{"id":15048092,"url":"https://github.com/github/go-spdx","last_synced_at":"2026-02-20T02:03:17.488Z","repository":{"id":64301092,"uuid":"528388612","full_name":"github/go-spdx","owner":"github","description":"Golang implementation of a checker for determining if an SPDX ID satisfies an SPDX Expression.","archived":false,"fork":false,"pushed_at":"2025-04-12T04:09:35.000Z","size":241,"stargazers_count":37,"open_issues_count":5,"forks_count":9,"subscribers_count":179,"default_branch":"main","last_synced_at":"2025-04-13T00:47:59.189Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/github.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":"CODEOWNERS","security":"SECURITY.md","support":"SUPPORT.md","governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2022-08-24T11:16:05.000Z","updated_at":"2025-04-08T10:12:18.000Z","dependencies_parsed_at":"2024-04-30T08:27:35.030Z","dependency_job_id":"c968ce3e-c37a-4e71-b913-7dacccd60cca","html_url":"https://github.com/github/go-spdx","commit_stats":{"total_commits":94,"total_committers":7,"mean_commits":"13.428571428571429","dds":"0.37234042553191493","last_synced_commit":"c3fae6997f148eda873af9edff82a83410f254ca"},"previous_names":["github/spdx-expression"],"tags_count":15,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fgo-spdx","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fgo-spdx/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fgo-spdx/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/github%2Fgo-spdx/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/github","download_url":"https://codeload.github.com/github/go-spdx/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248650437,"owners_count":21139672,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-09-24T21:08:03.667Z","updated_at":"2026-02-20T02:03:17.482Z","avatar_url":"https://github.com/github.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003csub\u003e[![Go Reference](https://pkg.go.dev/badge/github.com/github/go-spdx/v2@v2.4.0/spdxexp.svg)](https://pkg.go.dev/github.com/github/go-spdx/v2@v2.4.0/spdxexp) spdxexp\u003c/sub\u003e \u003cbr\u003e\n\u003csub\u003e[![Go Reference](https://pkg.go.dev/badge/github.com/github/go-spdx/v2@v2.4.0/spdxexp/spdxlicenses.svg)](https://pkg.go.dev/github.com/github/go-spdx/v2@v2.4.0/spdxexp/spdxlicenses) spdxlicenses\u003c/sub\u003e\n\n# go-spdx\n\nGolang implementation of a checker for determining if a set of SPDX IDs satisfies an SPDX Expression.\n\n## Installation\n\nThere are several ways to include a go package.  To download and install, you can use `go get`.  The command for that is:\n\n```sh\ngo get github.com/github/go-spdx@latest\n```\n\n## Packages\n\n- [spdxexp](https://pkg.go.dev/github.com/github/go-spdx/spdxexp) - Expression package validates licenses and determines if a license expression is satisfied by a list of licenses. Validity of a license is determined by the SPDX license list.\n\n## Public API\n\n_NOTE: The public API is initially limited to the Satisfies and ValidateLicenses functions.  If\nthere is interest in the output of the parser or license checking being public, please submit an\nissue for consideration._\n\n### Function: Satisfies\n\n```go\nSatisfies(testExpression string, allowedList []string, options *Options)\n```\n\n**Parameter: testExpression**\n\ntestExpression is an [SPDX expression](https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/#d1-overview) describing the licensing terms of source code or a binary file.\n\nExample expressions that can be used for testExpression:\n\n```go\n\"MIT\"\n\"MIT AND Apache-2.0\"\n\"MIT OR Apache-2.0\"\n\"MIT AND (Apache-1.0 OR Apache-2.0)\"\n\"Apache-1.0+\"\n\"DocumentRef-spdx-tool-1.2:LicenseRef-MIT-Style-2\"\n\"GPL-2.0 WITH Bison-exception-2.2\"\n```\n\n_See satisfies_test.go for more example expressions._\n\n**Parameter: allowedList**\n\nallowedList is an array of single licenses describing what licenses can be used to satisfy the testExpression.\n\nExample allowedList:\n\n```go\n[]string{\"MIT\"}\n[]string{\"MIT\", \"Apache-2.0\"}\n[]string{\"MIT\", \"Apache-2.0\", \"ISC\", \"GPL-2.0\"}\n[]string{\"MIT\", \"Apache-1.0+\"}\n[]string{\"GPL-2.0-or-later\"}\n```\n\n**N.B.** If at least one of expressions from `allowedList` is not a valid SPDX expression, the call\nto `Satisfies` will produce an error. Use [`ValidateLicenses`](###-ValidateLicenses) function\nto first check if all of the expressions from `allowedList` are valid.\n\n#### Examples: Satisfies returns true\n\n[Go Playground for Satisfies](https://go.dev/play/p/Ul8H15hyEpQ)\n\n```go\nSatisfies(\"MIT\", []string{\"MIT\"})\nSatisfies(\"MIT\", []string{\"MIT\", \"Apache-2.0\"})\nSatisfies(\"Apache-2.0\", []string{\"Apache-1.0+\"})\nSatisfies(\"MIT OR Apache-2.0\", []string{\"Apache-2.0\"})\nSatisfies(\"MIT OR Apache-2.0\", []string{\"MIT\", \"Apache-2.0\"})\nSatisfies(\"MIT AND Apache-2.0\", []string{\"MIT\", \"Apache-2.0\"})\nSatisfies(\"MIT AND Apache-2.0\", []string{\"MIT\", \"Apache-2.0\", \"GPL-2.0\"})\n```\n\n#### Examples: Satisfies returns false\n\n```go\nSatisfies(\"MIT\", []string{\"Apache-2.0\"})\nSatisfies(\"Apache-1.0\", []string{\"Apache-2.0+\"})\nSatisfies(\"MIT AND Apache-2.0\", []string{\"MIT\"})\n```\n\n### ValidateLicenses\n\n```go\nfunc ValidateLicenses(licenses []string) (bool, []string)\n```\n\nFunction `ValidateLicenses` is used to determine if any of the provided license expressions is\ninvalid.\n\n**parameter: licenses**\n\nLicenses is a slice of strings which must be validated as SPDX expressions.\n\n**returns**\n\nFunction `ValidateLicenses` has 2 return values. First is `bool` which equals `true` if all of\nthe provided licenses provided are valid, and `false` otherwise.\n\nThe second parameter is a slice of all invalid licenses which were provided.\n\n#### Examples: ValidateLicenses returns no invalid licenses\n\n```go\nvalid, invalidLicenses := ValidateLicenses([]string{\"Apache-2.0\"})\nassert.True(valid)\nassert.Empty(invalidLicenses)\n```\n\n#### Examples: ValidateLicenses returns invalid licenses\n\n```go\nvalid, invalidLicenses := ValidateLicenses([]string{\"NON-EXISTENT-LICENSE\", \"MIT\"})\nassert.False(valid)\nassert.Contains(invalidLicenses, \"NON-EXISTENT-LICENSE\")\nassert.NotContains(invalidLicenses, \"MIT\")\n```\n\n#### Examples: ValidateLicenses works with SPDX expressions\n\n```go\nvalid, invalidLicenses := ValidateLicenses([]string{\"MIT AND APACHE-2.0\"})\nassert.True(valid)\nassert.NotContains(invalidLicenses, \"MIT AND APACHE-2.0\")\n```\n\n### ExtractLicenses\n\n```go\nfunc ExtractLicenses(expression string) ([]string, error)\n```\n\nFunction `ExtractLicenses` is used to extract licenses from the given expression without duplicates.\n\n**parameter: expression**\n\n`expression` is an SPDX expression string.\n\n**returns**\n\nFunction `ExtractLicenses` has 2 return values. First is `[]string` which contains all of the SPDX licenses without duplicates.\n\nThe second return value is an `error` which is not `nil` if the given expression is not a valid SPDX expression.\n\n#### Example\n\n```go\nlicenses, err := ExtractLicenses(\"(MIT AND APACHE-2.0) OR (APACHE-2.0)\")\nassert.Equal(licenses, []string{\"MIT\", \"Apache-2.0\"})\n```\n\n## Background\n\nThis package was developed to support testing whether a repository's license requirements are met by an allowed-list of licenses.\n\nDependencies are defined in [go.mod](./go.mod).\n\nContributions and requests are welcome.  Refer to the [Contributing](#contributing) section for more information including how to set up a test environment and install dependencies.\n\n## License\n\nThis project is licensed under the terms of the MIT open source license. Please refer to [MIT](./LICENSE.md) for the full terms.\n\n## Maintainers\n\n- @elrayle\n- @dangoor\n\n## Support\n\nYou can expect the following support:\n\n- bug fixes\n- review of feature request issues\n- review of questions in discussions\n\n## Contributing\n\nContributions in the form of bug identification Issues, bug fix PRs, and feature requests are welcome.  See [CONTRIBUTING.md](./CONTRIBUTING.md) for more information on how to get involved and set up a testing environment.\n\n_NOTE: The list of valid licenses is maintained manually.  If you notice a missing license, an excellent way to contribute to the long term viability of this package is to open an Issue or PR addressing the missing license._\n\n## Acknowledgement\n\nThe process for parsing and evaluating expressions is a translation from JavaScript to Go based heavily on the JavaScript implementation defined across several repositories.\n\n- [spdx-satisfies.js](https://github.com/clearlydefined/spdx-satisfies.js)\n- [spdx-expression-parse.js](https://github.com/clearlydefined/spdx-expression-parse.js)\n- [spdx-ranges](https://github.com/jslicense/spdx-ranges.js)\n- [spdx-compare](https://github.com/jslicense/spdx-compare.js)\n- [spdx-license-ids](https://github.com/jslicense/spdx-license-ids)\n- [spdx-exceptions](https://github.com/jslicense/spdx-exceptions.json)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgithub%2Fgo-spdx","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgithub%2Fgo-spdx","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgithub%2Fgo-spdx/lists"}