NuGet packages, for the purpose of telegraphing the license of a package, have - or rather should have used to - the field <licenseUrl> that could link to a license for the package.

licenseUrl is deprecated: See https://learn.microsoft.com/en-us/nuget/reference/nuspec#licenseurl

This is (rightly so, I think) rationalized with the fact that an URL is not a stable reference, as the content of the URL can change.

Instead, NuGet proposes the field license where package author has the option to either specify a file within the package (totally fine) or, and here is the problem, an SPDX license expression.


    <license type="expression">MIT</license>
    <copyright>© Microsoft Corporation. All rights reserved.</copyright>
    <repository type="git" url="https://github.com/Azure/azure-sdk-for-net" commit="c8aaee521e662ddfb238d5ad1f2f9a79233f97f6" />

Here MS provides a license expression for the MIT license. They also provide (in the deprecated licenseUrl) a link to a generic MIT license with copyright placeholders.

Now, the MIT license stipulates that

The above copyright notice and this permission notice shall be included ...

which means that re-distributor of said NuGet packaged software has the obligation to include "above copyright notice" etc.

But with the <license type="expression"> of a NuGet package we have no complete license, nor copyright notice for license types like MIT, that include the copyright notice in the license text itself.

So to comply with the redistribution requirements, we will actually have to download the LICENSE from the repository link. (and first find it there, since there is no direct link anymore)

In which case the whole point (to me) of the license field (with expression) is moot. (For MIT license at least.)

Is this accurate? What other factors are there when attributing such a library?

  • I believe this is off topic here at Open Source Stack Exchange. We can't help with a performance/features of specific software. I guess Stack Overflow would be a better place for this question. Commented Jul 3 at 15:50
  • @Martin_in_AUT - I already tried to highlight an actually relevant point for this site here at the end in bod, namely whether it is broken from a useful-for-redistribution purposes angle. Oh, and this would be so off topic on S.O. ;-)
    – Martin Ba
    Commented Jul 3 at 15:56
  • 1
    I would say it falls under the "understanding, applying, and complying with Free & Open licenses" question umbrella?
    – Martin Ba
    Commented Jul 3 at 15:59
  • 1
    The answer probably is: If your tools are not able to create/reproduce the correct license file and/or attribution notices, then you might have to do it manually. The requirements MIT license are not difficult to understand. If the licensor (here: MSFT) is not complying with the redistribution requirements of the license, then that's tough luck, because the owner of the copyright is not bound by the license under which (s)he publishes the code. Commented Jul 3 at 17:08

1 Answer 1


If we take the text of the MIT license (and many other OSS licenses) completely literally, then SPDX expressions and even web-links to the license text are completely useless, because the license stipulates that the software must be accompanied by a copy of the license text.

On the other hand, if we can look at the purpose of an open-source license and why it should be included in re-distributions.

Open-source licenses give downstream recipients certain rights that go beyond what is granted by default in copyright law. Exercising those additional rights may also involve having to comply with specific conditions, the most widespread of which is that you cannot pretend all the work was yours when you re-used something form someone else (usually codified by the requirement to keep copyright notices intact). The reason to require the inclusion of the license on re-distribution is to ensure that all recipients are informed about their rights and obligations.

For a long time, including the actual license text was the only reasonable and reliable way to make sure the recipients would know their rights and obligations and a lot of the open-source licenses date back to that era. In the current day and age, an SPDX expression or a weblink to a canonical copy of a license seems to be just as good in informing recipients about their rights and obligations.

Also, looking at it from a third angle, the only people who have legal standing to take action for license infringement by failing to include a copy of it, are the copyright holders themselves. If they started with the practice of using only a SPDX expression instead of including the actual license text in their distribution, that makes their case a lot weaker when taking legal action (even though they themselves are not bound by the license terms).

  • 1
    Thank you. This is a very useful measured perspective. (By the by and unrelated: it won't help me, because the attribution report I have to prepare, and that got me to this, will be checked by a bunch of lawyers and they, as far as I can tell so far, don't have a measured perspective. 🤷 )
    – Martin Ba
    Commented Jul 5 at 6:33
  • @MartinBa, note that the copyright information you are probably supposed to reproduce for that package is also in the package metadata, in the <copyright> field. Commented Jul 5 at 6:41
  • 1
    Yeah, but unfortunately MS "decided" that the copyright string in the nuspec is different from the one in the github license file :-D
    – Martin Ba
    Commented Jul 5 at 9:10
  • Note that SPDX identifiers do not include the attribution notices which are required by basically every license other than public-domain equivalents like the WTFPL. So you still have to include those separately by some means, and since that can potentially be a significant amount of text if multiple notices are required, you may as well include the whole license for reasons of legal certainty.
    – Kevin
    Commented Jul 7 at 1:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.