In an SPDX expression, OR means the person receiving the code may choose either license, while AND means they must comply with both. WITH attaches an exception to a license, and parentheses set precedence. Reading these four pieces correctly tells you what you owe when you ship a dependency.
OR: you choose
Apache-2.0 OR MIT is a dual license. The licensee may choose either one. Many projects in some ecosystems publish this way so downstream users can pick the terms that fit their situation.
When you consume such a package, record which option you chose. Your compliance notes should say "MIT" or "Apache-2.0", not the whole expression, because your obligations follow the license you picked.
AND: you meet both
Apache-2.0 AND MIT means the code carries both sets of terms. This often appears when a package bundles parts from different origins. You must satisfy the conditions of each, for example keeping both sets of notices.
If one side of an AND is a strong copyleft license, treat the whole package as carrying that obligation.
Parentheses and precedence
Parentheses group terms. The SPDX example Apache-2.0 AND (MIT OR GPL-2.0-only) requires Apache-2.0, plus a choice of MIT or GPL-2.0-only. Read from the inside out: resolve the choice in the brackets, then apply the AND.
A practical habit is to rewrite the expression in plain words before you approve a package. "Must follow Apache, and may pick MIT or the GPL" is much harder to misread than the symbols.
WITH: exceptions
GPL-3.0-only WITH Classpath-exception-2.0 attaches an exception to the base license. The exception changes what the base license demands. You cannot judge the package by the base ID alone. Look up the exception text before you decide.
The plus sign and GNU suffixes
For non GNU licenses, a trailing + means the named version or any later one, for example EPL-1.0+. For GNU licenses such as GPL, LGPL, AGPL and GFDL, the guidance says not to use the bare ID. Use -only or -or-later instead. See GPL-2.0-only versus GPL-2.0-or-later for why that distinction matters.
A review checklist for expressions
- Is it a single ID, or an expression? If an expression, which operator is at the top level?
- For every OR, which option do we choose, and is it written down?
- For every AND, have we met all of the conditions?
- Is there a WITH? Have we read the exception?
- Does any branch contain a license our policy denies? If the OR gives a compliant option, you may be fine. If an AND includes it, you are not.
Putting it into policy
Teams that automate license checks need their policy engine to evaluate expressions, not just match single IDs. A tool that flags any package whose string contains a denied ID will reject packages you could legally use through the OR branch. Equally, a tool that approves a package because one branch is allowed may miss an AND.
If you are writing a policy, see license policy automation at pull request time. Safeguard's policies and gates can enforce rules like these on your dependency inventory, and you can try a free scan.
Quick check
If a package is MIT OR GPL-3.0-only, which license do I follow?
Whichever you choose. Pick one, note it in your records, and follow its terms.
Is AND ever a choice?
No. AND means both sets of conditions apply.
Sources
Last reviewed: 19 October 2026.
