MIT and Apache-2.0 license detection in Rust crate.io package should be considered MIT OR Apache-2.0

[JonoYang]

A significant amount of Rust crate.io packages are licensed under MIT or Apache-2.0. We should modify scancode such that if Apache-2.0 and MIT was detected as licenses for a crate.io package, this license should be normalized to the expression mit OR apache-2.0 instead of mit AND apache-2.0

[hyandell]

What about any MIT AND Apache-2.0 projects?

[pombredanne]

@hyandell good point!

Actually I think @JonoYang meant specific cases of Apache-2.0/MIT or MIT/Apache-2.0 and this represents about 39,374 crates as of today. These are legacy expressions that date from a time when Cargo accepted a list of licenses separated by a slash. The use of / is deprecated now and no longer accepted.
This would not for things worded as MIT AND Apache-2.0 which are bona-fide and clear SPDX expressions.

IMHO we would still need to double check these ~40K crates in details to verify that this holds on all and if this does not we can track a list of exceptions.

For reference see these too:

• rust-lang/cargo@7dee65f
• SPDX dual-license inconsistency rust-lang/cargo#2039

[hyandell]

I should have said "MIT and Apache-2.0 projects" :)

I spent a weekend doing a big slog of the Rust crate licensing and generally found that it was 50/50 as to whether a '/' meant AND or OR. Generally speaking, the more permissively licensed, the more likely it was OR, but I was also filtering out things like 'MIT/Apache-2.0' as I didn't care if it was an AND or OR for that analysis. Summary: I was surprised '/' was so inconsistently interpreted.

[pombredanne]

I spent a weekend doing a big slog of the Rust crate licensing and generally found that it was 50/50 as to whether a '/' meant AND or OR. Generally speaking, the more permissively licensed, the more likely it was OR, but I was also filtering out things like 'MIT/Apache-2.0' as I didn't care if it was an AND or OR for that analysis. Summary: I was surprised '/' was so inconsistently interpreted.

That's valuable input. It means that eventually the Rust declared license cannot be too trusted.. and we should err towards reporting these as AND by default may be?