In SPDX output, have PackageLicenseDeclared give the license directly instead of creating an unnecessary LicenseRef.

[vargenau]

Describe the Feature
In SPDX output, have PackageLicenseDeclared give the license directly instead of creating an unnecessary LicenseRef.

Use Cases
It will be easier for tools to process the SPDX files.

Implementation Changes
One would need to be able to identify a license already in SPDX format.

Tern is run with the following command:

tern report -f spdxtagvalue -i danmcni/danm-cni-plugins:latest -o danm-cni-plugins.spdx

danm-cni-plugins.spdx.txt

In the SPDX output file, you have the following:

PackageLicenseDeclared: LicenseRef-c66410f

and

LicenseID: LicenseRef-c66410f
ExtractedText: <text>Original license: GPL-2.0-only</text>

The license here is correctly detected and the name is the one found in the SPDX license list.
So it would be much better to output:

PackageLicenseDeclared: GPL-2.0-only

[rnjudge]

Thanks for the issue @vargenau. Unfortunately, we can't always use the direct license value as we have no way of checking currently if the license is an approved license on the SPDX license list. Additionally, sometimes licenses that are on the approved license list are not reported using the correct identifier and we would need a way to interpret these causes and augment these licenses to their correct license identifier. Therefore, we have to default to using a LicenseRef currently.

Your suggestion would certainly be a good enhancement and we have an issue open for this: #281. There was also talk in the SPDX community a few years ago about creating a license mapping repo but not much work has been done on this yet. I think the repo was created but no commits have been added.

[vargenau]

Hi Rose,

The following Python code should be able to do the job: https://pypi.org/project/spdx-lookup/.

Are you aware of it?

[ivanayov]

I can work on this.

[rnjudge]

Hi Rose,

The following Python code should be able to do the job: https://pypi.org/project/spdx-lookup/.

Are you aware of it?

I was not aware, thank you! We will try to use this.

[vargenau]

Hi,

I have found a better SPDX license expression parser:
https://github.com/nexB/license-expression

To install it:

pip install license-expression

Then you have to apply the following patch to file formats/spdx/spdxtagvalue/package_helpers.py

12a13
> from license_expression import get_spdx_licensing
13a15,19
> def is_spdx_license_expression(license):
>     '''Return True if the license is a valid SPDX license expression, else
>     return False'''
>     licensing = get_spdx_licensing()
>     return licensing.validate(license).errors == []
56,58c62,68
<     if mapping['PackageLicenseDeclared']:
<         block += 'PackageLicenseDeclared: {}\n'.format(
<             spdx_common.get_license_ref(mapping['PackageLicenseDeclared']))
---
>     declared = mapping['PackageLicenseDeclared']
>     if declared:
>         if is_spdx_license_expression(declared):
>             block += 'PackageLicenseDeclared: ' + declared + '\n'
>         else:
>             block += 'PackageLicenseDeclared: {}\n'.format(
>                 spdx_common.get_license_ref(declared))

This will produce a PackageLicenseDeclared as proposed above.

What remains to do is to remove the now useless LicenseID and ExtractedText that are still generated, I did not find an easy way to do it.

Also, the is for the SPDX tag;value format only, I did tot check what needs to be done for the SPDX JSON format.

Tell me if this is useful and can be integrated.

[ivanayov]

Thank you @vargenau , it was very useful. It's addressed for both tag/value and json in #1159.