dennisdoomen / packageguard / 40218849214

82%

push

github

Evaluate SPDX license expressions instead of plain identifiers (#311)

* Evaluate SPDX license expressions instead of plain identifiers

Licenses were compared as whole strings, so a package with "MIT OR
Apache-2.0" failed an allow list that has both MIT and Apache-2.0.

A small parser now reads OR, AND, WITH, parentheses and the "+" suffix,
and replaces deprecated GNU identifiers such as GPL-3.0 with their
current form. Text that is not a valid expression is matched as is.

- Allow: OR needs one allowed option, AND needs all. A WITH term is
  allowed by the full term or by its base license.
- Deny and warn: OR needs every option denied, AND needs one. A WITH
  term is only denied by the full term.
- The reason names the license that matched, for example
  'matches allow list license entry "MIT" (from "MIT OR Apache-2.0")'.
- Legal risk and the init classifier use the least restrictive option of
  an OR and the most restrictive license of an AND.

Closes #217

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Score LGPL licenses as weak copyleft instead of restrictive

The legal risk evaluator checked for restrictive licenses first, using a
substring match on "GPL". Because "LGPL" contains "GPL", every LGPL
license got the restrictive score of 6.0 instead of 3.0.

Also mention license expressions in the risk metrics page, the intro and
the README.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2718 of 3623 branches covered (75.02%)

Branch coverage included in aggregate %.

168 of 168 new or added lines in 8 files covered. (100.0%)

8369 of 9946 relevant lines covered (84.14%)

2198.85 hits per line