SPDX IDs: How to use

Examples

The examples below are for a language that uses // as its comment delimiter.

// SPDX-License-Identifier: MIT
The file is under the MIT license.
// SPDX-License-Identifier: EPL-1.0+
The file is under the Eclipse Public License version 1.0, or any later version, at the licensee's option.
// SPDX-License-Identifier: GPL-2.0-only
The file is under the GNU General Public License version 2.0.
A special suffix style is used for GNU licenses; see below for details.
// SPDX-License-Identifier: GPL-2.0-or-later
The file is under the GNU General Public License version 2.0, or any later version, at the licensee's option.
A special suffix style is used for GNU licenses; see below for details.
// SPDX-License-Identifier: Apache-2.0 OR MIT
The licensee may choose to use the file under either the Apache-2.0 license or the MIT license.
// SPDX-License-Identifier: Apache-2.0 AND MIT
The file is subject to both the Apache-2.0 license and the MIT license.
The licensee must comply with both licenses when using the file.
// SPDX-License-Identifier: Apache-2.0 AND (MIT OR GPL-2.0-only)
The file is subject to both the Apache-2.0 license, and at the licensee's choice either the MIT license or version 2.0 only of the GPL.
The licensee may choose between MIT and GPL-2.0.
Whichever they choose, they must comply with both that license and Apache-2.0.
// SPDX-License-Identifier: GPL-3.0-only WITH Classpath-exception-2.0
The file is subject to version 3.0 only of the GPL.
The licensee may also optionally apply the Classpath exception, version 2.0.

 

Using expressions like these in your source code and documentation is enough to get started. If you're looking for more details on how IDs work, see below.


 

Format

An SPDX short form identifier is a simple way to state the license that applies to a source code or documentation file.

It consists of the following parts on one line:

  1. [if required] The 'begin comment' characters for the applicable programming language (/*, //, #, ...)
  2. The characters SPDX-License-Identifier: with whitespace following the colon
  3. An SPDX license ID (e.g., Apache-2.0) or SPDX license expression (see below)
  4. [if required] The 'end comment' characters for the applicable programming language (*/, ...)

The format for SPDX identifiers is defined in Appendix V of the SPDX specification, version 2.1.


 

SPDX License Expressions

The simplest way to express the license for a file is with a single license ID (such as Apache-2.0 or GPL-3.0-or-later) from the SPDX License List.

If 2 or more licenses apply to a file, use an SPDX license expression.
It is a composite expression constructed using parentheses, AND / OR operators, and the WITH operator for license exceptions (see below).

Several examples at the top of this page use complex SPDX license expressions.

The format for SPDX license expressions is defined in Appendix IV of the SPDX specification, version 2.1.


 

SPDX License Exceptions

Some licenses are commonly made subject to certain exceptions.

For example, a file can be subject to the GPL version 3.0, but with an additional permission (the "Autoconf Exception version 3.0") allowing certain propagations of the file's output as an exception to some of the GPL's requirements.

A file like this would use the following expression as its short-form identifier:

// SPDX-License-Identifier: GPL-3.0-only WITH Autoconf-exception-3.0

The current list of SPDX license exceptions is available here.


 

Allowing later versions of a license

Some licensors will permit licensees to use the specified version of a license, or any later version of that license.

How to express this depends on whether it is a non-GNU license or a GNU license (such as the GPL, LGPL, AGPL and GFDL).

Non-GNU licenses

For non-GNU licenses, just add the + operator to the end of the license.
For example, the following expression allows recipients to use the file under the Academic Free License v2.0, or any future version of that license:

// SPDX-License-Identifier: AFL-2.0+

GNU licenses

For GNU licenses, do not use just the bare license ID, such as "GPL-2.0".
Instead, always use either the suffix "-only" or the suffix "-or-later" with GNU licenses.

For example, the following expression allows recipients to use the file under the GPL v2.0 only:

// SPDX-License-Identifier: GPL-2.0-only

By contrast, the following expression allows recipients to use the file under the GPL v2.0, or any later version of the GPL published by the FSF:

// SPDX-License-Identifier: GPL-2.0-or-later

To read more about the reasons for this distinction, please see this article by the FSF.
The SPDX Workgroup is very grateful to the FSF for collaborating with us to develop an identifier format that accommodates the GNU licenses' approach to license versioning.


 

Copyright notices

SPDX IDs are intending to express information about licenses. Copyright notices ‐ statements about who owns the copyright in a file or project ‐ are outside the scope of SPDX short-form IDs.

Therefore, you should not remove or modify existing copyright notices in files when adding an SPDX ID.


 

Standard license headers

When a license defines a recommended notice to attach to files under that license (sometimes called a "standard header"), the SPDX project recommends that the standard header be included in the files, in addition to an SPDX ID.

Additionally, when a file already contains a standard header or other license notice, the SPDX project recommends that those existing notices should not be removed. The SPDX ID is recommended to be used to supplement, not replace, existing notices in files.

Like copyright notices, existing license texts and notices should be retained, not replaced ‐ especially a third party's license notices.

The SPDX project's statement regarding standard license headers and SPDX short-form identifiers can be found at Appendix V of the SPDX specification, version 2.1.