Guidelines and HOWTOs/Licensing

This document explains how to state license information in KDE projects according to the KDE Licensing Policy. Stating licenses correctly is a very important task, because only correctly licensed software can be distributed and delivered to our users.

SPDX Expressions and REUSE.software

Every source code file shall contain an information about its license to inform the user of the file how it may be used. Such information are usually added in the form of source code comments at the top of the file. Traditionally, those comments stated so-called license headers, which are either the complete license texts or short texts that explain where to find the license text for the file and a few legal constraints. This system currently is getting replaced with "SPDX Expressions", which also should be the default way to state a license.

Introduction to SPDX Identifiers and Expressions

Software Package Data Exchange® (SPDX) is an open standard for communicating software bill of material information. The SPDX specification is developed by the SPDX workgroup, which is hosted by The Linux Foundation. The idea is to have a public registry of all open source licenses and important license exceptions, such that license statements can be reduced to simply stating the license identifiers.

• https://spdx.org/licenses/index.html
• https://spdx.org/licenses/exceptions-index.html

Yet, not every source code is licensed under just one license. For example, you might want to state that a file can be used under the terms for the BSD-2-Clause license or under the terms of the GNU Public License version 2 or later. For these cases, the SPDX workgroup also provides a specification how state complex license statements (which we call "SPDX expressions"). The SPDX expression language actually allow tooling based syntax checks, which enables us to use tools to check the correctness of license statements.

• https://spdx.org/specifications

SPDX Expression Examples

A SPDX conform license statement is quite simple. It always has the form to first state the copyright holders and then it specifies the license or licenses under which the source code can be used:

/*
 * SPDX-FileCopyrightText: 2019 Jane Doe <[email protected]>
 * SPDX-FileCopyrightText: © 2019 John Doe <[email protected]>
 *
 * SPDX-License-Identifier: LGPL-2.1-or-later
 */

SPDX-FileCopyrightText or Copyright Statement

We follow the recommendations from [reuse.software] how to state copyright information. Any of the following examples is OK:

1. Copyright 2016, 2018-2019 Joe Anybody <[email protected]>
2. Copyright (c) Alice Coder
3. SPDX-FileCopyrightText: 2019 Jane Doe <[email protected]>
4. SPDX-FileCopyrightText: © 2019 John Doe <[email protected]>
5. © Example Corporation <https://corp.example.com>

For copyright statements please ensure the following:

• Prefer "Copyright" or "SPDX-FileCopyrightText:" to state the copyright holders.
• State the copyright information in the order: year, name, contact address.
• Any contact address should be stated in angle brackets.
• The year of publication can be a single year, multiple years, or a span of years.

SPDX-License-Identifier Statement

The SPDX-License-Identifier tag must be followed by a valid SPDX License Expression.

Here are several example statements from the KDE project. For the list of allowed licenses in the KDE project, please see the KDE Licensing Policy:

• SPDX-License-Identifier: LGPL-2.1-or-later
• SPDX-License-Identifier: LGPL-2.1-only OR LGPL-3.0-only OR LicenseRef-KDE-Accepted-LGPL
• SPDX-License-Identifier: LGPL-2.1-only_WITH_Qt-LGPL-exception-1.1
• SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only OR LicenseRef-KDE-Accepted-GPL
• SPDX-License-Identifier: GPL-2.0-or-later
• SPDX-License-Identifier: GPL-3.0-or-later
• SPDX-License-Identifier: MIT
• SPDX-License-Identifier: BSD-2-Clause

Introduction to REUSE.software

TODO

Examples

TODO

License Statement Tooling

TODO