Hello,
Package affected: rubygems/diff-lcs (all versions), and likely any RubyGems package with multiple entries in licenses.
Querying diff-lcs returns:
"licenses": ["MIT", "Artistic-2.0", "GPL-2.0-or-later"]
This reads as if a consumer must comply with all three licenses simultaneously (an AND relationship).
What's actually true:
diff-lcs is disjunctively multi-licensed — a user may choose any one of the three licenses, not all of them. This is confirmed by multiple independent sources that had to manually re-derive the correct relationship from the gem's LICENSE files:
Gentoo/Portage metadata uses explicit boolean SPDX-style syntax: || ( Artistic MIT GPL-2+ ) — the || operator means "OR" (source: packages.gentoo.org/packages/dev-ruby/diff-lcs)
Debian's Free Software Directory lists it as: artistic or expat or gpl-2 (source: directory.fsf.org/wiki/Diff-lcs)
The gem's own RubyGems.org changelog states the third license is available "as an option" (source: rubygems.org/gems/diff-lcs/versions/1.1.3)
Probable Reasons:
RubyGems' gemspec format defines licenses as a plain array of strings (Gem::Specification#licenses), with no support for SPDX license-expression syntax (AND/OR/WITH). So there's no way to express the "choose one" relationship in the source metadata that deps.dev ingests. deps.dev appears to pass this array straight into its own licenses field without any indication of the boolean relationship, which makes every multi-entry RubyGems license list ambiguous to a downstream consumer (AND vs OR is indistinguishable in the current output).
Hello,
Package affected: rubygems/diff-lcs (all versions), and likely any RubyGems package with multiple entries in licenses.
Querying diff-lcs returns:
"licenses": ["MIT", "Artistic-2.0", "GPL-2.0-or-later"]This reads as if a consumer must comply with all three licenses simultaneously (an AND relationship).
What's actually true:
diff-lcs is disjunctively multi-licensed — a user may choose any one of the three licenses, not all of them. This is confirmed by multiple independent sources that had to manually re-derive the correct relationship from the gem's LICENSE files:
Gentoo/Portage metadata uses explicit boolean SPDX-style syntax: || ( Artistic MIT GPL-2+ ) — the || operator means "OR" (source: packages.gentoo.org/packages/dev-ruby/diff-lcs)
Debian's Free Software Directory lists it as: artistic or expat or gpl-2 (source: directory.fsf.org/wiki/Diff-lcs)
The gem's own RubyGems.org changelog states the third license is available "as an option" (source: rubygems.org/gems/diff-lcs/versions/1.1.3)
Probable Reasons:
RubyGems' gemspec format defines licenses as a plain array of strings (Gem::Specification#licenses), with no support for SPDX license-expression syntax (AND/OR/WITH). So there's no way to express the "choose one" relationship in the source metadata that deps.dev ingests. deps.dev appears to pass this array straight into its own licenses field without any indication of the boolean relationship, which makes every multi-entry RubyGems license list ambiguous to a downstream consumer (AND vs OR is indistinguishable in the current output).