A dual licensed package is offered under two or more licenses, and you normally choose the one whose terms you can meet. In SPDX expression syntax that is an OR. A package with an AND is different: you must satisfy all the listed licenses. Record your choice, so an auditor sees a decision and not a guess.
Reading the expression
The CycloneDX 1.6 reference gives an example expression: Apache-2.0 AND (MIT OR GPL-2.0-only). Read it from the inside out. The part in brackets offers MIT or GPL-2.0-only, your choice. The AND says the Apache-2.0 part applies as well.
So a plain OR is a menu. An AND is a stack of obligations. Mixing the two in one expression is common for packages with several components.
Choosing
When you take the permissive option, such as MIT, from an OR, you generally follow that license's terms for your use. Reasons to choose one over the other:
- Which one has duties you can meet in your product?
- Does one version suffix matter? GPL-2.0-only has different compatibility than GPL-2.0-or-later; see the compatibility post.
- Does a commercial license option exist? Some projects offer a paid license as the second option. That is a contract with the licensor and not something to assume.
Recording the choice
In a CycloneDX file you could keep the expression as declared and set a concluded value with the chosen license. In SPDX, the declared license holds the offered expression and the concluded license holds your choice, with a comment on why. The pattern is described in declared versus concluded.
Pitfalls
- Treating a flat list of two licenses as OR. Without an expression you cannot tell. Ask.
- Picking the choice once and forgetting it. A later version may change the offer.
- Taking a choice for the component and ignoring parts that carry their own license.
- Forgetting that a commercial option needs a signed agreement.
A short routine
Search the SBOM for expressions with OR. For each, record the chosen license and the reason. Review when the package version changes.
Safeguard's SBOM and dependency scanning produce the component list, and you can try the free scan. Choosing the license is up to you and your counsel.
Quick check
What does OR mean in a license expression?
You may choose one of the listed licenses.
What does AND mean?
All the listed licenses apply, so you meet the terms of each.
Sources
This post is general information, not legal advice.
Last reviewed: 19 October 2026.
