8

Maven allows several licenses in its license block e.g.

<licenses>
   <license>
     <name>GPL-3.0</name>
   </license>
   <license>
     <name> Beerware</name>
   </license>
</licenses>

Does mean :

  • the user can choose ? (or)
  • has to follow both licenses ? (and)
  • it is not defined by maven ?

Update: The answers so far confirm my suspicion that

* maven does not define a semantic
* most people setting 2 licenses also do not know really what it implies
* most people using such a dependency will pick and choose (i.e. 'or')
* the defensive approach would be to assume 'and' as user of such dependency

In effect it means that a licenses block with more than one license is so unclear that the user of such artifact better look elsewhere for license information (e.g. the source, web pages)

Update 2: After looking at many artifacts that either use 2 license blocks in a pom or directly declare "lisense1 and license2" I must conclude that always a logical 'or' is meant. When 'and' is used then in the same way people say "I bought apples and oranges"

I have yet to find project were the logical "and" was meant and made sense.

5

Maven allows several licenses in its <licenses> block and its meaning is not defined.

The only prudent approach is to consider that all licenses apply, at least if you consider ONLY the POM data to get license information.

Now the recourse to fix this would include:

  1. for you: you can scan the code for actual license terms, ideally both the sources and binaries. This way you may be will find out more about the licensing and determine which licenses apply and how. You can use the scancode tools for this. See https://github.com/nexB/scancode-toolkit

  2. for the upstream author: Using SPDX license expressions in the POM would allow to express clearly what the licensing is. This would mean using only a single <license> in the POM. These are example of such expressions: MIT or GPL-2.0+ LGPL-2.1 AND BSD-3-Clause

See Appendix IV: SPDX License Expressions in http://spdx.org/sites/spdx/files/SPDX-2.0.pdf#page=80&zoom=auto,-46,28 for details.

SPDX license ids and expressions are supported in NPM and RubyGems for instance and a few other package managers.

(Disclaimer: I am a co-founder of SPDX and a co-author of ScanCode)

  • I am aware and thankful for SPDX, but almost nobody is using it yet in poms. Also I found already a pom with a spdx 'and' which really was supposed to be an 'or', i.e. epl-2.0 and lgpl2.1 but the webpage says it is either or. – openCage May 29 '16 at 4:56
  • 2
    there should be some reaching out to the Maven devs (and more likely to the maintainers of Maven Central) to introduce the soft enforcement of SPDX checks, may be? – Philippe Ombredanne May 29 '16 at 12:01
3

It's not explicitly defined by Maven anywhere I can find. In practice, however, I would expect it to be an OR constraint. AND constraints are very difficult to follow entirely correctly with many licenses, due to the myriad incompatibilities between each license.

For example, if I specify both CC BY (which is a terrible idea for code) and GPL in my licenses section, then it's unclear what people will be able to do with it. CC BY is incompatible with the GPL, because CC BY requires that the work is available for commercial and closed-source use, while the GPL mandates that the resulting work be open-source. An AND constraint on these two licenses would be legally messy because of that, and would likely see the project not used for fear of legal issues.

An OR constraint, on the other hand, is fine - again using CC BY and GPL, anyone who wants to use my software can choose which license they want to follow. Followers of the free software movement will likely choose the GPL; people who just need the software to develop on will likely choose CC BY.

  • Most people will likely choose nothing, just using it with the motto: "It will go well somehow" ;-) – Quasimodo's clone May 20 '16 at 9:27
  • The only prudent assumption is to consider this to a conjunction of licenses, not an OR. A choice (an OR) may be correct in a few cases. The AND will always be correct (and the license compatibility is another topic) – Philippe Ombredanne May 20 '16 at 13:35
2

The Maven site provides a definition in the project descriptor reference (emphasis mine):

This element describes all of the licenses for this project. Each license is described by a license element, which is then described by additional elements. Projects should only list the license(s) that applies to the project and not the licenses that apply to dependencies. If multiple licenses are listed, it is assumed that the user can select any of them, not that they must accept all.

So the intention is to express an OR constraint, i.e. the user can choose. Of course, it may still be prudent to have a look at the actual license terms in addition to the pom, as suggested by other responses.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.