In an SPDX license expression, OR means you may choose one of the licenses, AND means you must satisfy all of them, and WITH adds a named exception to a license. So MIT OR Apache-2.0 lets you pick either. Read the expression before adopting a library, and ask legal about anything unclear.
What SPDX expressions are
SPDX is a standard way to name licenses with short identifiers. The SPDX specification defines license expressions for cases where a single identifier is not enough, for example when software is offered under a choice of licenses, or when a program combines files under different licenses. The identifiers come from the SPDX License List, which gives each license a standard short identifier, full name and permanent URL.
Many package registries carry a license field in this format, which makes it machine readable.
The operators
| Operator | Meaning | Example | What you do |
|---|---|---|---|
| OR | Licensee chooses | GPL-2.0-only OR BSD-3-Clause | Pick one and follow its terms |
| AND | All apply | LGPL-2.1-only AND BSD-3-Clause | Satisfy both sets of terms |
| WITH | License plus exception | A license WITH a named exception | Read the exception text; it modifies the license |
| + | That version or later | A license identifier followed by a plus sign | You may use a later version too |
| Parentheses | Grouping | (A OR B) AND C | Evaluate the inside first |
The OR and AND examples above come straight from the SPDX specification. Note that AND often appears when one package bundles several components, so the strictest part tends to drive your obligations.
Steps to handle an expression
- Copy the license expression from the package metadata or repository.
- Replace each identifier with its entry on the SPDX License List and read the text, or have counsel read it.
- For OR, decide which option you will rely on and write it down. Choosing is your right as licensee, so record the choice for later audits.
- For AND, list the combined obligations, such as notices, source offers or attribution.
- For WITH, read the exception. It may relax a restriction, but only in the way it describes.
- Check how you distribute: a library used inside a hosted service and one shipped inside a downloadable app can raise different questions. Ask legal when in doubt.
For the broader picture, see license compatibility when combining open source components and copyleft versus permissive licenses.
Pitfalls
- Free text instead of an identifier. If the field says "see LICENSE", open the file. Treat unclear fields as unknown until you read them.
- Metadata that disagrees with the repository. Trust the license text, and flag the mismatch.
- Per-file licenses. Some projects mix licenses across files. The REUSE initiative, started by the Free Software Foundation Europe, recommends stating the license of each file so humans and tools can read it.
This post is general information, not legal advice.
Where Safeguard fits
Safeguard's SBOM and dependency scanning list components with their license data so you can review them in one place, and policies can gate changes in pull requests. Try the free scan at gold.safeguard.sh/scan.
Quick check
If a library is MIT OR Apache-2.0, which one applies to me?
Whichever you choose. Record your choice and follow that license's conditions, such as keeping the notice.
Does WITH make a license weaker or stronger?
It modifies the license in the way the named exception states. Read the exception text before relying on it.
Sources
Last reviewed: 19 October 2026.
