← Back to issue list

List of supported SPDX licenses is outdated

View original Github issue

Metadata

Project
rockcraft
Number
#372
Type
issue
State
open
Author
cjdcordeiro
Labels
—
Created
Updated
Closed
—

Current evaluation

Rockcraft's SPDX license validation uses outdated spdx_lookup 0.3.3 (322 licenses vs 598 in SPDX), rejecting valid IDs like PSF-2.0 and BUSL-1.1. Maintainers discussed swapping to a fuller list; Jira CRAFT-2787 created. Code still uses spdx_lookup as of HEAD.

Suggested action: keep open

Reason: Verified in rockcraft/models/project.py that spdx_lookup.by_id() is still the validation path and uv.lock pins spdx-lookup 0.3.3 (2020), so the reported BUSL-1.1/PSF-2.0 rejections remain reproducible. The issue was triaged with maintainer replies and an internal Jira ticket (CRAFT-2787), and the underlying problem is still present in the code, so it should stay open despite ~12.5 months of inactivity.

Impact: 40 Quick Win: 26.0 Staleness: 65 Complexity: 35 Confidence: 78 Support Request: 10

Issue body

### Bug Description PSF-2.0 is not in the list of supported SPDX licenses for the Python package we are using. Rockcraft will thus wrongfully complain about it not being a valid license. ### To Reproduce use `license: PSF-2.0` in the rockfile and you'll see `License PSF-2.0 not valid. It must be valid and in SPDX format` You can confirm this by checking the Python module's list of licenses: ```python import spdx_lookup as lookup lookup.spdx.licenses() ``` ### Environment All ### rockcraft.yaml ```shell name: python base: ubuntu:20.04 version: '3.8' license: PSF-2.0 platforms: amd64: parts: foo: plugin: nil ``` ### Relevant log output ```shell `License PSF-2.0 not valid. It must be valid and in SPDX format` ```

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.8-27b
Impact: 40
Quick Win: 26.0
Staleness: 65
Complexity: 35
Confidence: 78
Support Request: 10
keep open Rockcraft's SPDX license validation uses outdated spdx_lookup 0.3.3 (322 licenses vs 598 in SPDX), rejecting valid IDs like PSF-2.0 and BUSL-1.1. Maintainers discussed swapping to a fuller list; Jira CRAFT-2787 created. Code still uses spdx_lookup as of HEAD.
qwen/qwen3.6-35b-a3b
Staleness: 85
Complexity: 20
Confidence: 75
Support Request: 10
close stale Rockcraft's SPDX license validation rejects valid licenses like PSF-2.0 and BUSL-1.1 due to an outdated internal list. Open with maintainer discussion and a Jira ticket, awaiting dependency update or fix.
qwen3.6-35b-a3b-mtp-q6
Staleness: 85
Complexity: 20
Confidence: 75
Support Request: 10
keep open Outdated SPDX license list causes validation failures for legitimate licenses like PSF-2.0 and BUSL-1.1. Maintainers acknowledged the issue and discussed fixes, but no implementation has occurred in nearly three years.
qwen3.6-35b-a3b-mtp-q6
Staleness: 80
Complexity: 45
Confidence: 75
Support Request: 10
needs triage Rockcraft SPDX license validation rejects valid licenses like PSF-2.0 and BUSL-1.1 due to an outdated dependency. Last activity ~10 months ago with an internal Jira ticket created but no labels or assignee.
qwen3.6-35b-a3b-mtp-q6
Staleness: 80
Complexity: 20
Confidence: 85
Support Request: 5
keep open Rockcraft rejects valid SPDX licenses like PSF-2.0 and BUSL-1.1 due to an outdated validation library. Maintainers propose switching to a more current package. Internal ticket CRAFT-2787 created; awaiting implementation.

Update history

No update history recorded yet.

Related work

  • Related To: canonical/rockcraft#168 (confidence 85%)

    PR that replaced the removed spdx-license-list package with spdx-lookup, introducing the outdated 322-license list this issue asks to replace.

Related issues

Issue Project State Summary Similarity
#169 Review SPDX package rockcraft open Rockcraft's SPDX license validation uses spdx-lookup (a stop-gap after spdx-license-list was removed from PyPI), which has an outdated license db. Maintainers discussed options but no resolution was reached; last activity ~2 years ago.
83%
#978 feat: add support for SPDX license expressions rockcraft open Feature request to allow SPDX license expressions in the license field; rockcraft's spdx_lookup validation only accepts single IDs. Maintainers pointed to craft-application's license_expression-based SpdxLicenseStr as the fix path. Open, unimplemented.
77%