licence_audit/spdx

Resolution of declared SPDX licence identifiers and expressions to their canonical licence text.

The canonical text is fetched from a pinned, immutable revision of the SPDX License List data repository so results are reproducible: the same identifier always yields byte-identical text regardless of when the fetch happens. Detail records are served as JSON from raw.githubusercontent.com at the pinned commit; the licenseText (for licences) and licenseExceptionText (for WITH exceptions) fields contain the text verbatim.

A declared licence may be a bare identifier (Apache-2.0) or a compound expression (MIT OR Apache-2.0 WITH LLVM-exception). Expressions are reduced to the set of identifiers they reference: for an OR all alternatives are included (we never try to pick a “best” one), and AND obviously needs all operands. LicenseRef-*/DocumentRef-* custom references have no canonical text and make an expression unresolvable.

Types

IndexKind

</>

pub type IndexKind {
  LicenceIndex
  ExceptionIndex
}

Constructors

```
LicenceIndex
```
```
ExceptionIndex
```

Requirement

</>

An identifier referenced by a declared licence expression.

pub type Requirement {
  LicenseRequirement(id: String)
  ExceptionRequirement(id: String)
}

Constructors

```
LicenseRequirement(id: String)
```
An SPDX licence identifier, e.g. Apache-2.0 (any trailing + stripped).
```
ExceptionRequirement(id: String)
```
An SPDX licence exception identifier appearing after WITH.

Values

canonical_requirement

</>

pub fn canonical_requirement(
  requirement: Requirement,
  canonical_ids: List(String),
) -> Result(Requirement, Nil)

Normalize an identifier to the exact casing used by the pinned SPDX list. SPDX identifiers are case-insensitive, while the raw GitHub paths are not.

decode_cached_index

</>

pub fn decode_cached_index(
  encoded: String,
) -> Result(List(String), Nil)

decode_index

</>

pub fn decode_index(
  kind: IndexKind,
  body: String,
) -> Result(List(String), Nil)

Decode the canonical identifiers from a pinned SPDX index response.

decode_text

</>

pub fn decode_text(
  requirement: Requirement,
  body: String,
) -> Result(String, Nil)

Extract the canonical text from a fetched detail-record body. Uses licenseText for licences and licenseExceptionText for exceptions. Returns Error(Nil) when the field is absent (e.g. an unknown identifier’s 404 body).

detail_request

</>

pub fn detail_request(
  requirement: Requirement,
) -> request.Request(String)

Build the request that fetches the JSON detail record for a requirement from the pinned SPDX License List revision.

encode_index

</>

pub fn encode_index(ids: List(String)) -> String

identifiers_of

</>

pub fn identifiers_of(
  expression: String,
) -> Result(List(Requirement), Nil)

Reduce a single declared licence string to its required identifiers.

index_kind

</>

pub fn index_kind(requirement: Requirement) -> IndexKind

index_request

</>

pub fn index_request(kind: IndexKind) -> request.Request(String)

Build the request for the pinned SPDX licence or exception index. The index supplies canonical identifier casing before detail records are requested.

index_slug

</>

pub fn index_slug(kind: IndexKind) -> String

license_list_commit

</>

pub const license_list_commit: String

Immutable commit in spdx/license-list-data, pinned to the v3.28.0 release. Pinning to a commit (not a tag) guarantees the fetched text can never drift.

required_identifiers

</>

pub fn required_identifiers(
  declared: List(String),
) -> Result(List(Requirement), Nil)

Reduce a list of declared licence strings (each a bare identifier or an expression) to the deduplicated set of SPDX identifiers whose canonical text is required. Returns Error(Nil) for invalid syntax or a LicenseRef-/DocumentRef- custom licence with no canonical text.

synthetic_path

</>

pub fn synthetic_path(requirement: Requirement) -> String

Synthetic archive path a resolved SPDX record is rendered under, clearly labelling it as canonical text synthesized from the SPDX License List rather than material shipped in the package source.