OSI Adopts SPDX IDs for License URLs

[nickvidal]

Hello all,

We know that this has been a long standing issue, but the OSI has finally adopted SPDX ids in URLs.

We did our best to follow this pattern*:

https://opensource.org/license/{SPDX ID}

* Please note that, while SPDX license identifiers include dots (for example, Apache-2.0), our website URLs use a hyphenated form for compatibility with our current publishing platform. Requests using the dotted SPDX form will continue to work and are automatically redirected, while the SPDX identifier itself is preserved in metadata and API responses.

To support the transition to SPDX-based identifiers while preserving long-standing links, we standardized license URLs and implemented redirects from legacy formats. The table below summarizes the types of changes applied across the OSI website.

License Name	URL ID (OLD)	SPDX ID
Zero-Clause BSD	0bsd	0BSD
Attribution Assurance License	attribution-php	AAL
Academic Free License v. 3.0	afl-3-0-php	AFL-3.0
GNU Affero General Public License version 3	agpl-v3	AGPL-3.0
Apache Software License, version 1.1	apache-1-1	Apache-1.1
Apache License, Version 2.0	apache-2-0	Apache-2.0
Adaptive Public License 1.0	apl1-0-php	APL-1.0
Apple Public Source License 2.0	apsl-2-0	APSL-2.0
Artistic License 1.0	artistic-1-0	Artistic-1.0
Artistic License (Perl) 1.0	artistic-perl-1-0-2	Artistic-1.0-Perl
Artistic License 2.0	artistic-2-0	Artistic-2.0
Blue Oak Model License	blue-oak-model-license	BlueOak-1.0.0
1-clause BSD License	bsd-1-clause	BSD-1-Clause
The 2-Clause BSD License	bsd-2-clause	BSD-2-Clause
BSD+Patent	bsdpluspatent	BSD-2-Clause-Patent
The 3-Clause BSD License	bsd-3-clause	BSD-3-Clause
Lawrence Berkeley National Labs BSD Variant License	bsd-3-clause-lbnl	BSD-3-Clause-LBNL
BSD-3-Clause-Open-MPI	bsd-3-clause-open-mpi	BSD-3-Clause-Open-MPI
Boost Software License 1.0	bsl-1-0	BSL-1.0
Cryptographic Autonomy License	cal-1-0	CAL-1.0
Computer Associates Trusted Open Source License 1.1	ca-tosl1-1-php	CATOSL-1.1
Common Development and Distribution License 1.0	cddl-1-0	CDDL-1.0
COMMON DEVELOPMENT AND DISTRIBUTION LICENSE (CDDL)	cddl-1-1	CDDL-1.1
Cea Cnrs Inria Logiciel Libre License, version 2.1	cecill-2-1	CECILL-2.1
CERN Open Hardware Licence Version 2 – Permissive	cern-ohl-p	CERN-OHL-P-2.0
CERN Open Hardware Licence Version 2 – Strongly Reciprocal	cern-ohl-s	CERN-OHL-S-2.0
CERN Open Hardware Licence Version 2 – Weakly Reciprocal	cern-ohl-w	CERN-OHL-W-2.0
The CNRI portion of the multi-part Python License	cnri-python	CNRI-Python
Common Public Attribution License Version 1.0	cpal-1-0	CPAL-1.0
Common Public License Version 1.0	cpl1-0-txt	CPL-1.0
CUA Office Public License	cuaoffice-php	CUA-OPL-1.0
Educational Community License, Version 1.0	ecl-1-0	ECL-1.0
Educational Community License, Version 2.0	ecl-2-0	ECL-2.0
eCos License version 2.0	ecos-2-0	eCos-2.0
Eiffel Forum License, version 1	efl-1-0	EFL-1.0
Eiffel Forum License, Version 2	ver2_eiffel-php	EFL-2.0
Entessa Public License Version. 1.0	entessa	Entessa
Eclipse Public License -v 1.0	epl-1-0	EPL-1.0
Eclipse Public License version 2.0	epl-2-0	EPL-2.0
EU DataGrid Software License	eudatagrid-php	EUDatagrid
The European Union Public License, version 1.1	eupl-1-1	EUPL-1.1
European Union Public Licence, version 1.2	eupl-1-2	EUPL-1.2
Fair License	fair	Fair
Frameworx License 1.0	frameworx-php	Frameworx-1.0
GNU General Public License, version 1	gpl-1-0	GPL-1.0
GNU General Public License version 2	gpl-2-0	GPL-2.0
GNU General Public License version 3	gpl-3-0	GPL-3.0
Historical Permission Notice and Disclaimer	historical-php	HPND
ICU License	icu-license	ICU
Intel Open Source License	intel	Intel
IPA Font License	ipafont-html	IPA
IBM Public License Version 1.0	ibmpl-php	IPL-1.0
ISC License	isc-license-txt	ISC
JAM License	jam	Jam
GNU Library General Public License version 2	lgpl-2-0	LGPL-2.0
GNU Lesser General Public License version 2.1	lgpl-2-1	LGPL-2.1
GNU Lesser General Public License version 3	lgpl-3-0	LGPL-3.0
Licence Libre du Québec – Permissive version 1.1	liliq-p-1-1	LiLiQ-P-1.1
Licence Libre du Québec – Réciprocité version 1.1	liliq-r-1-1	LiLiQ-R-1.1
Licence Libre du Québec – Réciprocité forte version 1.1	liliq-rplus-1-1	LiLiQ-Rplus-1.1
Lucent Public License, Plan 9, version 1.0	lpl-1-0	LPL-1.0
Lucent Public License Version 1.02	lucent1-02-php	LPL-1.02
LaTeX Project Public License, Version 1.3c	lppl	LPPL-1.3c
MirOS Licence	miros-html	MirOS
The MIT License	mit	MIT
MIT No Attribution License	mit-0	MIT-0
CMU License	cmu-license	MIT-CMU
Motosoto Open Source License	motosoto	Motosoto
Mozilla Public License, version 1.0	mpl-1-0	MPL-1.0
Mozilla Public License 1.1	mpl-1-1	MPL-1.1
Mozilla Public License 2.0	mpl-2-0	MPL-2.0
Microsoft Public License	ms-pl-html	MS-PL
Microsoft Reciprocal License	ms-rl-html	MS-RL
Mulan Permissive Software License v2	mulanpsl-2-0	MulanPSL-2.0
Multics License	multics-txt	Multics
NASA Open Source Agreement v1.3	nasa1-3-php	NASA-1.3
NAUMEN Public License	naumen-php	Naumen
The University of Illinois/NCSA Open Source License	uoi-ncsa-php	NCSA
The Nethack General Public License	nethack	NGPL
Nokia Open Source License Version 1.0a	nokia	NOKIA
Non-Profit Open Software License version 3.0	nposl-3-0	NPOSL-3.0
NTP License	ntp-license-php	NTP
The OCLC Research Public License 2.0 License	oclc2-php	OCLC-2.0
SIL OPEN FONT LICENSE	ofl-1-1	OFL-1.1
Open Group Test Suite License	opengroup-php	OGTSL
OpenLDAP Public License Version 2.8	oldap-2-8	OLDAP-2.8
Open Logistics Foundation License v1.3	olfl-1-3	OLFL-1.3
OSC License 1.0	osc-license-1-0	OSC-1.0
OSET Public License version 2.1	opl-2-1	OSET-PL-2.1
Open Software License, version 1.0	osl-1-0	OSL-1.0
Open Software License 2.1	osl-2-1	OSL-2.1
The Open Software License 3.0	osl-3-0-php	OSL-3.0
PHP License 3.0	php-3-0	PHP-3.0
PHP License 3.01	php-3-01	PHP-3.01
The PostgreSQL License	postgresql	PostgreSQL
Python License, Version 2	PSF-2.0	Python-2.0
The Q Public License Version	qpl-1-0	QPL-1.0
Reciprocal Public License, version 1.1	rpl-1-1	RPL-1.1
Reciprocal Public License 1.5	rpl-1-5	RPL-1.5
RealNetworks Public Source License Version 1.0	real-php	RPSL-1.0
The Ricoh Source Code Public License	ricohpl-php	RSCPL
Simple Public License	simpl-2-0-html	SimPL-2.0
Sun Industry Standards Source License	sissl	SISSL
The Sleepycat License	sleepycat-php	Sleepycat
Sun Public License, Version 1.0	sunpublic-php	SPL-1.0
Upstream Compatibility License v1.0	ucl-1-0	UCL-1.0
UNICODE LICENSE V3	unicode-license-v3	Unicode-3.0
Unicode, Inc. License Agreement – Data Files and Software	unicode-inc-license-agreement-data-files-and-software	Unicode-DFS-2015
The Unlicense	unlicense	Unlicense
The Universal Permissive License Version 1.0	upl	UPL-1.0
The Vovida Software License v. 1.0	vovidapl-php	VSL-0.1
The W3C® Software and Document license	w3c	W3C-20150513
The Sybase Open Source Licence	sybase-php	Watcom-1.0
WordNet	wordnet	WordNet
The wxWindows Library Licence	wxwindows-php	wxWindows
The X.Net, Inc. License	xnet	Xnet
The zlib/libpng License	zlib	Zlib
Zope Public License 2.0	zpl-2-0	ZPL-2.0
Zope Public License 2.1	zpl-2-1	ZPL-2.1
Jabber Open Source License	jabberpl-php
Los Alamos National Labs BSD-3 Variant	los-alamos-national-labs-bsd-3-variant
MITRE Collaborative Virtual Workspace License	cvw

In addition to updating our website URLs, OSI license data is available through our API, making it easier for developers and organizations to consume authoritative license information directly from OSI.

We welcome feedback from the community. If you spot an issue or have suggestions for further improvements, please let us know.

[nickvidal]

No SPDX identified

• - Jabber Open Source License
• - Los Alamos National Labs BSD-3 Variant
• - MITRE Collaborative Virtual Workspace License

On OSI's list, but not marked as OSI-Approved on SPDX list

• - CDDL-1.1
• - eCos-2.0 (deprecated)
• - MIT-CMU
• - Unicode-DFS-2015 (now listed as Unicode-DFS-2016)
• - wxWindows (deprecated)

[nickvidal]

I looked up all opensource.org URLs displayed on the SPDX website with the [no longer live] warning (200+ total), and I made sure to add the appropriate redirects so that 100% of these URLs now point to the appropriate license.

Ideally, all opensource.org license URLs displayed on the SPDX website should follow this pattern:

https://opensource.org/license/{SPDX ID}

[swinslow]

Hi @nickvidal, thanks very much for this!

Really appreciate OSI's partnership in helping to address these links. If I understand correctly, it sounds like the old links as well as the new SPDX-based ones will remain valid via redirects? That's excellent to hear.

Appreciate the notes here on the handful of differences showing up between the old and new IDs. I'll take a look at these in particular so we can see where the differences should be resolved.

[swinslow]

For the Unicode-DFS-2015 vs. -2016 licenses: I think that OSI may be using the incorrect SPDX identifier here?

At https://opensource.org/license/unicode-dfs-2015, the license called "Unicode, Inc. License Agreement - Data Files and Software" -- from a quick look, it looks to me like this is actually the -2016 variant? See https://spdx.org/licenses/Unicode-DFS-2016.html. I'm not able to run a comparison right this moment, but note that Unicode-DFS-2015 has clauses (a), (b), and (c), while Unicode-DFS-2016 has just (a) and (b). The latter is what appears to be on the OSI site, unless I'm misunderstanding?

[nickvidal]

@swinslow I wasn't sure about that one, but followed your recommendation:

https://opensource.org/license/unicode-dfs-2016

I changed the URL, SPDX id, and redirects.

[mlinksva]

Just curious:

• Please note that, while SPDX license identifiers include dots (for example, Apache-2.0), our website URLs use a hyphenated form for compatibility with our current publishing platform. Requests using the dotted SPDX form will continue to work and are automatically redirected, while the SPDX identifier itself is preserved in metadata and API responses.

Requests using the dotted SPDX form do work, and are not automatically redirected (at this very moment anyway). If they work why/how are the dot-to-dash versions needed for compatibility with the current publishing system?

This is such a good change it's a shame to have this weird wrinkle.

(Congratulations and thanks on the change overall!)

[nickvidal]

Thanks @mlinksva, we should have done this a long time ago, so apologies to everyone.

Requests using the dotted SPDX form do work, and are not automatically redirected

Most are redirected (e.g. https://opensource.org/license/apache-2.0), but I did see some that just works.

WordPress/Pressable folks are looking into it, so we might be able to make it work across all licenses.

[ferdnyc]

Requests using the dotted SPDX form do work, and are not automatically redirected (at this very moment anyway). If they work why/how are the dot-to-dash versions needed for compatibility with the current publishing system?

It's actually really confusing/interesting what happens there. For example, take version 3.0 of the GPL:

• https://opensource.org/license/GPL-3.0-only
  • Redirects to https://opensource.org/license/gpl-3.0-only
• https://opensource.org/license/GPL-3-0-only
  • Does not redirect, loads with that URL
• https://opensource.org/license/gpl-3.0-only
  • Does not redirect, loads with that URL
• https://opensource.org/license/gpl-3-0-only
  • Redirects to https://opensource.org/license/GPL-3-0-only

Whereas, with Apache 2.0:

• https://opensource.org/license/Apache-2.0
  • Redirects to https://opensource.org/license/apache-2-0
• https://opensource.org/license/Apache-2-0
  • Does not redirect, loads with that URL
• https://opensource.org/license/apache-2.0
  • Redirects to https://opensource.org/license/apache-2-0
• https://opensource.org/license/apache-2-0
  • Redirects to https://opensource.org/license/Apache-2-0

That actually hurts my brain. Some of the redirect target URLs (https://opensource.org/license/apache-2-0) will themselves redirect elsewhere if used as an initiating URL!

But, the reason I wanted to bring up the GPL specifically: I notice that OSI is listing all of the GPL versions as "GPL-X.Y-only" (and in fact, URLs like https://opensource.org/license/GPL-3.0-or-later result in a 404 error), but the license text displayed at https://opensource.org/license/GPL-3.0-only has a "How to Apply These Terms..." section that includes the "either version 3 of the License, or (at your option) any later version." text, making it appear to be GPL-3.0-or-later.

(In truth, AIUI the FSF doesn't differentiate between GPL-3.0-only and GPL-3.0-or-later themselves, the difference is in how you choose to apply the license to your work. But in light of that, calling the license "GPL-3.0-only" doesn't appear to be correct... it's either just "GPL-3.0", or it's "GPL-3.0-or-later" (as it allows for the "any later version" stipulation, or it's BOTH.)

[nickvidal]

@mlinksva @ferdnyc : I believe I might have fixed the dotted SPDXs for all licenses. Any dashed SPDXs will be redirected to the dotted ones as well. For example, now https://opensource.org/license/Apache-2-0 redirects to https://opensource.org/license/apache-2.0

I'm checking with Automattic/Pressable if that's a definitive solution.

@ferdnyc : wrt the "GPL-X.Y-only" issue, that's a great question. I'm consulting with the Licensing Committee for their input.