10

When you publish Solidity code, you can include machine-readable license identifier in the beginning of the file. Usually, it looks like this:

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.7;
...

However, sometimes I see the mark UNLICENSED. Referring to Solidity doc, it says:

If you do not want to specify a license or if the source code is not open-source, please use the special value UNLICENSED.

https://docs.soliditylang.org/en/latest/layout-of-source-files.html#spdx-license-identifier

BUT, there is also similarly-named UNLICENSE: https://unlicense.org/

What is the Unlicense? The Unlicense is a template for disclaiming copyright monopoly interest in software you've written; in other words, it is a template for dedicating your software to the public domain. It combines a copyright waiver patterned after the very successful public domain SQLite project with the no-warranty statement from the widely-used MIT/X11 license.

Going in the SPDX spec, again there's no option of UNLICENSED, only UNLICENSE, which seems to be the same as Unlicense.org. (https://spdx.org/licenses/)

screenshot of spdx.org list of licenses featuring only UNLICENSE

What's the real difference between them? Is there any source where I can verifiably check if UNLICENSED means what it's supposed to mean?

And most important, can I use the code marked UNLICENSED?

Improve this question

2 Answers 2

Reset to default
19

Unfortunately, the format SPDX-License-Identifier: UNLICENSED is an invalid SPDX license expression per the SPDX spec, because the identifier UNLICENSED is not part of the SPDX license list. While well-intentioned, Solidity has here caused potentially dangerous confusion.

The SPDX project is concerned about machine-readable annotations for FOSS licenses (free/libre or open source software). By default, software is “all rights reserved”. For such software, it makes no sense to add an SPDX tag. Yet, the Solidity documentation is suggesting to refer to such all-rights reserved software as “unlicensed”.

The Unlicense is a license or license-like legal device that tries to do the very opposite of “all rights reserved”: it is a very permissive license that allows any use, and may even be equivalent to a public domain dedication that relinquishes any copyright. It's a bit confusingly written and has a confusing name so I don't recommend that anyone should use the license, but it's popular with people who don't like to think about licensing and want their software to be used however anyone wants, without limitations.

So Solidity's nonstandard UNLICENSED identifier is VERY DIFFERENT from the SPDX Unlicense identifier. See also Solidity issue #12251. Per SPDX-spec issue #49, it would have been better to represent unlicensed software with NONE, but that's not yet part of the formal SPDX license identifier syntax.

Improve this answer
3
  • The special identifier UNLICENSED (instead of an SPDX expression) is pretty well known to mark proprietary code, probably most famously used in npm's package.json.
    – AndreKR
    Dec 11, 2021 at 18:26
  • 2
    Yes, but NPM is at least pretty clear that the license metadata field can either contain an SPDX expression or a free-form format like SEE LICENSE IN or UNLICENSED. They did not co-opt the SPDX-License-Identifier tag format.
    – amon
    Dec 11, 2021 at 18:33
  • 1
    Yes, this non-standard usage is bad. Here's another concrete example of the fallout, where it breaks the REUSE license validation tool: github.com/fsfe/reuse-tool/issues/409
    – Adam Spiers
    Feb 18, 2022 at 1:47
7

The two statuses are about as far apart as could be. Having no licence means, as we've said before, that you have no rights to use the code at all. Being licensed under the Unlicense means that you have about as many rights to the code as the author can grant.

I agree that the texts are close (UNLICENSED for the former, Unlicense for the latter). Some might say they're confusingly close. But they are different, and moreover the former seems to be a Solidity convention, not an SPDX official identifier. So with care you can be sure which of the two licensing regimes applies to any piece of Solidity code bearing one of these identifiers.

Improve this answer
4
  • It's not a Solidity convention, npm also uses UNLICENSED instead of an SPDX expression to mark proprietary packages.
    – AndreKR
    Dec 11, 2021 at 18:28
  • @AndreKR thank you, that's useful to know. Nevertheless, what it isn't is an SPDX convention.
    – MadHatter ♦
    Dec 11, 2021 at 21:08
  • "I agree that the SPDX identifiers are close (UNLICENSED for the former, Unlicense for the latter)." – UNLICENSED is not a valid SPDX identifier. In fact, there is no SPDX identifier that signifies "no license", nor does there need to be: if there is no license, that already makes it pretty clear that there is … no license.
    – Jörg W Mittag
    Dec 12, 2021 at 17:13
  • @JörgWMittag I take your point. I'd said in the following sentence that the former wasn't an SPDX identifier, but you're right that the whole paragraph was confusing, so I've tried to improve it. That said, I wish SPDX did have such an identifier, since it does serve a purpose: it lets recipients know that an attempt was made to SPDX-classify the code's licence status, and this was not possible, because there was no licence. Simply having no identifier is less useful, because it doesn't let recipients know that such an attempt was made.
    – MadHatter ♦
    Dec 12, 2021 at 21:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.