Request for Handling Custom Licenses in Document and Package Validators about tools-python HOT 6 CLOSED

Hi @meer-khan, please refer to this section in the SPDX specification or the spec example. Custom licenses have to be defined separately in an SPDX document and then referenced by their LicenseRef.

from tools-python.

Hi @armintaenzertng ,
I appreciate your quick response to my previous query. I would like to seek further clarification on a specific aspect of the spdx-tools library.

Could you please provide insights into how we can identify licenses that are not part of the SPDX license list? Specifically, I am looking for guidance on distinguishing licenses that require separate definition in an SPDX document and subsequent referencing through LicenseRef. Currently, when we validate the entire document using spdx-tools, warnings are generated for non-SPDX licenses. In our use case, it is crucial to ascertain which licenses fall outside the SPDX scope before initiating the package creation process. This enables us to define all non-SPDX licenses in the document upfront, facilitating a smooth progression through subsequent stages.

Your expertise on this matter would be immensely valuable, and I look forward to your guidance.

from tools-python.

Could you please provide insights into how we can identify licenses that are not part of the SPDX license list?

We use the library nexB/license-expression/ and that can provide you with a list of invalid names, e.g. foo in the following example:

>>> licensing.validate('foo and MIT and GPL-2.0+')
ExpressionInfo(
    original_expression='foo and MIT and GPL-2.0+',
    normalized_expression=None,
    errors=['Unknown license key(s): foo'],
    invalid_symbols=['foo']
)

But SPDX is rather strict on that: licenses must be either from the license list or present as ExtractedLicensingInfo.

And I am also confused by CSV. There is no CSV SPDX format and the plain list format seems to be insufficient to contain the hierarchical data. Can you explain what you are doing here?

If you want to extend the tools capabilities for your use case, I am happy to work with you on a contribution from your side for that.

from tools-python.

Hi @maxhbr I would love to discuss the use case I am working on. Can you share your email, I will brief you about all details there. and Yes I am positive that we can extend the capabilities of this tool based on my experience of working on SBOMs for clients and Technical Teams.

from tools-python.

This Thursday (December 21th, 2023, 9:00am to 9:30am, (UTC-08:00) Pacific Time - Los Angeles) is the public python tools meeting. You can join there to discuss it. You should be able to see the invite in the calendar attached to the groups.io mailing-list on https://spdx.dev/engage/participate/technical-team/.

These lists are also a good place for discussions.

from tools-python.

Sure, thank you for providing me with this meeting update I also got email addresses where I can share my experience with SBOMs in SPDX and CycloneDX.

Thanks again @maxhbr @armintaenzertng

from tools-python.