SPDX - How to handle MIT and BSD

[Miroslav Suchý]

MIT and BSD are very common licenses and can be tricky to convert to SPDX license
identifiers. Just today, I got two 
questions about it. We have this covered in FAQ

https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1#I_have_a_pac...

But still, it can be confusing. So let me explain more verbosely than we have in the FAQ.


You have a package that is licensed under the "MIT" license. So you run


```

$ license-fedora2spdx *'*MIT*'*

Warning: more options how to interpret MIT. Possible options: ['mpich2',
'libtiff', 'SMLNJ', 'SGI-B-2.0', 'NTP', 'MIT', 
'MIT-open-group', 'MIT-feh', 'MIT-enna',
'MIT-Modern-Variant', 'MIT-CMU', 'ICU', 'HPND',
'BSL-1.0', 'Adobe-Glyph']

Adobe-Glyph

```


Can you choose any license from the output? No. Definitely no.


You can take the result of this tool only when there is no warning. E.g.:


```

$ license-fedora2spdx 'GPLv2'
GPL-2.0-only

```


Until now, what Fedora described as an "MIT" license was, in fact, a whole
family of licenses. SPDX identify them 
differently. And the differences can be subtle. E.g., compare

  * https://spdx.org/licenses/MIT.html
  * https://spdx.org/licenses/MIT-feh.html
  * https://spdx.org/licenses/MIT-open-group.html

If your old Fedora license was MIT, there is a very high chance that the new one will be
MIT too. But it is far from 
being 100 % sure. There are 14 other options. These that `license-fedora2spdx` listed in
the warning above.

Similarly, for BSD. BSD also identified the whole family. You likely end up with
"BSD-2-Clause" or "BSD-3-Clause", but 
there are two different options as well.


There are two common ways to find out what SPDX identifier you should use in such cases.


1) You can use https://github.com/spdx/spdx-license-diff and use it to identify your
license. This is a Chrome and 
Firefox plugin and allows you to select the text; and in the context menu, you can choose
to identify the license. It 
will print, e.g., that it matches 60% of the MIT-feh license and highlight the difference.
Or...


2) you can navigate to

https://docs.fedoraproject.org/en-US/legal/allowed-licenses/

in the search box above the first table, you enter your license and filter the content. If
you enter "MIT", it will find 
you 26 licenses. Out of them, 15 have "MIT" in the "Fedora
abbreviation" column (Hmm, this should be changed to "legacy 
name"). Now you have to open the link in the "URL" column and find your
package's license. This may look painful, but 
you usually find the correct license within a few clicks.


Miroslav