Update License Expression Annex

docs/annexes/spdx-license-expressions.md

@@ -6,32 +6,32 @@ Often a single license can be used to represent the licensing terms of a source
 
 SPDX License Expressions provide a way for one to construct expressions that more accurately represent the licensing terms typically found in open source software source code. A license expression could be a single license identifier found on the SPDX License List; a user defined license reference denoted by the `LicenseRef-(idstring)`; a license identifier combined with an SPDX exception; or some combination of license identifiers, license references and exceptions constructed using a small set of defined operators (e.g., `AND`, `OR`, `WITH` and `+`). We provide the definition of what constitutes a valid SPDX License Expression in this section.
 
-The exact syntax of license expressions is described below in ABNF, as defined
+The general format of license expressions is described below in ABNF, as defined
 in [RFC 5234](https://datatracker.ietf.org/doc/rfc5234/) and expanded
 in [RFC 7405](https://datatracker.ietf.org/doc/rfc7405/).
 
-```ANBF
+```ABNF
 idstring = 1*(ALPHA / DIGIT / "-" / "." )
 
 license-id = <short form license identifier from SPDX License List>
 
 license-exception-id = <short form license exception identifier from SPDX License List>
 
-license-ref = [%s"DocumentRef-"(idstring)":"]%s"LicenseRef-"(idstring)
+license-ref = ["DocumentRef-"(idstring)":"]"LicenseRef-"(idstring)
 
-addition-ref = [%s"DocumentRef-"(idstring)":"]%s"AdditionRef-"(idstring)
+addition-ref = ["DocumentRef-"(idstring)":"]"AdditionRef-"(idstring)
 
-simple-expression = license-id / license-id"+" / license-ref
+simple-expression = license-id / license-id"+" / license-ref / "NONE" / "NOASSERTION"
 
 addition-expression = license-exception-id / addition-ref
 
 compound-expression = (simple-expression /
 
-  simple-expression ( %s"WITH" / %s"with" ) addition-expression /
+  simple-expression "WITH" addition-expression /
 
-  compound-expression ( %s"AND" / %s"and" ) compound-expression /
+  compound-expression "AND" compound-expression /
 
-  compound-expression ( %s"OR" / %s"or" ) compound-expression /
+  compound-expression "OR" compound-expression /
 
   "(" compound-expression ")" )
 
@@ -46,48 +46,48 @@ A valid `<license-expression>` string consists of either:
 
 (ii) a more complex expression constructed by combining smaller valid expressions using Boolean license operators.
 
-There MUST NOT be white space between a license-id and any following `+`. This supports easy parsing and backwards compatibility. There MUST be white space on either side of the operator "WITH". There MUST be white space and/or parentheses on either side of the operators `AND` and `OR`.
+There shall not be any space between a license-id and any following `+`. This supports easy parsing and backwards compatibility.
 
-In the `tag:value` format, a license expression MUST be on a single line, and MUST NOT include a line break in the middle of the expression.
+There shall be at least one space on either side of the operators `AND`, `OR`, and "WITH".
+
+A license expression shall be on a single line, and shall not include a line break in the middle of the expression.
 
 ## Case sensitivity
 
-License expression operators (`AND`, `and`, `OR`, `or`, `WITH` and `with`) should be matched in a *case-sensitive* manner, i.e., letters must be all upper case or all lower case.
+In SPDX-3, license expressions are completely *case-insensitive*.
 
-License identifiers (including license exception identifiers) used in SPDX documents or source code files should be matched in a *case-insensitive* manner. In other words, `MIT`, `Mit` and `mIt` should all be treated as the same identifier and referring to the same license.
+That includes the operators (`AND`, `OR`, `WITH`), the special identifiers (`NONE` and `NOASSERTION`), as well as the license identifiers, including the user-defined ones.
 
-However, please be aware that it is often important to match with the case of the canonical identifier on the [SPDX License List](https://spdx.org/licenses). This is because the canonical identifier's case is used in the URL of the license's or exception's entry on the List, and because the canonical identifier is translated to a URI in RDF documents.
+For example, the expressions `MIT AND NOASSERTION AND (BSD-3-Clause OR LicenseRef-Name)` and `mit aNd NoaSSerTion AnD (bSd-3-clausE OR licenseref-NAME)` are equivalent.
 
-For user defined license identifiers, only the variable part (after `LicenseRef-`) is case insensitive.  This means, for example, that `LicenseRef-Name` and `LicenseRef-name` should be treated as the same identifier and considered to refer to the same license, while `licenseref-name` is not a valid license identifier.
+However, please be aware that it is often important to note the case of the canonical identifier on the [SPDX License List](https://spdx.org/licenses). This is because the canonical identifier's case is used in the URL of the license's or exception's entry on the List, and because the canonical identifier is translated to a URI in RDF documents.
 
-The same applies to `AdditionRef-` user defined identifiers.
 
 ## Simple license expressions
 
 A simple `<license-expression>` is composed one of the following:
 
 - An SPDX License List Short Form Identifier. For example: `CDDL-1.0`
 - An SPDX License List Short Form Identifier with a unary "+" operator suffix to represent the current version of the license or any later version. For example: `CDDL-1.0+`
-- An SPDX user defined license reference:
+- One of the special identifiers "NONE" or "NOASSERTION"
+- A user defined license reference:
   `["DocumentRef-"(idstring)":"]"LicenseRef-"(idstring)`.
   For example:
   `LicenseRef-23`,
   `LicenseRef-MIT-Style-1`, and
   `DocumentRef-spdx-tool-1.2:LicenseRef-MIT-Style-2`
 
-The current set of valid license identifiers can be found in [spdx.org/licenses](https://spdx.org/licenses).
+The current set of valid license identifiers can be found in the SPDX License List.
 
 ## Composite license expressions
 
 ### Introduction
 
 More expressive composite license expressions can be constructed using "OR", "AND", and "WITH" operators similar to constructing mathematical expressions using arithmetic operators.
 
-For the `tag:value` format, any license expression that consists of more than one license identifier and/or LicenseRef, may optionally be encapsulated by parentheses: "( )".
+Any license expression that consists of more than one license identifier and/or LicenseRef, may optionally be encapsulated by parentheses: "( )".
 
-Nested parentheses can also be used to specify an order of precedence which is
-discussed in more detail in
-[Order of precedence and parentheses](#order-of-precedence-and-parentheses).
+Nested parentheses can also be used to specify an order of precedence which is discussed in more detail below.
 
 ### Disjunctive "OR" operator
 
@@ -111,11 +111,11 @@ An example representing a choice between three different licenses would be:
 LGPL-2.1-only OR MIT OR BSD-3-Clause
 ```
 
-It is allowed to use the operator in lower case form `or`.
+The special identifiers "NONE" or "NOASSERTION" cannot be used with the OR operator.
 
 ### Conjunctive "AND" operator
 
-If required to simultaneously comply with two or more licenses, use the conjunctive binary "AND" operator to construct a new license expression, where both the left and right operands are a valid license expression values.
+If required to simultaneously comply with two or more licenses, use the conjunctive binary "AND" operator to construct a new license expression, where both the left and right operands are valid license expression values.
 
 For example, when one is required to comply with both the LGPL-2.1-only and MIT licenses, a valid expression would be:
 
@@ -129,13 +129,13 @@ The "AND" operator is commutative, meaning that the above expression should be c
 MIT AND LGPL-2.1-only
 ```
 
-An example where all three different licenses apply would be:
+An example where three different licenses apply would be:
 
 ```text
 LGPL-2.1-only AND MIT AND BSD-2-Clause
 ```
 
-It is allowed to use the operator in lower case form `and`.
+The "AND" operator is the only operator that can be used in conjuction with the special identifiers "NONE" or "NOASSERTION".
 
 ### Additive "WITH" operator
 
@@ -153,7 +153,7 @@ GPL-2.0-or-later WITH Bison-exception-2.2
 
 The current set of valid license exceptions identifiers can be found in [spdx.org/licenses](https://spdx.org/licenses).
 
-It is allowed to use the operator in lower case form `with`.
+The special identifiers "NONE" or "NOASSERTION" cannot be used with the WITH operator.
 
 ### Order of precedence and parentheses
 
@@ -181,79 +181,67 @@ When required to express an order of precedence that is different from the defau
 For instance, the following expression:
 
 ```text
-MIT AND (LGPL-2.1-or-later OR BSD-3-Clause)
+(LGPL-2.1-or-later OR BSD-3-Clause) AND MIT
 ```
 
 states the OR operator should be applied before the AND operator. That is, one should first select between the LGPL-2.1-or-later or the BSD-3-Clause license before applying the MIT license.
 
-### License expressions in RDF
-
-A conjunctive license can be expressed in RDF via a `<spdx:ConjunctiveLicenseSet>` element, with an spdx:member property for each element in the conjunctive license. Two or more members are required.
-
-```XML
-<spdx:ConjunctiveLicenseSet>
-    <spdx:member rdf:resource="http://spdx.org/licenses/GPL-2.0-only"/>
-    <spdx:ExtractedLicensingInfo rdf:about
-      ="http://example.org#LicenseRef-EternalSurrender">
-        <spdx:extractedText>
-            In exchange for using this software, you agree to give
-            its author all your worldly possessions. You will not
-            hold the author liable for all the damage this software
-            will inevitably cause not only to your person and
-            property, but to the entire fabric of the cosmos.
-        </spdx:extractedText>
-        <spdx:licenseId>LicenseRef-EternalSurrender</spdx:licenseId>
-    </spdx:ExtractedLicensingInfo>
-</spdx:ConjunctiveLicenseSet>
-```
+## Complete grammar
 
-A disjunctive license can be expressed in RDF via a `<spdx:DisjunctiveLicenseSet>` element, with an spdx:member property for each element in the disjunctive license. Two or more members are required.
-
-```XML
-<spdx:DisjunctiveLicenseSet>
-    <spdx:member rdf:resource="http://spdx.org/licenses/GPL-2.0-only"/>
-    <spdx:member>
-        <spdx:ExtractedLicensingInfo rdf:about
-          ="http://example.org#LicenseRef-EternalSurrender">
-            <spdx:extractedText>
-                In exchange for using this software, you agree to
-                give its author all your worldly possessions. You
-                will not hold the author liable for all the damage
-                this software will inevitably cause not only to
-                your person and property, but to the entire fabric
-                of the cosmos.
-            </spdx:extractedText>
-            <spdx:licenseId>LicenseRef-EternalSurrender</spdx:licenseId>
-        </spdx:ExtractedLicensingInfo>
-    </spdx:member>
-</spdx:DisjunctiveLicenseSet>
-```
+The complete syntax of license expressions,
+including precedence and whitespace,
+is described by the following ABNF:
+
+``` ABNF
+; ABNF Grammar for License Expressions
+
+SPSX-license-expression = (or-operand *( required-ws "OR" required-ws or-operand )) / special-identifier
+
+or-operand = (term required-ws "AND" required-ws term *( required-ws "AND" required-ws term )) / base-term
+
+term = base-term / special-identifier
+
+base-term = with-expression / identifier / parenthesized-expression
+
+with-expression = identifier required-ws "WITH" required-ws addition-identifier
+
+addition-identifier = license-exception-id / addition-ref
+
+identifier = license-id / or-later-expression / licesnse-ref
+
+or-later-expression = license-id PLUS
+
+parenthesized-expression = LPAREN optional-ws expression optional-ws RPAREN
+
+special-identifier = "NONE" / "NOASSERTION"
+
+; --- SPDX License List contents ---
+
+license-id           = <short form license identifier from SPDX License List>
+license-exception-id = <short form license exception identifier from SPDX License List>
+
+; --- User-defined identifiers ---
+
+license-ref  = [ "DocumentRef-" idstring ":" ] "LicenseRef-"  idstring
+addition-ref = [ "DocumentRef-" idstring ":" ] "AdditionRef-" idstring
+
+idstring = *id-char alnum *id-char
+idchar   = alnum / DOT / DASH
+alnum    = ALPHA / DIGIT
+
+; --- Whitespace and characters ---
+
+optional-ws = *SPACE       ; Optional whitespace (zero or more spaces)
+required-ws = 1*SPACE      ; Required whitespace (one or more spaces)
+
+SPACE  = %x20              ; Space character
+LPAREN = %x28              ; ( - Left parenthesis
+RPAREN = %x29              ; ) - Right parenthesis
+PLUS   = %2B               ; + - Plus
+DASH   = %2D               ; - - Dash, hyphen
+DOT    = %2E               ; . - Dot, fullstop, period
+
+ALPHA  = %x41-5A / %x61-7A ; A-Z / a-z
+DIGIT  = %x30-39           ; 0-9
 
-A License Exception can be expressed in RDF via a `<spdx:LicenseException>` element. This element has the following unique mandatory (unless specified otherwise) attributes:
-
-- `comment` - An `rdfs:comment` element describing the nature of the exception.
-- `seeAlso` (optional, one or more)- An `rdfs:seeAlso` element referencing external sources of information on the exception.
-- `example` (optional) - Text describing examples of this exception.
-- `name` - The full human readable name of the item.
-- `licenseExceptionId` - The identifier of an exception in the SPDX License List to which the exception applies.
-- `licenseExceptionText` - Full text of the license exception.
-
-```XML
-<rdf:Description rdf:about
-  ="http://example.org#SPDXRef-ButIDontWantToException">
-    <rdfs:comment>This exception may be invalid in some
-      jurisdictions.</rdfs:comment>
-    <rdfs:seeAlso>http://dilbert.com/strip/1997-01-15</rdfs:seeAlso>
-    <spdx:example>So this one time, I had a license exception
-      …</spdx:example>
-    <spdx:licenseExceptionText>
-        A user of this software may decline to follow any subset of
-        the terms of this license upon finding any or all such terms
-        unfavorable.
-    </spdx:licenseExceptionText>
-    <spdx:name>&quot;But I Don&apos;t Want To&quot; Exception</spdx:name>
-    <spdx:licenseExceptionId>SPDXRef-ButIDontWantToException</spdx:licenseExceptionId>
-    <rdf:type rdf:resource
-      ="http://spdx.org/rdf/terms#LicenseException"/>
-</rdf:Description>
 ```