Documentation points to spdx.org for license identifiers, but listed license identifiers are invalid.

[jcfergus]

While I understand that this is partially a PEBCAK issue, I'm putting it up anyway because it's probably caused/causing someone else grief too.

I wanted to publish a new crate - I'm new to rust/cargo so didn't realize the license was a required field. So tried to publish w/o a license, got the nice warning:

warning: manifest has no description, license, license-file, documentation, homepage or repository. See http://doc.crates.io/manifest.html#package-metadata for more info.

R'd TFM:
This is a string description of the license for this package. Currently crates.io will validate the license provided against a whitelist of known license identifiers from http://spdx.org/licenses/. Multiple licenses can be separated with a/.

Yay, that's simple enough. Went to http://spdx.org/licenses/, grabbed the listed identifier for LGPL 3.0: LGPL-3.0-or-later, put it in my Cargo.toml, and boom:

error: api errors: unknown license or other term: LGPL-3.0-or-later; see http://opensource.org/licenses for options, and http://spdx.org/licenses/ for their identifiers

So, um...yeah. Cargo doesn't seem to like the -or-later. Either the documentation, or the application, needs an update.

[wking]

Cargo doesn't seem to like the -or-later.

That form is new in v3.0 of the license list. See github/choosealicense.com#563 and spdx/spdx-spec#6 for some elated discussion. In the mean time, you get the same semantics with LGPL-3.0+.

[mlinksva]

Appears to me the error is coming from https://github.com/rust-lang/crates.io/blob/c69ca7a8531e52f534e5f0eb9f714f91012bfcec/src/version/mod.rs#L199-L204 and in turn from https://github.com/withoutboats/license-exprs which looks like it needs maintainer attention (there isn't a PR for SPDX license list 3.0 yet, but there are several other updates outstanding).

[wking]

After some discussion on IRC this morning, I've filed #4898 with the pinning approach. An alternative for this issue would be the “immediately support new identifiers as the SPDX cuts license-list releases” approach, but I think it's better to pin and get a bit of breathing room.