Repository navigation
fix(validation): support '+' or-later operator on license references (#887) - #909
Open
ShivanshhhG wants to merge 1 commit into
Open
ShivanshhhG wants to merge 1 commit into
ShivanshhhG wants to merge 1 commit into
Conversation
…pdx#887) According to the SPDX specification, any SPDX-listed license short-form identifier, user-defined license reference (LicenseRef-), or external license reference can be followed by a '+' operator indicating 'or any later version'. Currently, when a license expression contains a license identifier with '+' (such as 'Apache-1.0+'), spdx_licensing.validate reports the token as an unknown license key because the underlying license list contains base keys without the operator suffix. Consequently, validate_license_expression falsely reports valid expressions as unrecognized license references. Support the '+' operator in validate_license_expression by checking whether the base token (stripped of '+') resolves to a known SPDX license (non-exception) or a defined license reference. Fixes spdx#887 Signed-off-by: SHIVANSH-ux-ys <[email protected]>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Per the SPDX specification (Clause 8.1.3), an SPDX-listed license short-form identifier, user-defined license reference (
LicenseRef-[idstring]), or external license reference can be followed by a+operator indicating "or any later version" (e.g.Apache-1.0+,Apache-2.0+,LicenseRef-custom+).Currently, when
spdx_licensing.validatevalidates a license expression containing a valid license with a+operator, the symbol is reported as an unknown license key (because the known license keys in the license list match base keys without the operator suffix). Consequently,validate_license_expressionflags legitimate expressions likeApache-1.0+as unrecognized license references.Changes
validate_license_expressioninsrc/spdx_tools/spdx/validation/license_expression_validator.pyto recognize when an invalid symbol ends with+. If the base symbol stripped of+is a known non-exception SPDX license or present in the document'sextracted_licensing_info, it is accepted as valid.tests/spdx/validation/test_license_expression_validator.pycovering standard licenses with+(Apache-1.0+,Apache-2.0+,Apache-1.0+ or MIT), extracted licenses with+(LicenseRef-...and external references), while verifying invalid licenses (InvalidLicense+) and exception symbols with+(LLVM-exception+) remain correctly rejected.Fixes #887