Handling of SPDX 3 *-only and *-or-later

[Kyle E. Mitchell]

@jinwoo, there is an issue to contend with for the new, SPDX-3-compatible version of this package.

@goneall, I've read through some of the SPDX minutes, but couldn't quite pick out: Is GPL-2.0-only semantically equivalent to GPL-2.0? Is GPL-2.0-or-later semantically equivalent to GPL-2.0+?

[Jinwoo Lee]

Does this block publishing v3.0.0?

[Kyle E. Mitchell]

I think so. If we don't know how to handle *-only and *-or-later identifiers, the right thing to do is still to throw.

[Jinwoo Lee]

If spdx-satisfies will throw for those identifiers, I think spdx-correct must also be updated so that those identifiers are not resulted from spdxCorrect('some-id'). E.g. spdxCorrect('LGLP3') will return 'LGPL-3.0-or-later', and spdxSatisfies('LGPL-3.0-or-later') will throw, which is why I originally created the issue, #2.

[Kyle E. Mitchell]

spdx-correct has been updated.

[Jinwoo Lee]

What I meant was that the new version of spdx-correct returns 'LGPL-3.0-or-later' for 'LGPL3'. If you make spdx-satisfies throw for *-only and *-or-later identifiers, many corrected identifiers will make spdx-satisfies throw.

[Gary O'Neall]

@goneall <https://github.com/goneall> , I've read through some of the SPDX minutes, but couldn't quite pick out: Is GPL-2.0-only semantically equivalent to GPL-2.0? Is GPL-2.0-or-later semantically equivalent to GPL-2.0+? The title of the GPL-2.0 license on the SPDX 2.6 license list is “GNU General Public License v2.0 only”. Based on the title, you could interpret GPL-2.0-only semantically equivalent to GPL-2.0. One of the drivers for making the change is the identifier did not make this clear Due to this lack of clarity there are likely some uses where the GPL-2.0 identifier is used in a situation where the or later version of the license (e.g. GPL-2.0+ or GPL-2.0-or-later) should have been specified.

[Kyle E. Mitchell]

@jinwoo, yes, different versions are inconsistent as to which identifiers are valid. Some packages, like the parser, could go ahead based just on the new license list. Other packages with more semantics, like spdx-satisfied, wait on clarifications like the one @goneall was just kind enough to provide.

[Kyle E. Mitchell]

#5 resolves.

[Jinwoo Lee]

Thanks again, @kemitchell , for quickly fixing the issues and publishing a new NPM!

[Kyle E. Mitchell]

@jinwoo, I'll invite you to the org, with edit perms. Feel free to open pull requests to do what needs doing. If in doubt, just @-mention me or another member of the org.

[Jinwoo Lee]

Thanks for the invite. Joined just now.