Mike's Notes
A fantastic resource. Will use it to sort out open-source licensing.
"System Package Data Exchange (SPDX, formerly Software Package Data Exchange) is an open standard capable of representing systems with digital components as bills of materials (BOMs).[2] First designed to describe software components, SPDX can describe the components of software systems, AI models, software builds, security data, and other data packages. SPDX allows the expression of components, licenses, copyrights, security references and other metadata relating to systems.[3]
The original purpose of SPDX was to improve license compliance,[4] and it has since been expanded to facilitate additional use cases such as supply-chain transparency and security.[5] SPDX is authored by the community-driven SPDX Project involving key industry experts, organizations, and open-source enthusiasts under the auspices of the Linux Foundation.
The SPDX specification is recognized as the international open standard for security, license compliance, and other software supply chain artifacts as ISO/IEC 5962:2021. As of August 2025, the latest version of the standard has been 3.0.1.[1]" - Wikipedia
Legal advice
Edwin Lim, a lawyer at Hudson Gavin Martin (HGM), is my go-to for licensing advice.
Resources
- https://en.wikipedia.org/wiki/Software_Package_Data_Exchange
- https://spdx.org/licenses/
- https://spdx.org/licenses/exceptions-index.html
- https://spdx.github.io/spdx-spec/latest/annexes/spdx-license-expressions/
- https://spdx.github.io/spdx-spec/latest/annexes/license-matching-guidelines-and-templates/
- https://github.com/spdx/license-list-XML/blob/master/DOCS/license-fields.md
- https://github.com/spdx/license-list-XML/blob/master/DOCS/license-inclusion-principles.md
- https://github.com/spdx/license-list-XML/blob/master/CONTRIBUTING.md
- https://spdx.dev/ids
- https://github.com/spdx/license-list-XML
- https://github.com/spdx/license-list-data
- https://www.iso.org/standard/81870.html
- https://www.hgmlegal.com/team/edwin-lim
- https://www.kiwisaas.com/resources/tag/Edwin+Lim
- https://www.blog.ajabbi.com/2025/02/rabinowitz-boudin-standard-krinsky.html
References
- ISO/IEC 5962:2021
Repository
- Home > Ajabbi Research > Library >
- Home > Handbook >
Last Updated
13/10/2026
SPDX License List
...
The SPDX License List is an integral part of the SPDX Specification. The SPDX License List itself is a list of commonly found licenses and exceptions used in free and open or collaborative software, data, hardware, or documentation. The SPDX License List includes a standardized short identifier, the full name, the license text, and a canonical permanent URL for each license and exception.
The purpose of the SPDX License List is to enable efficient and reliable identification of such licenses and exceptions in an SPDX document, in source files or elsewhere.
License Exceptions are commonly found exceptions to free and open source licenses, used with the License Expression operator, "WITH" to create a license with an exception.
The matching guidelines define what constitutes a license or exception match. The license text on the HTML pages here will display omitable text in blue and replaceable text in red (see Guideline #2 for more information).
Explanation of fields used on the SPDX License List
- License inclusion principles for adding new licenses or exceptions to the SPDX License List
- Contribute to the project or request a new license
- Use short identifiers in your source code
- Github repo
- Machine readable data files for the SPDX License List
[Example of data]
Note: You can sort by each column by clicking on the column header. By default, the table sorts by the Identifier column.
| Full name | Identifier | FSF Free/Libre? | OSI Approved? |
|---|---|---|---|
| BSD Zero Clause License | 0BSD | Y | |
| 3D Slicer License v1.0 | 3D-Slicer-1.0 | ||
| Attribution Assurance License | AAL | Y | |
| Abstyles License | Abstyles | ||
| AdaCore Doc License | AdaCore-doc | ||
| Adobe Systems Incorporated Source Code License Agreement | Adobe-2006 | ||
| Adobe Display PostScript License | Adobe-Display-PostScript | ||
| Adobe Glyph List License | Adobe-Glyph | ||
| Adobe Utopia Font License | Adobe-Utopia | ||
| Amazon Digital Services License | ADSL | ||
| Advanced Cryptics Dictionary License | Advanced-Cryptics-Dictionary | ||
| Academic Free License v1.1 | AFL-1.1 | Y | Y |
| Academic Free License v1.2 | AFL-1.2 | Y | Y |
| Academic Free License v2.0 | AFL-2.0 | Y | Y |
| Academic Free License v2.1 | AFL-2.1 | Y | Y |
| Academic Free License v3.0 | AFL-3.0 | Y | Y |
| Afmparse License | Afmparse |
Deprecated License Identifiers
SPDX endeavors to never change the SPDX license identifiers. However, sometimes there has been a compelling reason to deprecate a license identifier, such as to accommodate improved SPDX license expressions or when we have found a duplicate license. When a license identifier is "deprecated" on the SPDX License List, it effectively means that there is an updated license identifier and the deprecated license identifier, while remaining valid, should no longer be used. The URL to each deprecated license is retained and those license pages are updated to note the deprecation. Some reasons for deprecation are as follows:
- Release 2.0 of the SPDX Specification introduced License Expressions that supports the ability to identify common variations of SPDX-identified licenses without the need to define each potential variation as a distinct license on the SPDX License List. This new syntax supports the ability to declare an SPDX-identified license exception using the "WITH" operator (e.g. GPL-2.0-or-later WITH Autoconf-exception-2.0), as well as the ability to use a simple "+" operator after a license short identifier to indicate "or later version". SPDX has defined a list of license exceptions to use after the "WITH" operator. As a result, a number of licenses formerly included on the SPDX License List have been deprecated, and correct usage employs the License Expression syntax as of v2.0.
- Release 3.0 replaced previous Identifiers for GNU licenses with more explicit Identifiers to reflect the "this version only" or "any later version" option specific to those licenses. As such, the previously used Identifiers for those licenses are deprecated as of v3.0.
- Other licenses may have been deprecated for the reasons noted.
[Example of data]
| Full name | Identifier | Deprecated as of: |
|---|---|---|
| Affero General Public License v1.0 | AGPL-1.0 | 3.1 |
| GNU Affero General Public License v3.0 | AGPL-3.0 | 3.0 |
| BSD 2-Clause FreeBSD License | BSD-2-Clause-FreeBSD | 3.10 |
| BSD 2-Clause NetBSD License | BSD-2-Clause-NetBSD | 3.9 |
| bzip2 and libbzip2 License v1.0.5 | bzip2-1.0.5 | 3.16 |
| eCos license version 2.0 | eCos-2.0 | 2.0rc2 |
| GNU Free Documentation License v1.1 | GFDL-1.1 | 3.0 |
| GNU Free Documentation License v1.2 | GFDL-1.2 | 3.0 |
| GNU Free Documentation License v1.3 | GFDL-1.3 | 3.0 |
No comments:
Post a Comment