Provide guidance on how to specify spdx license expression

[thompson-tomo]

Currently the guides do not define how to include a spdx license expression within the gemspec.

The docs currently state for LICENSE

The license must be no more than 64 characters.

This should just be the name of your license. The full text of the license should be inside of the gem (at the top level) when you build it.

The simplest way is to specify the standard SPDX ID spdx.org/licenses/ for the license.

This should be changed to cater for the scenario where a gem is dual licensed.

This is important as tools such as fossa treat each license in the array as a seperate license due to them being unable to know how to combine them into an expression.

While at it we should discourage the usage of the array option and instead provide guidance on defining it as an expression.

[headius]

The license field should probably be migrated to "licenses" and be an array, since multi-licensing is fairly common (and I believe even Ruby itself including stdlib gems is dual licensed under both the Ruby license and BSD 2-clause).

[thompson-tomo]

But with thr array tools such as Fossa do not know if those licenses should be combined using the or operator or if it should be the and operator which makes a big difference.

[headius]

I did not know "and" was an option with software licenses, given that they frequently have conflicting requirements. I have only ever dealt with software that "ors" licenses.

[headius]

I read up on SPDX license descriptors and I agree the license field should just be modified to support this long form license descriptor format (and perhaps formalized to indicate users should be preferring SPDX license descriptors here).

[thompson-tomo]

For those interested you can go to https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/ to read what we are referring to.

Would the next step be to propose a pr to update the docs?