← Back to issue list

feat: add support for SPDX license expressions

View original Github issue

Metadata

Project
rockcraft
Number
#978
Type
issue
State
open
Author
lczyk
Labels
Type: Enhancement
Created
Updated
Closed
—

Current evaluation

Rockcraft's license field rejects SPDX license expressions like (MIT OR Apache-2.0) AND GPL-3.0 because validation uses abandoned spdx_lookup; maintainers triaged and suggest reusing craft-application's license_expression-based validator.

Suggested action: keep open

Reason: Maintainers acknowledged the issue and identified the root cause: rockcraft/models/project.py:295 still uses spdx_lookup.by_id, which only matches single SPDX IDs, while craft-application already has a license_expression-based SpdxLicenseStr validator. The issue is clearly scoped with a concrete reproducer and a likely implementation path, but no fix has landed.

Evaluated by: mr-cal-bot

Impact: 50 Quick Win: 24 Complexity: 40 Confidence: 85 Actionability: 80

Issue body

### Bug Description the `license:` field cannot be a [license expression](https://packaging.python.org/en/latest/glossary/#term-License-Expression) which does not allow to accurately depict the license of the main components of the rock. my use case: https://github.com/canonical/rockcraft/issues/978 [rust and cargo are dual licensed under MIT or Apache-2.0](https://www.rust-lang.org/policies/licenses) and the rock also includes the gcc tolchain [which is licensed under GPL-3.0]( https://gcc.gnu.org/onlinedocs/libstdc++/manual/license.html) ### To Reproduce `license: (MIT OR Apache-2.0) AND GPL-3.0` ### Environment n/a ### rockcraft.yaml ```yaml n/a ``` ### Relevant log output ```shell 2025-09-25 18:48:56.052 Bad rockcraft.yaml content: 2025-09-25 18:48:56.053 - license (MIT OR Apache-2.0) AND GPL-3.0 not valid. It must be either 'proprietary' or in SPDX format. (in field 'license') ```

Evaluation history

Date Model Scores Action Summary
~deepseek/deepseek-pro-latest
Impact: 50
Quick Win: 24
Complexity: 40
Confidence: 85
Actionability: 80
keep open Rockcraft's license field rejects SPDX license expressions like (MIT OR Apache-2.0) AND GPL-3.0 because validation uses abandoned spdx_lookup; maintainers triaged and suggest reusing craft-application's license_expression-based validator.
stealth/space-bunny-alpha
Impact: 42
Quick Win: 22
Complexity: 35
Confidence: 88
Actionability: 82
keep open Rockcraft's `license:` field rejects SPDX license expressions (e.g. `(MIT OR Apache-2.0) AND GPL-3.0`) because `_validate_license` uses abandoned spdx_lookup, which only matches single license IDs. Triaged by maintainers; still unfixed at HEAD.
qwen/qwen3.6-35b-a3b
Impact: 40
Quick Win: 21
Complexity: 35
Confidence: 75
Actionability: 80
keep open Rockcraft rejects SPDX license expressions in the license field because it uses spdx_lookup which only supports single license IDs. Maintainers identified switching to license_expression as the fix.
qwen/qwen3.8-27b
Impact: 40
Quick Win: 22
Staleness: 65
Complexity: 45
Confidence: 80
Support Request: 10
keep open Feature request to allow SPDX license expressions in the license field; rockcraft's spdx_lookup validation only accepts single IDs. Maintainers pointed to craft-application's license_expression-based SpdxLicenseStr as the fix path. Open, unimplemented.
qwen/qwen3.6-35b-a3b
Staleness: 75
Complexity: 55
Confidence: 85
Support Request: 10
needs triage Feature request to support SPDX license expressions in rockcraft.yaml. Blocked by an abandoned validation library. Contributors discussed switching to spdx/tools-python or using craft-application's validation. Awaiting maintainer assessment.
qwen3.6-35b-a3b-mtp-q6
Staleness: 50
Complexity: 45
Confidence: 85
Support Request: 10
keep open Enhancement to support SPDX license expressions in the license field. Maintainers are analyzing the root cause and discussing library replacements to enable this feature.
qwen3.6-35b-a3b-mtp-q6
Staleness: 70
Complexity: 40
Confidence: 85
Support Request: 10
needs triage Enhancement request to support SPDX license expressions in the license field. Contributors identified the abandoned validation library and suggested switching to spdx-tools-python or leveraging craft-application, but no maintainer action or assignment has occurred.

Update history

No update history recorded yet.

Related work

  • Related To: rockcraft#372 (confidence 80%)

    Both issues stem from rockcraft's reliance on the outdated spdx_lookup dependency for license validation.

  • Related To: craft-application#1022 (confidence 70%)

    craft-application already documents SPDX compatibility for the license key and has reusable SPDX expression validation.

Related issues

Issue Project State Summary Similarity
#372 List of supported SPDX licenses is outdated rockcraft open Rockcraft's license validation relies on the 2020-era spdx-lookup 0.3.3 list (322 licenses), rejecting valid modern SPDX IDs such as PSF-2.0 and BUSL-1.1. Root cause confirmed in rockcraft/models/project.py and pyproject.toml; still unfixed.
76%