List of supported SPDX licenses is outdated

Metadata

Project: rockcraft
Number: #372
Type: issue
State: open
Author: cjdcordeiro
Labels: —
Created: 2023-10-09 01:53 PM UTC
Updated: 2025-08-15 03:12 PM UTC
Closed: —

Current evaluation

Rockcraft's license validation relies on the 2020-era spdx-lookup 0.3.3 list (322 licenses), rejecting valid modern SPDX IDs such as PSF-2.0 and BUSL-1.1. Root cause confirmed in rockcraft/models/project.py and pyproject.toml; still unfixed.

Suggested action: keep open

Reason: The problem is still live: project.py:295 validates licenses via spdx_lookup.by_id() and pyproject.toml pins spdx-lookup>=0.3.3 (a Dec-2020 wheel with only 322 of the ~598 SPDX licenses), and git log shows no commit updating or replacing it since #168. The issue has maintainer participation (author cjdcordeiro is a maintainer) plus a second independent report from @gruyaume that BUSL-1.1 is rejected and blocks distributing Vault, so it is a valid, still-open bug rather than a stale one. Impact is moderate (blocks packaging for a subset of valid licenses, workaround is to use `Python-2.0`), and the fix is a contained dependency/validation change, but the exact approach needs a maintainer decision: commit 7609b585 (#168) deliberately moved *from* spdx-license-list *to* spdx-lookup, so @cjdcordeiro's suggestion to switch back to spdx-license-list would partly revert an earlier choice.

Evaluated by: mr-cal-bot

Impact: 50 Quick Win: 24 Complexity: 35 Confidence: 82 Actionability: 75

Issue body

### Bug Description PSF-2.0 is not in the list of supported SPDX licenses for the Python package we are using. Rockcraft will thus wrongfully complain about it not being a valid license. ### To Reproduce use `license: PSF-2.0` in the rockfile and you'll see `License PSF-2.0 not valid. It must be valid and in SPDX format` You can confirm this by checking the Python module's list of licenses: ```python import spdx_lookup as lookup lookup.spdx.licenses() ``` ### Environment All ### rockcraft.yaml ```shell name: python base: ubuntu:20.04 version: '3.8' license: PSF-2.0 platforms: amd64: parts: foo: plugin: nil ``` ### Relevant log output ```shell `License PSF-2.0 not valid. It must be valid and in SPDX format` ```

Evaluation history

Date	Model	Scores	Action	Summary
2026-10-02 04:56 PM UTC	stealth/space-bunny-alpha	Impact: 50 Quick Win: 24 Complexity: 35 Confidence: 82 Actionability: 75	keep open	Rockcraft's license validation relies on the 2020-era spdx-lookup 0.3.3 list (322 licenses), rejecting valid modern SPDX IDs such as PSF-2.0 and BUSL-1.1. Root cause confirmed in rockcraft/models/project.py and pyproject.toml; still unfixed.
2026-09-20 05:04 AM UTC	qwen/qwen3.6-35b-a3b	Impact: 70 Quick Win: 39 Complexity: 30 Confidence: 80 Actionability: 80	keep open	Rockcraft's SPDX license validation fails for valid licenses like PSF-2.0 and BUSL-1.1 due to outdated spdx_lookup dependency. Acknowledged by maintainers, no fix implemented.
2026-09-01 01:54 AM UTC	qwen/qwen3.8-27b	Impact: 40 Quick Win: 26 Staleness: 65 Complexity: 35 Confidence: 78 Support Request: 10	keep open	Rockcraft's SPDX license validation uses outdated spdx_lookup 0.3.3 (322 licenses vs 598 in SPDX), rejecting valid IDs like PSF-2.0 and BUSL-1.1. Maintainers discussed swapping to a fuller list; Jira CRAFT-2787 created. Code still uses spdx_lookup as of HEAD.
2026-07-22 12:13 PM UTC	qwen/qwen3.6-35b-a3b	Staleness: 85 Complexity: 20 Confidence: 75 Support Request: 10	close stale	Rockcraft's SPDX license validation rejects valid licenses like PSF-2.0 and BUSL-1.1 due to an outdated internal list. Open with maintainer discussion and a Jira ticket, awaiting dependency update or fix.
2026-07-08 08:16 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 85 Complexity: 20 Confidence: 75 Support Request: 10	keep open	Outdated SPDX license list causes validation failures for legitimate licenses like PSF-2.0 and BUSL-1.1. Maintainers acknowledged the issue and discussed fixes, but no implementation has occurred in nearly three years.
2026-07-05 10:54 AM UTC	qwen3.6-35b-a3b-mtp-q6	Staleness: 80 Complexity: 45 Confidence: 75 Support Request: 10	needs triage	Rockcraft SPDX license validation rejects valid licenses like PSF-2.0 and BUSL-1.1 due to an outdated dependency. Last activity ~10 months ago with an internal Jira ticket created but no labels or assignee.

Update history

No update history recorded yet.

Related work

Related To: rockcraft#168 (confidence 70%)
Commit 7609b585 'project: move from spdx-license-list to spdx-lookup (#168)' is the origin of the stale322-license list; relevant because the issue's proposed fix (going back to spdx-license-list) would partly revert it.

Related issues

Issue	Project	State	Summary	Similarity
#978 feat: add support for SPDX license expressions	rockcraft	open	Rockcraft's license field rejects SPDX license expressions like (MIT OR Apache-2.0) AND GPL-3.0 because validation uses abandoned spdx_lookup; maintainers triaged and suggest reusing craft-application's license_expression-based validator.	76%
#169 Review SPDX package	rockcraft	open	Maintainer-raised request to replace the discontinued spdx-license-list dependency; #168 used spdx-lookup as a stop-gap and JJMC89's recreated spdx-license-list is proposed but rockcraft still depends on spdx-lookup 0.3.3	71%