A package manifest can record which terms apply by storing a short identifier instead of pasting the whole license. The same exchange also describes packages, files, and the relationships among them, so the file can serve as a software bill of materials.
The Linux Foundation hosts the specification and the license list. An edition of the specification is the international standard International Standards Organization (ISO)/IEC 5962:2021. The list gives each commonly used license a stable short name, the full name, the license text, and a permanent address. A license that is not on the list can be labeled inside one document with a local name that starts with LicenseRef-.
A source file can carry the same identifier on its own comment line, introduced by SPDX-License-Identifier, so a scanner can read the terms without interpreting the legal text.
How a Short Identifier Names a License
The short name is the value a manifest, a file header, or a bill of materials stores. It does not replace the license text. It points at the text the list already holds.
- Single name: One identifier points at one license text, so a manifest can name the terms without copying them.
- Combined terms: AND means each named license applies. OR means the recipient may pick among the named licenses. WITH adds an exception that the list publishes beside the licenses.
- No license or no claim: NONE states that no license was found for that item. NOASSERTION states that the document does not assert which terms apply.
| Identifier | What it names |
| ISC | The ISC License, a short permissive license from the Internet Systems Consortium. |
| MIT | The MIT License, a short permissive license associated with the Massachusetts Institute of Technology. |
| Apache-2.0 | The Apache License, version 2.0. |
| GPL-2.0-only | Version 2.0 of the GNU General Public License, with no grant to use a later version. |
| GPL-2.0-or-later | Version 2.0 of the GNU General Public License, or any later version. |
Packages, Files, and Relationships
A license identifier answers which terms apply. The rest of the document answers what the software contains and how its parts fit together.
- Package: A package entry can carry the name, version, where the package was obtained, a checksum, the license the document creator concluded, and the license the authors declared.
- File: A file entry can carry a path, a checksum, and the license expression for that file. A snippet can mark a passage inside a file that came from another work.
- Relationship: The document can say which item it describes, which package contains which files, and which file or package was generated from another.
Canonical Spelling in Tools
Each short name has one canonical spelling on the license list. The list still treats a license identifier as the same license when only the letter case changes, and it tells authors to keep the canonical spelling because the license’s address on the list uses that spelling. A tool that compares the characters exactly will miss a differently cased copy.
- Canonical spelling: Store the identifier as the license list prints it. Apache-2.0 is that name. A lowercase or shortened variant is a different string to an exact comparison.
- Operators: AND, OR, and WITH are written in capitals, with a space on each side, and matched case-sensitively.
- Document fields: Labels for fields in an exchange document are case-sensitive. A label that differs only by letter case is not the same field.
