← Back to issue list

feat: add support for SPDX license expressions

View original Github issue

Metadata

Project
rockcraft
Number
#978
Type
issue
State
open
Author
lczyk
Labels
Type: Enhancement
Created
Updated
Closed
—

Current evaluation

Feature request to allow SPDX license expressions in the license field; rockcraft's spdx_lookup validation only accepts single IDs. Maintainers pointed to craft-application's license_expression-based SpdxLicenseStr as the fix path. Open, unimplemented.

Suggested action: keep open

Reason: Maintainer tigarmo (2025-11-12) confirmed craft-application 'has the code to validate the license' via SpdxLicenseStr/license_expression, and rockcraft's own spdx_lookup-based _validate_license (project.py) is the blocker. It is a valid, scoped enhancement with a clear fix path, so it should stay open pending implementation.

Impact: 40 Quick Win: 22.0 Staleness: 65 Complexity: 45 Confidence: 80 Support Request: 10

Issue body

### Bug Description the `license:` field cannot be a [license expression](https://packaging.python.org/en/latest/glossary/#term-License-Expression) which does not allow to accurately depict the license of the main components of the rock. my use case: https://github.com/canonical/rockcraft/issues/978 [rust and cargo are dual licensed under MIT or Apache-2.0](https://www.rust-lang.org/policies/licenses) and the rock also includes the gcc tolchain [which is licensed under GPL-3.0]( https://gcc.gnu.org/onlinedocs/libstdc++/manual/license.html) ### To Reproduce `license: (MIT OR Apache-2.0) AND GPL-3.0` ### Environment n/a ### rockcraft.yaml ```yaml n/a ``` ### Relevant log output ```shell 2025-09-25 18:48:56.052 Bad rockcraft.yaml content: 2025-09-25 18:48:56.053 - license (MIT OR Apache-2.0) AND GPL-3.0 not valid. It must be either 'proprietary' or in SPDX format. (in field 'license') ```

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.8-27b
Impact: 40
Quick Win: 22.0
Staleness: 65
Complexity: 45
Confidence: 80
Support Request: 10
keep open Feature request to allow SPDX license expressions in the license field; rockcraft's spdx_lookup validation only accepts single IDs. Maintainers pointed to craft-application's license_expression-based SpdxLicenseStr as the fix path. Open, unimplemented.
qwen/qwen3.6-35b-a3b
Staleness: 75
Complexity: 55
Confidence: 85
Support Request: 10
needs triage Feature request to support SPDX license expressions in rockcraft.yaml. Blocked by an abandoned validation library. Contributors discussed switching to spdx/tools-python or using craft-application's validation. Awaiting maintainer assessment.
qwen3.6-35b-a3b-mtp-q6
Staleness: 50
Complexity: 45
Confidence: 85
Support Request: 10
keep open Enhancement to support SPDX license expressions in the license field. Maintainers are analyzing the root cause and discussing library replacements to enable this feature.
qwen3.6-35b-a3b-mtp-q6
Staleness: 70
Complexity: 40
Confidence: 85
Support Request: 10
needs triage Enhancement request to support SPDX license expressions in the license field. Contributors identified the abandoned validation library and suggested switching to spdx-tools-python or leveraging craft-application, but no maintainer action or assignment has occurred.
qwen3.6-35b-a3b-mtp-q6
Staleness: 75
Complexity: 60
Confidence: 85
Support Request: 10
keep open Add SPDX license expression support to rockcraft.yaml. Validation rejects complex expressions due to an abandoned library. Discussion about migrating to craft-application's SpdxLicenseStr and license_expression support. Open, awaiting implementation.

Update history

No update history recorded yet.

Related issues

Issue Project State Summary Similarity
#372 List of supported SPDX licenses is outdated rockcraft open Rockcraft's SPDX license validation uses outdated spdx_lookup 0.3.3 (322 licenses vs 598 in SPDX), rejecting valid IDs like PSF-2.0 and BUSL-1.1. Maintainers discussed swapping to a fuller list; Jira CRAFT-2787 created. Code still uses spdx_lookup as of HEAD.
77%
#169 Review SPDX package rockcraft open Rockcraft's SPDX license validation uses spdx-lookup (a stop-gap after spdx-license-list was removed from PyPI), which has an outdated license db. Maintainers discussed options but no resolution was reached; last activity ~2 years ago.
71%