What is the meaning of two licenses in a maven pom?

Question

Maven allows several licenses in its license block e.g.

<licenses>
   <license>
     <name>GPL-3.0</name>
   </license>
   <license>
     <name> Beerware</name>
   </license>
</licenses>

Does mean :

• the user can choose ? (or)
• has to follow both licenses ? (and)
• it is not defined by maven ?

Update: The answers so far confirm my suspicion that

* maven does not define a semantic
* most people setting 2 licenses also do not know really what it implies
* most people using such a dependency will pick and choose (i.e. 'or')
* the defensive approach would be to assume 'and' as user of such dependency

In effect it means that a licenses block with more than one license is so unclear that the user of such artifact better look elsewhere for license information (e.g. the source, web pages)

Update 2: After looking at many artifacts that either use 2 license blocks in a pom or directly declare "lisense1 and license2" I must conclude that always a logical 'or' is meant. When 'and' is used then in the same way people say "I bought apples and oranges"

I have yet to find project were the logical "and" was meant and made sense.

Answer 1

Maven allows several licenses in its <licenses> block and its meaning is defined as a choice as @Tordanik explained here correctly. (This not undefined as I originally mentioned):

If multiple licenses are listed, it is assumed that the user can select any of them, not that they must accept all.

Yet, this is not something that is explicit and obvious, therefore I would not rely on the author having read this. Hence, the only prudent approach is to consider that all licenses likely apply, at least if you consider ONLY the POM data to get license information.

Now the recourse to fix this would include:

1. for you: you can scan the code for actual license terms, ideally both the sources and binaries. This way you may be will find out more about the licensing and determine which licenses apply and how. You can use the scancode tools for this. See https://github.com/nexB/scancode-toolkit

2. for the upstream author: Using SPDX license expressions in the POM would allow to express clearly what the licensing is. This would mean using only a single <license> in the POM. These are example of such expressions:

MIT or GPL-2.0+
LGPL-2.1 AND BSD-3-Clause

See Appendix IV: SPDX License Expressions in http://spdx.org/sites/spdx/files/SPDX-2.0.pdf#page=80&zoom=auto,-46,28 for details.

SPDX license ids and expressions are supported in NPM and RubyGems for instance and a few other package managers.

(Disclaimer: I am a co-founder of SPDX and a co-author of ScanCode)

Answer 2

The Maven site provides a definition in the project descriptor reference (emphasis mine):

This element describes all of the licenses for this project. Each license is described by a license element, which is then described by additional elements. Projects should only list the license(s) that applies to the project and not the licenses that apply to dependencies. If multiple licenses are listed, it is assumed that the user can select any of them, not that they must accept all.

So the intention is to express an OR constraint, i.e. the user can choose. Of course, it may still be prudent to have a look at the actual license terms in addition to the pom, as suggested by other responses.

Answer 3

It's not explicitly defined by Maven anywhere I can find. In practice, however, I would expect it to be an OR constraint. AND constraints are very difficult to follow entirely correctly with many licenses, due to the myriad incompatibilities between each license.

For example, if I specify both CC BY (which is a terrible idea for code) and GPL in my licenses section, then it's unclear what people will be able to do with it. CC BY is incompatible with the GPL, because CC BY requires that the work is available for commercial and closed-source use, while the GPL mandates that the resulting work be open-source. An AND constraint on these two licenses would be legally messy because of that, and would likely see the project not used for fear of legal issues.

An OR constraint, on the other hand, is fine - again using CC BY and GPL, anyone who wants to use my software can choose which license they want to follow. Followers of the free software movement will likely choose the GPL; people who just need the software to develop on will likely choose CC BY.