An exception loosens a license, never tightens it. GPL-2.0-only WITH Classpath-exception-2.0 is the GPL without the linking problem.
On this page
What it does
An exception is a rider that the copyright holders attach to a base license to remove one of its restrictions. It can only give you more room, never less. Four of them cover almost everything you will meet. Classpath-exception-2.0 on GPL-2.0-only is the OpenJDK license: you may link your own code against the class library without your code becoming GPL. LLVM-exception on Apache-2.0 covers the LLVM toolchain and Rust's compiler-builtins crate. GCC-exception-3.1 does the same job for code that GCC emits, and Autoconf-exception covers generated configure scripts.
Details
If you see GPL-2.0-only WITH Classpath-exception-2.0 on a JDK dependency, the practical answer is that it does not make your application GPL. That is the entire reason the exception exists. It is worth saying plainly, because a bare GPL label on a JDK frightens people who have been told to avoid the GPL. The same goes for code built on LLVM and for anything compiled with GCC. The risk runs the other way: drop the exception from your records, and a routine dependency starts reading as a strong copyleft problem it is not.
Pros
- Naming the situation (no license, dual license, exception, custom text) is better than forcing a nearby SPDX id.
- Once the files are read, the rest of the review looks like any other component.
Cons
- Auto-fetch and SPDX matching will not finish this for you. A person has to read what shipped.
- Wrong SPDX on a dual-license or LicenseRef package is a common attestation error.
What it allows and requires
Choose a category to see the full grant in one scannable list. Permissions show what the license allows, limits show what it withholds, and obligations show the conditions your release process must satisfy.
Permissions
Exception grant
An SPDX WITH exception adds or removes a condition on top of the base license, often to allow linking that the base license would block.
Limits
Ignore the exception
The exception is part of the effective license. Dropping it in your record makes the remaining grant look stricter or looser than it is.
Obligations
Keep both ids
Record the base SPDX id and the exception id together (GPL-2.0-only WITH Classpath-exception-2.0). Both belong on the page.
What spdx-exceptions requires when you ship
spdx-exceptions is a situation more than a standard grant. Read what is actually on the component, then record that, rather than hoping a nearby SPDX id covers it. The steps below are how to keep the record tied to the text you actually have.
You record the full expression, base and exception together. Dropping the exception overstates your duties, and dropping the base understates them.
You rely on the exception only as far as its own text reaches. The base license still governs everything the exception does not touch.
You do not carry an exception from one project onto another project's code. It is granted by that project's copyright holders, for that project.
You have checked that your SBOM output still carries the WITH clause. An export that says GPL-2.0-only alone turns a harmless JDK dependency into a red flag in someone else's review.
The duties named in spdx-exceptions
There is no standard grant to scan. Record the identifier and the text that is actually on the component, then treat nearby SPDX ids as other pages, not as substitutes.
Keep both ids
Record the base SPDX id and the exception id together (GPL-2.0-only WITH Classpath-exception-2.0). Both belong on the page.
Things to be aware of
- An SBOM records GPL-2.0-only and drops WITH Classpath-exception-2.0. A routine JDK dependency then reads as a strong copyleft problem it is not.
- Someone assumes an exception can add a restriction. It cannot. Text that adds a condition is a modification of the license, not an exception to it.
- Someone treats any text appended after a license as an exception. An unrecognised addition is a modification, and it changes the terms you are working under.
What the License exceptions (WITH expressions) does not do
Search results often flatten License exceptions (WITH expressions) into a slogan. These are the usual misreads. spdx-exceptions is a grant with conditions, not a permission to skip the paperwork below.
- an SPDX license with an exception is not a single SPDX license with one obligations checklist. Treat the actual files as the source of truth.
- It does not let you skip recording what is in the package. Buyers still want the situation named.
How spdx-exceptions differs from nearby licenses
These licenses are often confused with spdx-exceptions, but their release duties differ. Each row summarizes what the license requires when you ship. Open the linked page for the full checklist.
- spdx-exceptions
- An exception loosens a license, never tightens it. GPL-2.0-only WITH Classpath-exception-2.0 is the GPL without the linking problem.
- GPL-2.0-or-later
- GPL-2.0 asks for source when you hand someone a binary. Running it on your own servers triggers nothing. The trigger is shipping a copy, not merely using it.
- Apache-2.0
- Permissive like MIT, plus an express patent grant. The catch is the NOTICE file: it has to travel inside the binaries you ship.
- dual-license
- One package, more than one license. OR means you choose an arm and follow that one. AND means every arm binds you at the same time.
Common questions about License exceptions (WITH expressions)
Answers to common questions about what License exceptions (WITH expressions) requires, when its duties apply, and what evidence belongs with a release.
What is the License exceptions (WITH expressions)?
An exception is a rider that the copyright holders attach to a base license to remove one of its restrictions. It can only give you more room, never less. Four of them cover almost everything you will meet. Classpath-exception-2.0 on GPL-2.0-only is the OpenJDK license: you may link your own code against the class library without your code becoming GPL. LLVM-exception on Apache-2.0 covers the LLVM toolchain and Rust's compiler-builtins crate. GCC-exception-3.1 does the same job for code that GCC emits, and Autoconf-exception covers generated configure scripts.
What does spdx-exceptions require when you ship a product?
You record the full expression, base and exception together. Dropping the exception overstates your duties, and dropping the base understates them. You rely on the exception only as far as its own text reaches. The base license still governs everything the exception does not touch. You do not carry an exception from one project onto another project's code. It is granted by that project's copyright holders, for that project. You have checked that your SBOM output still carries the WITH clause. An export that says GPL-2.0-only alone turns a harmless JDK dependency into a red flag in someone else's review.
Why does spdx-exceptions sit under special cases?
spdx-exceptions is a situation rather than a standard public grant: no license, a choice between licenses, an exception, a custom identifier, or a text that fits none of the families above. Each one is decided by reading what is actually there.
How is spdx-exceptions different from GNU GPL v2.0 or later?
spdx-exceptions asks this: An exception loosens a license, never tightens it. GPL-2.0-only WITH Classpath-exception-2.0 is the GPL without the linking problem. GNU GPL v2.0 or later asks this: GPL-2.0 asks for source when you hand someone a binary. Running it on your own servers triggers nothing. The trigger is shipping a copy, not merely using it. Open the GNU GPL v2.0 or later page for what that license requires when you ship. Do not treat the SPDX ids as interchangeable because the short names look similar.
Where do I record spdx-exceptions for a buyer?
The expression parser treats WITH as a first-class operator, so GPL-2.0-only WITH Classpath-exception-2.0 is kept whole rather than reduced to its base. The text arbiter is taught that a recognised exception appended to a base license is a standard WITH construction and not a package modification. It names Classpath-exception-2.0, LLVM-exception, GCC-exception-3.1 and Autoconf-exception-3.0 explicitly. Any compound expression containing a WITH is classified as unsafe, so it is never flattened and always reaches a person.
Where do I record spdx-exceptions for a buyer?
The expression parser treats WITH as a first-class operator, so GPL-2.0-only WITH Classpath-exception-2.0 is kept whole rather than reduced to its base. The text arbiter is taught that a recognised exception appended to a base license is a standard WITH construction and not a package modification.
It names Classpath-exception-2.0, LLVM-exception, GCC-exception-3.1 and Autoconf-exception-3.0 explicitly. Any compound expression containing a WITH is classified as unsafe, so it is never flattened and always reaches a person.
Read /docs/auto-fetch-license.
- The base license still drives the checklist. A GPL base is copyleft, so a source offer item appears on projects that ship binaries or run a mixed deployment.
- The text stored on the component is what your attestation page and export files carry. Attach the copy that includes the exception, not a bare base license.
See also
The hub is the pillar for this cluster. Sibling licenses are the other spokes. Product FAQ links explain how SourceTrust records the duty, not the license text itself.
Practical guidance for procurement review, not legal advice. Confirm high-stakes use with counsel.