Is an SDPX header legally equivalent to a license header?

Question

I consider to use SDPX headers in stead of the full license headers in my code. However, I wonder whether this is actually legally equivalent.

So, for context, this is the SDPX license list: https://spdx.org/licenses/

The header of my code would then not look like this:

# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements.  See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership.  The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License.  You may obtain a copy of the License at
# 
#  http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied.  See the License for the
# specific language governing permissions and limitations
# under the License.

but like this:

# SPDX-License-Identifier: Apache-2.0

I can't really find anything on the web page of SDPX on this. The license header is pretty obvious in stating the main terms and conditions of the license, in a human readable way, while SDPX defines a key one can use to refer to a license, but then you have to know the convention.

So I could imagine they may be legally different. I know there is no such thing as international copyright law, but it would be useful to have an idea why those are or are not equivalent and what typically differences would be. Would there?

Of course, this is all apart from having a LICENSE file shipped with the code, and probably other requirements that are put on my code if I want to correctly use SPDX.

Answer 1

First off: Legally, everything is copyrighted anyway. Licensing is not at all necessary. Hence, even if a court would disagree with # SPDX-License-Identifier: Apache-2.0, that would just make it closed source.

Having said that, the law generally doesn't bother with trivialities such as "file headers". Any commonly accepted way to state the copyright and license terms is OK. Your LICENSE is such a common convention. If you want to avoid all doubt what is covered under that license, put a reference to that LICENSE in each header. If you have just five files in one directory that are all licensed the same, I wouldn't even bother with that. Again, the default position is that everything is closed source.

Answer 2

If you want a set of files to be compliant with SPDX, you must follow the SPDX Specification. This requires that certain elements are present, and permits others. It requires that the file have certain properties, for example (spec item 1.7.1) that it must be human-readable. If you do not comply with the specification, what you have is not an SPDX document. According to specification item 2.2 a "DataLicense: CC0-1.0" tag is required to make the metadata freely usable and copyable. Other license tags appear to be permitted but optional, if I am reading the spec correctly.

There is no general requirement that you use a license designation such as the one quoted in the quotation, and I do not see any such requirement in the SPDX spec. The exact license quoted is one granted by Apache, so you would not use that in any case.

However, if you want the code to in fact be available under the terms of the Apache 2.o license, you must follow the procedures of that license. These read:

To apply the ALv2 to a new software distribution, include one copy of the license text by copying the contents of LICENSE-2.0.txt into a file called LICENSE in the top directory of your distribution. If the distribution is a jar or tar file, try to add the LICENSE file first in order to place it at the top of the archive. This covers the collective licensing for the distribution.

In addition, you must include a correct NOTICE file in the same directory as the LICENSE file.

Each original source document (code and documentation, but not the LICENSE and NOTICE files) should include a short license header at the top. If the distribution contains documents not covered by an ICLA, CCLA or Software Grant (such as third-party libraries), consult the policy guide.

If you do not comply with these requirements, others using the Apache 2.0 license may not consider your distribution to be compatible, and may decline to link to it or accept it.