One package, more than one license. OR means you choose an arm and follow that one. AND means every arm binds you at the same time.
On this page
What it does
An SPDX expression joins licenses with operators, and the operator changes everything. OR means you pick one arm and follow it. AND means every arm binds you at once. WITH attaches an exception to a base license. A trailing plus, or the newer or-later form, means that version of the license or any later one. Almost the whole crates.io ecosystem is MIT OR Apache-2.0, Rust itself included. Perl itself and most of CPAN are Artistic-1.0-Perl OR GPL-1.0-or-later, and Qt and MySQL use an open arm alongside a commercial one.
Details
With an OR the choice is yours, not the author's, and you can choose differently in a different product. Picking Apache-2.0 over MIT gets you an express patent grant, which is why most Rust shops pick it. The GPL arm of Qt or MySQL is often workable for a hosted service and rarely workable for a vendor shipping binaries. That is exactly why the commercial arm exists. Record the expression instead of an arm, and your attestation page claims duties nobody accepted while hiding the ones that actually apply.
Pros
- Naming the situation (no license, dual license, exception, custom text) is better than forcing a nearby SPDX id.
- Once the files are read, the rest of the review looks like any other component.
Cons
- Auto-fetch and SPDX matching will not finish this for you. A person has to read what shipped.
- Wrong SPDX on a dual-license or LicenseRef package is a common attestation error.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Pick one grant
Dual licensing lets the recipient choose one of the named licenses and follow that license's terms.
Limits
Mix the grants
You cannot take the permissions of one license and ignore the obligations of the other in the same use. Choose one and keep its conditions.
Obligations
Record the choice
Write down which license you elected for this component. Procurement will ask, and the published page should show it.
What dual-license requires when you ship
dual-license is a situation more than a standard grant. Read what is actually on the component, then record that, rather than hoping a nearby SPDX id covers it. The steps below are how to keep the record tied to the text you actually have.
You have elected one arm of an OR and recorded it, rather than storing the whole expression as though it were the license.
You follow the arm you picked, and that one only. Cherry-picking clauses across arms is not an option any of these licenses offers.
You follow every arm at once when the operator is AND, which in practice means the strictest terms in the expression win.
You have looked at what an AND arm quietly adds. An expression like (MIT OR Apache-2.0) AND Unicode-3.0 carries a third license most reviewers skim past.
You elect again when the same package turns up in a different product with different constraints. The election belongs to the product, not to the package.
The duties named in dual-license
There is no standard grant to scan. Record the identifier and the text that is actually on the component, then treat nearby SPDX ids as other pages, not as substitutes.
Record the choice
Write down which license you elected for this component. Procurement will ask, and the published page should show it.
Things to be aware of
- Teams read MIT OR Apache-2.0 as MIT because MIT is the first token. It is a choice, and Apache-2.0 is the arm that carries the express patent grant.
- Teams record the whole expression instead of an arm. The public page then lists duties nobody accepted and leaves out the ones that apply.
- Teams treat an AND like an OR. An AND never collapses into a single license, no matter how similar the two arms look on the page.
- Teams elect once and forget. A new product, or a change from a hosted service to a shipped binary, can make the other arm the right one.
What the Dual-licensed packages (OR and AND) does not do
Search results often flatten Dual-licensed packages (OR and AND) into a slogan. These are the usual misreads. dual-license is a grant with conditions, not a permission to skip the paperwork below.
- a dual-license choice is not a single SPDX license with one obligations checklist. Treat the actual files as the source of truth.
- It does not let you skip recording what is in the package. Buyers still want the situation named.
How dual-license differs from nearby licenses
These licenses are often confused with dual-license, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- dual-license
- One package, more than one license. OR means you choose an arm and follow that one. AND means every arm binds you at the same time.
- MIT
- MIT lets you ship the code inside a closed, paid product. The one condition is that the copyright line and license text travel with every copy.
- Apache-2.0
- Permissive like MIT, plus an express patent grant. The catch is the NOTICE file: it has to travel inside the binaries you ship.
- spdx-exceptions
- An exception loosens a license, never tightens it. GPL-2.0-only WITH Classpath-exception-2.0 is the GPL without the linking problem.
Common questions about Dual-licensed packages (OR and AND)
Answers to common questions about what Dual-licensed packages (OR and AND) requires, when its duties apply, and what evidence belongs with a release.
What is the Dual-licensed packages (OR and AND)?
An SPDX expression joins licenses with operators, and the operator changes everything. OR means you pick one arm and follow it. AND means every arm binds you at once. WITH attaches an exception to a base license. A trailing plus, or the newer or-later form, means that version of the license or any later one. Almost the whole crates.io ecosystem is MIT OR Apache-2.0, Rust itself included. Perl itself and most of CPAN are Artistic-1.0-Perl OR GPL-1.0-or-later, and Qt and MySQL use an open arm alongside a commercial one.
What does dual-license require when you ship a product?
You have elected one arm of an OR and recorded it, rather than storing the whole expression as though it were the license. You follow the arm you picked, and that one only. Cherry-picking clauses across arms is not an option any of these licenses offers. You follow every arm at once when the operator is AND, which in practice means the strictest terms in the expression win. You have looked at what an AND arm quietly adds. An expression like (MIT OR Apache-2.0) AND Unicode-3.0 carries a third license most reviewers skim past. You elect again when the same package turns up in a different product with different constraints. The election belongs to the product, not to the package.
Why does dual-license sit under special cases?
dual-license is a situation rather than a standard public grant: no license, a choice between licenses, an exception, a custom identifier, or a text that fits none of the families above. Each one is decided by reading what is actually there.
How is dual-license different from MIT License?
dual-license asks this: One package, more than one license. OR means you choose an arm and follow that one. AND means every arm binds you at the same time. MIT License asks this: MIT lets you ship the code inside a closed, paid product. The one condition is that the copyright line and license text travel with every copy. Open the MIT License page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record dual-license for a buyer?
SourceTrust reads the declared expression. When it is a flat OR over at most three plain licenses, it builds one arm per license and asks a reviewer to elect one. Approval is blocked while that election is pending, so an OR package cannot slip through as whichever arm happened to come first. Anything harder is deliberately left alone: a nested or mixed expression, an OR with four or more arms, a WITH, or a LicenseRef is classified as unsafe and reaches a person untouched. A flat AND is never collapsed into one license.
Where do I record dual-license for a buyer?
SourceTrust reads the declared expression. When it is a flat OR over at most three plain licenses, it builds one arm per license and asks a reviewer to elect one.
Approval is blocked while that election is pending, so an OR package cannot slip through as whichever arm happened to come first. Anything harder is deliberately left alone: a nested or mixed expression, an OR with four or more arms, a WITH, or a LicenseRef is classified as unsafe and reaches a person untouched.
A flat AND is never collapsed into one license. Read /docs/reviewing-component.
- The elected arm is what drives the component's obligations, its checklist items, and the license your attestation page shows for that dependency.
- Changing an election that was already confirmed resets the component to needs review and clears its external obligation checkmarks, so the record stays honest.
- Both arms keep their own text on the component, so the one you did not pick is still there when somebody asks why you picked the other.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.