pmonks / clj-spdx Goto Github PK

Steps to Reproduce:

(require '[spdx.expressions :as sexp])
(sexp/extract-ids (sexp/parse "GPL-2.0+"))

Expected Result:

#{"GPL-2.0-or-later"}

Actual Result:

#{"GPL-2.0"}

SPDX v3.0 is currently in RC and a GA will likely be available soon, and while it mostly doesn't impact clj-spdx (being mostly model changes, which this library doesn't yet implement), there will be some changes necessary, including:

• Waiting for spdx/Spdx-Java-Library#178 (note: technically optional, given we don't use the model classes from that library that are most affected by the new version of the spec)
• Update the SPDX expression parser to support AdditionRefs (done in rev e75f9cd)

Currently the parse trees returned from spdx.expressions/parse don't represent the precedence order for AND and OR (as specified in Annex D of the SPDX specification). Rather than leaving this to users of clj-spdx, the library should explicitly represent operator precedence (i.e. by introducing grouping where it didn't exist in the original expression) to make it explicit.

For example, this SPDX expression:

GPL-3.0 OR MIT AND Apache-2.0

should be parsed to:

[{license-id "GPL-3.0-only"} :or [{license-id "MIT"} :and {license-id "Apache-2.0"}]]

The Spdx-Java-Library is exceptionally expensive to initialise with the basic reference data (license and exception lists, templates etc.). On my laptop it generally takes more than a minute to pull this information down, parse it, and load it into memory.

There may be a way to cache the library's state to disk (e.g. via serialisation, perhaps using nippy) and only incur the cost of initialisation when the lists have changes (which can be determined via an eTag request to the two list URLs).