### Bug Description The following are some of the license expressions provided by the fetch service: ``` [ "", "(GFDL-1.3+ and/or GPL-2+) with Autoconf-data exception", "(MIT and/or GPL-2 and/or GPL-3+) with Autoconf-data exception", "BSD-2-Clause-NetBSD and/or BSD-4-clause and/or ISC", "BSD-2-clause", "BSD-2-clause and/or BSD-3-Clause-Attribution and/or BSD-3-clause and/or GPL-3", "BSD-2-clause and/or BSD-3-clause and/or MIT and/or FSFULLR", "BSD-2-clause and/or ISC and/or public-domain", "BSD-2-clause and/or MIT", "BSD-2-clause and/or public-domain", "BSD-3-clause", "BSD-3-clause and/or FSFULLR and/or GPL-2 and/or GPL-3 and/or X11", "BSD-3-clause and/or GPL-3 and/or LGPL-2.1", "BSD-3-clause and/or GPL-3+ and/or ISC", "BSD-3-clause and/or LGPL-2.1+ and/or Zlib", "BSD-3-clause and/or MIT and/or X11", "BSD-3-clause and/or OPL-1.0", "CC-BY-SA-4.0 and/or MIT", "FSFULLR and/or GPL-2 and/or LGPL-2.1 and/or LGPL-3", "GFDL and/or GPL", "GFDL and/or GPL-2 and/or GPL-3+", "GFDL and/or GPL-2+ and/or GPL-3+", "GFDL and/or GPL-3 and/or LGPL-2.1+ and/or LGPL-3", "GFDL-1.2+ and/or GPL-3+", "GFDL-1.2+ and/or LGPL", "GFDL-1.3+ and/or GPL-3+", "GPL", "GPL-2", "GPL-2 and/or GPL-3 and/or LGPL-2 and/or LGPL-2.1 and/or LGPL-3+", "GPL-2 and/or LGPL-2", "GPL-2 and/or LGPL-3 and/or X11", "GPL-2+", "GPL-2+ and/or GPL-3+", "GPL-2+ and/or GPL-3+ and/or LGPL-3", "GPL-2+ and/or LGPL-2.1+", "GPL-2+ and/or LGPL-3", "GPL-3", "GPL-3 and/or LGPL-2+", "GPL-3 and/or LGPL-2.1", "GPL-3+", "GPL-3+ and/or LGPL-2.1+", "GPL-3+ with Autoconf-data exception", "LGPL-2.1+", "LGPL-3+", "MIT", "MIT and/or GPL-3", "MIT and/or GPL-3 and/or LGPL-2.1 and/or LGPL-3", "MIT and/or GPL-3 and/or OFL-1.1-RFN and/or Zlib", "MIT and/or GPL-3.0-only and/or IJG", "MIT and/or ISC", "MIT and/or Unicode-DFS-2016", "MIT~Boehm", "OLDAP-2.8", "UNKNOWN", "Zlib" ] [ "", "(GFDL-1.3+ and/or GPL-2+) with Autoconf-data exception", "(MIT and/or GPL-2 and/or GPL-3+) with Autoconf-data exception", "BSD-2-Clause-NetBSD and/or BSD-4-clause and/or ISC", "BSD-2-clause", "BSD-2-clause and/or BSD-3-Clause-Attribution and/or BSD-3-clause and/or GPL-3", "BSD-2-clause and/or BSD-3-clause and/or MIT and/or FSFULLR", "BSD-2-clause and/or ISC and/or public-domain", "BSD-2-clause and/or MIT", "BSD-2-clause and/or public-domain", "BSD-3-clause", "BSD-3-clause and/or FSFULLR and/or GPL-2 and/or GPL-3 and/or X11", "BSD-3-clause and/or GPL-3 and/or LGPL-2.1", "BSD-3-clause and/or GPL-3+ and/or ISC", "BSD-3-clause and/or LGPL-2.1+ and/or Zlib", "BSD-3-clause and/or MIT and/or X11", "BSD-3-clause and/or OPL-1.0", "CC-BY-SA-4.0 and/or MIT", "FSFULLR and/or GPL-2 and/or LGPL-2.1 and/or LGPL-3", "GFDL and/or GPL", "GFDL and/or GPL-2 and/or GPL-3+", "GFDL and/or GPL-2+ and/or GPL-3+", "GFDL and/or GPL-3 and/or LGPL-2.1+ and/or LGPL-3", "GFDL-1.2+ and/or GPL-3+", "GFDL-1.2+ and/or LGPL", "GFDL-1.3+ and/or GPL-3+", "GPL", "GPL-2", "GPL-2 and/or GPL-3 and/or LGPL-2 and/or LGPL-2.1 and/or LGPL-3+", "GPL-2 and/or LGPL-2", "GPL-2 and/or LGPL-3 and/or X11", "GPL-2+", "GPL-2+ and/or GPL-3+", "GPL-2+ and/or GPL-3+ and/or LGPL-3", "GPL-2+ and/or LGPL-2.1+", "GPL-2+ and/or LGPL-3", "GPL-3", "GPL-3 and/or LGPL-2+", "GPL-3 and/or LGPL-2.1", "GPL-3+", "GPL-3+ and/or LGPL-2.1+", "GPL-3+ with Autoconf-data exception", "LGPL-2.1+", "LGPL-3+", "MIT", "MIT and/or GPL-3", "MIT and/or GPL-3 and/or LGPL-2.1 and/or LGPL-3", "MIT and/or GPL-3 and/or OFL-1.1-RFN and/or Zlib", "MIT and/or GPL-3.0-only and/or IJG", "MIT and/or ISC", "MIT and/or Unicode-DFS-2016", "MIT~Boehm", "OLDAP-2.8", "UNKNOWN", "Zlib" ] [ "", "Proprietary" ] ``` Without going into much depth around the actual license identifiers, the license expressions themselves are not valid in SPDX. SPDX does not recognize `and/or` pattern, it has to be either `AND`, `and` or `OR`, `or`. The current license implementation is rather straightforward (and out of control of fetch-service): https://github.com/canonical/fetch-service/blob/b96a4a8309a4a643edf2f182ab976968a5c06e80/utils/file_utils.go#L64-L83 `and/or` together doesn't make any sense. The consumer wouldn't know whether to comply with both the licenses or either one of them. | License/Exception | IN SPDX? | |-----------------|-----------| | Autoconf-data | No, `Autoconf-exception-*` are there in SPDX | | BSD-2-Clause-NetBSD | Yes, but deprecated now | | BSD-2-clause | Yes | | BSD-3-Clause-Attribution | Yes | | BSD-3-clause | Yes | | BSD-4-clause | Yes | | CC-BY-SA-4.0 | Yes | | FSFULLR | Yes | | GFDL | No (needs version) | | GFDL-1.2+ | No, don't use `+` with GNU licenses | | GFDL-1.3+ | No, don't use `+` with GNU licenses | | GPL | No (needs version) | | GPL-2 | No, needs to be more specific, GPL-2.0, 2.1? | | GPL-2+ | No, needs to be more specific, GPL-2.0, 2.1? Also use `-or-later` for GNU licenses | | GPL-3 | No, needs to be more specific, GPL-3.0, 3.1? | | GPL-3+ | No, needs to be more specific, GPL-3.0, 3.1? Also use `-or-later` for GNU licenses| | GPL-3.0-only | Yes | | IJG | Yes | | ISC | Yes | | LGPL | No (needs version) | | LGPL-2 | No, need to be more specific | | LGPL-2.1 | Yes, Deprecated. Use `-only` or `-or-later` | | LGPL-2.1+ | Yes, Deprecated. Use `-only` or `-or-later` | | LGPL-3 | No, need to be more specific. Also use `-or-later` for GNU licenses | | LGPL-3+ | No, need to be more specific. Also use `-or-later` for GNU licenses | | MIT | Yes | | MIT~Boehm | No | | OFL-1.1-RFN | Yes | | OLDAP-2.8 | Yes | | OPL-1.0 | Yes | | Proprietary | No | | public-domain | No | | UNKNOWN | No, but can be represented in the SBOM, in such cases, we'd like this field to be empty | | Unicode-DFS-2016 | Yes | | X11 | Yes | | Zlib | Yes | I would recommend using https://github.com/google/licensecheck as that seems to be up to date and more accurate (and documented). Even though, it was updated 3 years ago, the accuracy seems high and we can pin license-data version in SBOMs to https://github.com/spdx/license-list-data/tree/v3.10, so it seems worth trying. ### To Reproduce Taken from fetch service output manifests. Can be shared if asked for. ### Relevant log output _No response_