN",
"Zlib"
]
[
"",
"Proprietary"
]
```
Without going into much depth around the actual license identifiers, the license expressions themselves are not valid in SPDX. SPDX does not recognize `and/or` pattern, it has to be either `AND`, `and` or `OR`, `or`.
The current license implementation is rather straightforward (and out of control of fetch-service):
https://github.com/canonical/fetch-service/blob/b96a4a8309a4a643edf2f182ab976968a5c06e80/utils/file_utils.go#L64-L83
`and/or` together doesn't make any sense. The consumer wouldn't know whether to comply with both the licenses or either one of them.
| License/Exception | IN SPDX? |
|-----------------|-----------|
| Autoconf-data | No, `Autoconf-exception-*` are there in SPDX |
| BSD-2-Clause-NetBSD | Yes, but deprecated now |
| BSD-2-clause | Yes |
| BSD-3-Clause-Attribution | Yes |
| BSD-3-clause | Yes |
| BSD-4-clause | Yes |
| CC-BY-SA-4.0 | Yes |
| FSFULLR | Yes |
| GFDL | No (needs version) |
| GFDL-1.2+ | No, don't use `+` with GNU licenses |
| GFDL-1.3+ | No, don't use `+` with GNU licenses |
| GPL | No (needs version) |
| GPL-2 | No, needs to be more specific, GPL-2.0, 2.1? |
| GPL-2+ | No, needs to be more specific, GPL-2.0, 2.1? Also use `-or-later` for GNU licenses |
| GPL-3 | No, needs to be more specific, GPL-3.0, 3.1? |
| GPL-3+ | No, needs to be more specific, GPL-3.0, 3.1? Also use `-or-later` for GNU licenses|
| GPL-3.0-only | Yes |
| IJG | Yes |
| ISC | Yes |
| LGPL | No (needs version) |
| LGPL-2 | No, need to be more specific |
| LGPL-2.1 | Yes, Deprecated. Use `-only` or `-or-later` |
| LGPL-2.1+ | Yes, Deprecated. Use `-only` or `-or-later` |
| LGPL-3 | No, need to be more specific. Also use `-or-later` for GNU licenses |
| LGPL-3+ | No, need to be more specific. Also use `-or-later` for GNU licenses |
| MIT | Yes |
| MIT~Boehm | No |
| OFL-1.1-RFN | Yes |
| OLDAP-2.8 | Yes |
| OPL-1.0 | Yes |
| Proprietary | No |
| public-domain | No |
| UNKNOWN | No, but can be represented in the SBOM, in such cases, we'd like this field to be empty |
| Unicode-DFS-2016 | Yes |
| X11 | Yes |
| Zlib | Yes |
I would recommend using https://github.com/google/licensecheck as that seems to be up to date and more accurate (and documented). Even though, it was updated 3 years ago, the accuracy seems high and we can pin license-data version in SBOMs to https://github.com/spdx/license-list-data/tree/v3.10, so it seems worth trying.
### To Reproduce
Taken from fetch service output manifests. Can be shared if asked for.
### Relevant log output
_No response_
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
50
Quick Win:
13
Complexity:
64
Confidence:
92
Actionability:
70
|
keep open | Maintainer-scoped SPDX normalization remains unimplemented: licensecheck still emits invalid and/or expressions, and a current test explicitly expects that output. | |
| stealth/space-bunny-alpha |
Impact:
58
Quick Win:
11
Complexity:
73
Confidence:
94
Actionability:
72
|
keep open | fetch-service still emits invalid SPDX operators such as "and/or"; maintainers agreed on incremental normalization and conservative AND grouping, but implementation remains pending. | |
| stealth/space-bunny-alpha |
Impact:
52
Quick Win:
14
Complexity:
60
Confidence:
82
Actionability:
66
|
keep open | fetch-service emits non-SPDX license expressions (e.g. 'GPL-3+ and/or MIT') and deprecated/invalid identifiers. Maintainer proposed incremental plan in Jan 2025: normalize names, GPL/LGPL '+' to -or-later, group with AND; no implementation yet. | |
| stealth/space-bunny-alpha |
Impact:
60
Quick Win:
15
Complexity:
68
Confidence:
89
Actionability:
78
|
keep open | fetch-service emits non-SPDX license expressions and deprecated or invalid identifiers. A maintainer proposed normalization, GNU + handling, and conservative AND grouping, but implementation remains pending. | |
| qwen/qwen3.6-35b-a3b |
Impact:
80
Quick Win:
40
Staleness:
50
Complexity:
50
Confidence:
85
Support Request:
0
|
keep open | Maintainer outlined an incremental plan to normalize non-SPDX license expressions and identifiers. Tracks compliance fixes for fetch-service SBOM generation. |
Update history
| Date | Change |
|---|---|
| created |
Related work
-
Related To:
licensecheck#2105679
(confidence 95%)
A maintainer cited this Launchpad bug while evaluating missing licensecheck functionality needed for normalization.
-
Related To:
licensecheck#2104867
(confidence 95%)
A maintainer cited this second Launchpad bug while assessing licensecheck limitations.
Related issues
No related issues found above the similarity threshold.