Review SPDX package
Metadata
Current evaluation
Maintainer-raised request to replace the discontinued spdx-license-list dependency; #168 used spdx-lookup as a stop-gap and JJMC89's recreated spdx-license-list is proposed but rockcraft still depends on spdx-lookup 0.3.3
Suggested action: keep open
Reason: The issue is valid and unresolved: pyproject.toml still pins "spdx-lookup>=0.3.3" and rockcraft/models/project.py still validates licenses via spdx_lookup.by_id(), with uv.lock showing spdx 2.5.1 artifacts uploaded 2020-12-07 — i.e. the outdated license DB Lengau flagged is still in use. Maintainers engaged (Lengau laid out three options and said "it'd be reasonable to revert #168 and use this package. What do you think @tigarmo ?"), JJMC89 supplied an automated drop-in replacement, and dotlambda pinged for an update in 2024, so it should stay open. Impact is moderate rather than severe — validation still functions and the schema/documented behaviour in tests/unit/test_project.py:252 is unaffected — but the underlying dependency-sustainability concern stands and awaits a maintainer decision.
Evaluated by: mr-cal-bot
Issue body
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha |
Impact:
30
Quick Win:
14
Complexity:
25
Confidence:
78
Actionability:
60
|
keep open | Maintainer-raised request to replace the discontinued spdx-license-list dependency; #168 used spdx-lookup as a stop-gap and JJMC89's recreated spdx-license-list is proposed but rockcraft still depends on spdx-lookup 0.3.3 | |
| qwen/qwen3.6-35b-a3b |
Impact:
30
Quick Win:
14
Complexity:
20
Confidence:
70
Actionability:
60
|
keep open | Review SPDX package dependency: spdx-license-list was removed from PyPI, replaced with spdx-lookup as stop-gap in #168. Issue asks to evaluate switching to recreated spdx-license-list or another sustainable solution. | |
| qwen/qwen3.8-27b |
Impact:
45
Quick Win:
25
Staleness:
80
Complexity:
45
Confidence:
75
Support Request:
10
|
keep open | Rockcraft's SPDX license validation uses spdx-lookup (a stop-gap after spdx-license-list was removed from PyPI), which has an outdated license db. Maintainers discussed options but no resolution was reached; last activity ~2 years ago. | |
| qwen/qwen3.6-35b-a3b |
Staleness:
92
Complexity:
35
Confidence:
85
Support Request:
5
|
close stale | Review of SPDX license validation dependency after upstream package removal. Open since 2022 with proposed solutions but no maintainer decision or implementation. | |
| qwen3.6-35b-a3b-mtp-q6 |
Staleness:
92
Complexity:
20
Confidence:
85
Support Request:
0
|
close stale | Tracking decision on replacing the removed spdx-license-list package. A drop-in replacement was proposed in early 2023, but the discussion stalled with no maintainer response or action since then. |
Update history
No update history recorded yet.
Related work
-
Related To:
canonical/rockcraft#168
(confidence 95%)
Merged stop-gap PR (commit 7609b585, 'project: move from spdx-license-list to spdx-lookup') that this issue was opened to review and which Lengau proposed reverting.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #168 project: move from spdx-license-list to spdx-lookup | rockcraft | merged | Merged PR #168 as commit 7609b585, replacing the PyPI-removed spdx-license-list dependency with spdx-lookup to restore license lookup functionality. | |
| #372 List of supported SPDX licenses is outdated | rockcraft | open | Rockcraft's license validation relies on the 2020-era spdx-lookup 0.3.3 list (322 licenses), rejecting valid modern SPDX IDs such as PSF-2.0 and BUSL-1.1. Root cause confirmed in rockcraft/models/project.py and pyproject.toml; still unfixed. |