spdx-expression-validate

What is spdx-expression-validate?

The spdx-expression-validate npm package is used to validate SPDX license expressions. SPDX (Software Package Data Exchange) is a standard format for communicating the components, licenses, and copyrights associated with software packages. This package ensures that the given license expressions conform to the SPDX specification.

What are spdx-expression-validate's main functionalities?

Validate SPDX License Expression

This feature allows you to validate whether a given SPDX license expression is valid according to the SPDX specification. The code sample demonstrates how to use the package to validate the expression 'MIT OR Apache-2.0'.

const validate = require('spdx-expression-validate');

const expression = 'MIT OR Apache-2.0';
const isValid = validate(expression);
console.log(isValid); // true

Invalid SPDX License Expression

This feature allows you to check if an invalid SPDX license expression is correctly identified as invalid. The code sample demonstrates how to use the package to validate the expression 'Invalid-License'.

const validate = require('spdx-expression-validate');

const expression = 'Invalid-License';
const isValid = validate(expression);
console.log(isValid); // false

Other packages similar to spdx-expression-validate

spdx-correct

The spdx-correct package is used to correct common misspellings and typos in SPDX license expressions. While spdx-expression-validate focuses on validating the correctness of the expressions, spdx-correct helps in correcting them to valid SPDX expressions.

spdx-satisfies

The spdx-satisfies package is used to check if a given SPDX license expression satisfies another SPDX license expression. This is useful for license compatibility checks. Unlike spdx-expression-validate, which only validates the expression, spdx-satisfies checks for compatibility between expressions.

spdx-license-ids

The spdx-license-ids package provides a list of all valid SPDX license identifiers. It is useful for referencing valid license IDs but does not perform validation of expressions like spdx-expression-validate.

README

var assert = require('assert')
var valid = require('spdx-expression-validate')

Simple License Expressions

assert(!valid('Invalid-Identifier'))
assert(valid('GPL-2.0'))
assert(valid('GPL-2.0+'))
assert(valid('LicenseRef-23'))
assert(valid('LicenseRef-MIT-Style-1'))
assert(valid('DocumentRef-spdx-tool-1.2:LicenseRef-MIT-Style-2'))

Composite License Expressions

Disjunctive OR Operator

assert(valid('(LGPL-2.1 OR MIT)'))
assert(valid('(LGPL-2.1 OR MIT OR BSD-3-Clause)'))

Conjunctive AND Operator

assert(valid('(LGPL-2.1 AND MIT)'))
assert(valid('(LGPL-2.1 AND MIT AND BSD-2-Clause)'))

Exception WITH Operator

assert(valid('(GPL-2.0+ WITH Bison-exception-2.2)'))

Strict Whitespace Rules

assert(!valid('MIT '))
assert(!valid(' MIT'))
assert(!valid('MIT  AND  BSD-3-Clause'))

---

The Software Package Data Exchange (SPDX) specification is the work of the Linux Foundation and its contributors, and is licensed under the terms of the Creative Commons Attribution License 3.0 Unported (SPDX: "CC-BY-3.0"). "SPDX" is a United States federally registered trademark of the Linux Foundation.