Security News
The Unpaid Backbone of Open Source: Solo Maintainers Face Increasing Security Demands
Solo open source maintainers face burnout and security challenges, with 60% unpaid and 60% considering quitting.
spdx-expression-validate
Advanced tools
The spdx-expression-validate npm package is used to validate SPDX license expressions. SPDX (Software Package Data Exchange) is a standard format for communicating the components, licenses, and copyrights associated with software packages. This package ensures that the given license expressions conform to the SPDX specification.
Validate SPDX License Expression
This feature allows you to validate whether a given SPDX license expression is valid according to the SPDX specification. The code sample demonstrates how to use the package to validate the expression 'MIT OR Apache-2.0'.
const validate = require('spdx-expression-validate');
const expression = 'MIT OR Apache-2.0';
const isValid = validate(expression);
console.log(isValid); // true
Invalid SPDX License Expression
This feature allows you to check if an invalid SPDX license expression is correctly identified as invalid. The code sample demonstrates how to use the package to validate the expression 'Invalid-License'.
const validate = require('spdx-expression-validate');
const expression = 'Invalid-License';
const isValid = validate(expression);
console.log(isValid); // false
The spdx-correct package is used to correct common misspellings and typos in SPDX license expressions. While spdx-expression-validate focuses on validating the correctness of the expressions, spdx-correct helps in correcting them to valid SPDX expressions.
The spdx-satisfies package is used to check if a given SPDX license expression satisfies another SPDX license expression. This is useful for license compatibility checks. Unlike spdx-expression-validate, which only validates the expression, spdx-satisfies checks for compatibility between expressions.
The spdx-license-ids package provides a list of all valid SPDX license identifiers. It is useful for referencing valid license IDs but does not perform validation of expressions like spdx-expression-validate.
var assert = require('assert')
var valid = require('spdx-expression-validate')
assert(!valid('Invalid-Identifier'))
assert(valid('GPL-2.0'))
assert(valid('GPL-2.0+'))
assert(valid('LicenseRef-23'))
assert(valid('LicenseRef-MIT-Style-1'))
assert(valid('DocumentRef-spdx-tool-1.2:LicenseRef-MIT-Style-2'))
OR
Operatorassert(valid('(LGPL-2.1 OR MIT)'))
assert(valid('(LGPL-2.1 OR MIT OR BSD-3-Clause)'))
AND
Operatorassert(valid('(LGPL-2.1 AND MIT)'))
assert(valid('(LGPL-2.1 AND MIT AND BSD-2-Clause)'))
WITH
Operatorassert(valid('(GPL-2.0+ WITH Bison-exception-2.2)'))
assert(!valid('MIT '))
assert(!valid(' MIT'))
assert(!valid('MIT AND BSD-3-Clause'))
The Software Package Data Exchange (SPDX) specification is the work of the Linux Foundation and its contributors, and is licensed under the terms of the Creative Commons Attribution License 3.0 Unported (SPDX: "CC-BY-3.0"). "SPDX" is a United States federally registered trademark of the Linux Foundation.
FAQs
validate SPDX license expressions
The npm package spdx-expression-validate receives a total of 169,010 weekly downloads. As such, spdx-expression-validate popularity was classified as popular.
We found that spdx-expression-validate demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Solo open source maintainers face burnout and security challenges, with 60% unpaid and 60% considering quitting.
Security News
License exceptions modify the terms of open source licenses, impacting how software can be used, modified, and distributed. Developers should be aware of the legal implications of these exceptions.
Security News
A developer is accusing Tencent of violating the GPL by modifying a Python utility and changing its license to BSD, highlighting the importance of copyleft compliance.