What this license is
An SPDX expression joins licenses with operators, and the operator changes everything. OR means you pick one arm and follow it. AND means every arm binds you at once. WITH attaches an exception to a base license. A trailing plus, or the newer or-later form, means that version of the license or any later one. Almost the whole crates.io ecosystem is MIT OR Apache-2.0, Rust itself included. Perl itself and most of CPAN are Artistic-1.0-Perl OR GPL-1.0-or-later, and Qt and MySQL use an open arm alongside a commercial one.
Why it matters for your product
With an OR the choice is yours, not the author's, and you can choose differently in a different product. Picking Apache-2.0 over MIT gets you an express patent grant, which is why most Rust shops pick it. The GPL arm of Qt or MySQL is often workable for a hosted service and rarely workable for a vendor shipping binaries. That is exactly why the commercial arm exists. Record the expression instead of an arm, and your attestation page claims duties nobody accepted while hiding the ones that actually apply.
You are meeting the terms when
- You have elected one arm of an OR and recorded it, rather than storing the whole expression as though it were the license.
- You follow the arm you picked, and that one only. Cherry-picking clauses across arms is not an option any of these licenses offers.
- You follow every arm at once when the operator is AND, which in practice means the strictest terms in the expression win.
- You have looked at what an AND arm quietly adds. An expression like (MIT OR Apache-2.0) AND Unicode-3.0 carries a third license most reviewers skim past.
- You elect again when the same package turns up in a different product with different constraints. The election belongs to the product, not to the package.
Where teams get it wrong
- Teams read MIT OR Apache-2.0 as MIT because MIT is the first token. It is a choice, and Apache-2.0 is the arm that carries the express patent grant.
- Teams record the whole expression instead of an arm. The public page then lists duties nobody accepted and leaves out the ones that apply.
- Teams treat an AND like an OR. An AND never collapses into a single license, no matter how similar the two arms look on the page.
- Teams elect once and forget. A new product, or a change from a hosted service to a shipped binary, can make the other arm the right one.
How SourceTrust handles this license
SourceTrust reads the declared expression. When it is a flat OR over at most three plain licenses, it builds one arm per license and asks a reviewer to elect one. Approval is blocked while that election is pending, so an OR package cannot slip through as whichever arm happened to come first. Anything harder is deliberately left alone: a nested or mixed expression, an OR with four or more arms, a WITH, or a LicenseRef is classified as unsafe and reaches a person untouched. A flat AND is never collapsed into one license. Read Reviewing a component.
- The elected arm is what drives the component's obligations, its checklist items, and the license your attestation page shows for that dependency.
- Changing an election that was already confirmed resets the component to needs review and clears its external obligation checkmarks, so the record stays honest.
- Both arms keep their own text on the component, so the one you did not pick is still there when somebody asks why you picked the other.