{"id":"CATOSL-1.1","title":"Computer Associates Trusted Open Source License 1.1","reviewed_on":"2026-09-15","reviewer":"Giray Havur","text_source":"https://raw.githubusercontent.com/spdx/license-list-data/main/text/CATOSL-1.1.txt","text_retrieved":true,"verdict":"corrected","summary":"The Computer Associates Trusted Open Source License is reciprocal: contributions and modifications are governed by the same license and source must be made available. The record prohibited cc:ShareAlike, reversing that, and the prohibition was removed. The trademark and branding restrictions are correctly modelled.","findings":[{"rubric":5,"severity":"major","field":"odrl:prohibition","description":"The license states that the Program and every Contribution are \"governed by the terms of this License\" and requires source availability for any distribution. Prohibiting cc:ShareAlike asserts the opposite. Removed.","action":"applied","change":"# removed\nodrl:prohibition [ a odrl:Prohibition ;\n        odrl:action cc:ShareAlike ] ;\n"},{"rubric":5,"severity":"major","field":"odrl:duty","description":"Reciprocity belongs as a license-wide cc:ShareAlike duty. Held back because the record permits odrl:grantUse, which section 2 does grant (\"sublicense the Contribution of such Contributor, if any, and such derivative works\"), and the dependency graph treats the two as contradictory.","action":"proposed","change":"odrl:duty [ a odrl:Duty ;\n        odrl:action cc:ShareAlike ] ;\n"},{"rubric":4,"severity":"info","field":"odrl:prohibition","description":"dalicc:promote is prohibited and the section headed \"TRADEMARKS AND BRANDING\" supports it: the license grants no right to the CA Marks or to any mark of a Contributor.","action":"none"},{"rubric":8,"severity":"gap","field":"vocabulary","description":"The license carries a patent grant, a patent retaliation clause and a branding obligation (the Program must carry the notices posted at the CA URL). Proposed: dalicc:patentGrant, dalicc:patentRetaliationTermination, dalicc:brandingNotice.","action":"none"},{"rubric":5,"severity":"minor","field":"odrl:duty","description":"The attribution, notice and source-code duties sit on cc:DerivativeWorks and odrl:distribute while odrl:modify and odrl:derive are bare, a template artefact.","action":"proposed","change":"# add the same duties to odrl:modify and odrl:derive\n"},{"rubric":10,"severity":"minor","field":"record","description":"Standard-license addition of 2026-09-15, decision 9 and 10: the record was corrected against its new siblings and versioned. Library convention 14: the warranty and liability literals carried a padding space inside their quotation marks.","action":"applied"}],"family":"Other OSI approved licenses (corporate, academic, weak copyleft)","port_of":null,"variant_kind":null,"notes":"This record uses the composer template shared by AAL, AFL-3.0, APL-1.0, APSL-2.0, CATOSL-1.1, CECILL-2.1, EPL-1.0 and PHP-3.0: bare odrl:derive and odrl:modify permissions with the real duties hung on cc:DerivativeWorks, plus a fixed block of three prohibitions (cc:ShareAlike, dalicc:addStatement, dalicc:promote). The template fits a permissive license and misdescribes every reciprocal one."}