← Back to issue list

Review SPDX package

View original Github issue

Metadata

Project
rockcraft
Number
#169
Type
issue
State
open
Author
tigarmo
Labels
—
Created
Updated
Closed
—

Current evaluation

Rockcraft's SPDX license validation uses spdx-lookup (a stop-gap after spdx-license-list was removed from PyPI), which has an outdated license db. Maintainers discussed options but no resolution was reached; last activity ~2 years ago.

Suggested action: keep open

Reason: The issue is still relevant: the codebase (rockcraft/models/project.py and pyproject.toml) still depends on spdx-lookup, the stop-gap introduced by PR #168, which has an outdated license db. Maintainers (tigarmo, lengau) actively discussed three options (vendor the file, download at runtime, or use SPDX's tools-python) but no decision was made, and the last comment (2024-07-24) was an unanswered 'Any update?' — so it is triaged and valid, not stale-irrelevant.

Impact: 45 Quick Win: 24.75 Staleness: 80 Complexity: 45 Confidence: 75 Support Request: 10

Issue body

Looks like the `spdx-license-list` package is gone from PyPI. We use it to validate that the chosen license is valid. #168 replaces that package with `spdx-lookup` as a stop-gap to "unbreak" `main`, but as @lengau points out that one has a single release and an outdated license db. We should review this situation and come up with something more sustainable.

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.8-27b
Impact: 45
Quick Win: 24.75
Staleness: 80
Complexity: 45
Confidence: 75
Support Request: 10
keep open Rockcraft's SPDX license validation uses spdx-lookup (a stop-gap after spdx-license-list was removed from PyPI), which has an outdated license db. Maintainers discussed options but no resolution was reached; last activity ~2 years ago.
qwen/qwen3.6-35b-a3b
Staleness: 92
Complexity: 35
Confidence: 85
Support Request: 5
close stale Review of SPDX license validation dependency after upstream package removal. Open since 2022 with proposed solutions but no maintainer decision or implementation.
qwen3.6-35b-a3b-mtp-q6
Staleness: 92
Complexity: 20
Confidence: 85
Support Request: 0
close stale Tracking decision on replacing the removed spdx-license-list package. A drop-in replacement was proposed in early 2023, but the discussion stalled with no maintainer response or action since then.
qwen3.6-35b-a3b-mtp-q6
Staleness: 88
Complexity: 20
Confidence: 85
Support Request: 0
close stale Replacing the deprecated spdx-license-list PyPI package used for license validation. A community member recreated it with automated updates. Awaiting maintainer decision to revert the temporary fix and adopt the new package. Currently stalled.

Update history

No update history recorded yet.

Related work

  • Related To: rockcraft#168 (confidence 90%)

    PR #168 is the merged stop-gap that replaced spdx-license-list with spdx-lookup; this issue is the follow-up to make that dependency sustainable.

Related issues

Issue Project State Summary Similarity
#372 List of supported SPDX licenses is outdated rockcraft open Rockcraft's SPDX license validation uses outdated spdx_lookup 0.3.3 (322 licenses vs 598 in SPDX), rejecting valid IDs like PSF-2.0 and BUSL-1.1. Maintainers discussed swapping to a fuller list; Jira CRAFT-2787 created. Code still uses spdx_lookup as of HEAD.
83%
#978 feat: add support for SPDX license expressions rockcraft open Feature request to allow SPDX license expressions in the license field; rockcraft's spdx_lookup validation only accepts single IDs. Maintainers pointed to craft-application's license_expression-based SpdxLicenseStr as the fix path. Open, unimplemented.
71%