`GPL-2.0-only AND AGPL-3.0-or-later` is not a compatible SPDX license expression

[carmenbianca]

`GPL-2.0-only AND AGPL-3.0-or-later` is not a compatible SPDX license expression

[schiessle]

I agree with the assessment of @carmenbianca, this is also my understanding.

[carmenbianca]

Well, yes and no. After you've removed the last line of code that is GPL-2.0-only, you'd be able to replace all instances of AGPL-3.0-or-later OR GPL-2.0-only with AGPL-3.0-or-later. From that point on, all future code is really truly no longer dual-licensed. Until then, getting rid of GPL-2.0-only seems impossible to me.

But I reiterate that I'm not an expert, neither in licensing compatibility nor in this project.

[AndyScherzinger]

Hi @carmenbianca happy for any insights you can provide since i am unsure if it is wrong or how to do it right.
So #4014 isn't of any help actually bit let me try to explain why I chose GPL-2.0-only AND AGPL-3.0-or-later where #4014 does cover it to some extend. So files haven GPL-2.0-only AND AGPL-3.0-or-later have old code from before the fork which by than has been GPLv2-only while any newly added code in that file from that moment onwards is AGPLv3+. So I choose the above licenses with an AND to reflect that.
According to @schiessle this is fine and basically everything is seen as GPLv2-only until no GPLv2-only lines exist in the file and than only GPLv3+ remains.

So yes, both can't be respected at the same time - GPL2-only wins, yet I need to have a way to state new code is AGPL3+. So would you say that this is then an OR which I doubt since that would mean the GPL2-only- licensed code could be AGPL3+ which it can't.

Looking forward to your feedback

[carmenbianca]

Oof, I'm not entirely certain how to convey that information in an SPDX expression. From the perspective of AGPL-3.0-or-later-licensed code, the OR statement makes perfect sense, but not the other way around.

My non-expert analysis would probably be something like this:

A newly created file is licensed AGPL-3.0-or-later. However, because the whole of the program is licensed under GPL-2.0-only (with which AGPL-3.0-or-later is not compatible), it should be licensed AGPL-3.0-or-later OR GPL-2.0-only, allowing the user to 'fall back' to GPL-2.0.

An old file still containing GPL-2.0-only code sometimes also receives new contributions that are licensed AGPL-3.0-or-later OR GPL-2.0-only. However, this license expression is not correct for the entire file. As such, the license expression should be GPL-2.0-only AND (AGPL-3.0-or-later OR GPL-2.0-only). This collapses to GPL-2.0-only, as intended, but communicates additional semantics.

Something like that? I'm not a licensing compatibility expert, mind.

[AndyScherzinger]

I also have a hard time wrapping my head around it. Also cause when you reach the point where all lines are AGPLv3+ than we would remove any GPLv2 statements. So if you actively put them in again than you also locked that license into the code base and the goal is to get rid of gpl2-only.

Looping in @schiessle for feedback.

[carmenbianca]

In my reading, there is no way to license any code in this project exclusively AGPL-3.0-or-later if it must also be compatible with existing GPL-2.0-only code.

[AndyScherzinger]

I can't tell but I would expect to be able to change a license if all code has been changed. With your argument you would never be able to ever get aways from a GPLv2-only.

[AndyScherzinger]

If the later is the case, yes, than that would be a viable option. Getting rid of GPL2-only before that, yes impossible. I just can't say how to best express that in the license expression, but if GPL-2.0-only AND (AGPL-3.0-or-later OR GPL-2.0-only) reflects that than I can jut take care of getting this change in.

[AndyScherzinger]

PR to correct the headers based on your feedback: #12951

Again thanks for the explanations and clarifications 🙏 Highly appreciated!