In an SPDX license expression, WITH attaches an exception to a license. The pattern is a license identifier, the word WITH, then an exception identifier, for example GPL-2.0-only WITH Classpath-exception-2.0. Exceptions are not standalone licenses. They modify the terms of the license they accompany.
The operators side by side
The Linux kernel documentation summarizes the main operators well:
| Operator | Meaning |
|---|---|
| WITH | Adds an exception to a license |
| OR | You may pick one of the licenses |
| AND | The terms of all listed licenses apply |
| plus sign suffix | Or later version |
Examples from the SPDX exceptions list
The SPDX project keeps a list of exception identifiers. A few that show up often:
- Classpath-exception-2.0, used with copyleft licenses
- GCC-exception-3.1, the GCC runtime library exception
- Linux-syscall-note, used on Linux user space API headers
The SPDX page lists names and identifiers. To learn what an exception actually permits, read its full text at the linked page for that identifier.
Why scanners and policies trip on it
A policy that says "deny GPL" may match GPL-2.0-only WITH Classpath-exception-2.0 and block something the exception was written to allow. A policy that ignores the WITH part may allow something it should not. The right behavior is to treat the combined expression as its own entry and decide on it deliberately.
The Apache Software Foundation page illustrates the point. It lists plain GPL as a category it does not bundle, yet it treats GPL-2.0 with the GNU Classpath Exception as a conditional category, with checks that the dependency is fully under the exception and is a separate module.
Steps for your policy
- Parse expressions instead of matching on the base license name.
- Keep a short list of exceptions you have reviewed.
- Send unreviewed exceptions to a person.
- Record the exact expression in your SBOM so it can be checked again.
Common mistakes
- Writing GPL when the real expression is GPL-2.0-only WITH an exception.
- Dropping the WITH part when copying a license field into a spreadsheet.
- Assuming every exception does the same thing.
For OR and AND, see SPDX OR vs AND explained.
Safeguard supports policies, gates and guardrails, so a team can decide which findings block a pull request and which only warn. A free scan is available if you want to see your own dependency list first.
Try it yourself
Open the gate demo and see how a rule decides on a change. Think about how a license expression would be evaluated by a rule like this.
Click through it at your own pace, or open it full screen.
Quick check
Is an exception a license of its own?
No. The SPDX list says exceptions are not standalone licenses. They apply with a base license.
Where do I find the exact terms of an exception?
On the page for that identifier in the SPDX exceptions list. Read the full text, not just the name.
Sources
- SPDX exceptions list
- Linux kernel documentation: licensing rules
- Apache Software Foundation licensing policy
Last reviewed: 19 October 2026.
