Weave Code
Spdx Licenses Laravel Package
composer/spdx-licenses
PHP library providing the official SPDX license and exception lists plus validation for SPDX license expressions. Look up licenses by identifier or name, check OSI approval or deprecation status, and validate license strings for Composer and tooling.
SPDX licenses list and validation library.
Frequently asked questions about Spdx Licenses
- How do I integrate composer/spdx-licenses into a Laravel project for dependency license validation?
- Install via `composer require composer/spdx-licenses`, then wrap the `SpdxLicenses` class in a Laravel ServiceProvider for dependency injection. Use it in middleware to validate licenses in HTTP requests or create an Artisan command for CLI audits. For example, inject it via `app()->make(SpdxLicenses::class)` in your service layer.
- Does composer/spdx-licenses support Laravel 9+ and PHP 8.0+?
- Yes, upgrade to **v1.6.0+** for full PHP 8.0+ support, which aligns with Laravel 9+. Older versions (PHP 5.3–7.1) are deprecated. Always pin to a stable version (e.g., `^1.6`) to avoid SPDX list drift. Check the [README](https://github.com/composer/spdx-licenses) for version-specific requirements.
- Can I use this package to block non-OSI-approved licenses in CI/CD?
- Absolutely. Use `SpdxLicenses::isOsiApprovedByIdentifier()` in a GitHub Action or GitLab CI script to fail builds on non-compliant licenses. For example, add a step like `composer validate --check-licenses` or integrate it with Laravel’s `Artisan::call()` in a custom command. Combine with `validate()` to catch malformed SPDX expressions.
- How do I handle deprecated licenses (e.g., Common-Public-License-1.0) in my Laravel app?
- Use `SpdxLicenses::isDeprecatedByIdentifier()` to check licenses during dependency resolution or runtime. Log warnings via Laravel’s logging system or throw a custom exception (e.g., `InvalidLicenseException`) to enforce compliance. For production, consider blocking deprecated licenses via middleware or a Composer plugin.
- Is composer/spdx-licenses suitable for validating complex SPDX expressions like `MIT AND Apache-2.0`?
- Yes, the `validate()` method supports full SPDX expression syntax, including `AND`, `OR`, and `WITH` clauses. However, regex-based validation may miss edge cases—unit test against known expressions (e.g., `MIT AND (Apache-2.0 OR GPL-3.0)`) to ensure robustness. For critical projects, manually verify complex expressions against the [SPDX spec](https://spdx.org/specifications).
- How can I cache the SpdxLicenses instance to improve performance in Laravel?
- The `getLicenses()` method loads all licenses (~100KB) into memory. Cache the `SpdxLicenses` instance as a singleton in Laravel’s container (e.g., bind it in a ServiceProvider) or use PHP’s `static` property. For CLI tools, cache globally in a static variable. Avoid recreating the instance per request to minimize overhead.
- Are there alternatives to composer/spdx-licenses for SPDX validation in Laravel?
- Primary alternatives include **spdx-tools/php-spdx** (more verbose API) and **frostbite1994/spdx** (simpler but less maintained). However, `composer/spdx-licenses` is the **official SPDX list** (3.28+) with direct Composer integration, making it ideal for Laravel. For lightweight needs, consider a custom regex solution, but it won’t cover OSI approval or deprecation status.
- Can I extend composer/spdx-licenses to enforce custom license policies (e.g., reject GPLv3 in proprietary modules)?
- Yes, use the `validate()` method with a custom callback to implement organization-specific rules. For example, override the validator to reject GPLv3 by checking `SpdxLicenses::isOsiApprovedByIdentifier()` and adding your logic. Combine with Laravel’s policy system or middleware to enforce these rules at the application level.
- How do I audit existing Laravel dependencies for SPDX compliance?
- Run a script using `SpdxLicenses::validate()` on your `composer.json` dependencies. For example, iterate over `composer.json['require']` and check each license with `getIdentifierByName()`. Log results or fail builds in CI/CD. Tools like `composer validate` can also help, but `composer/spdx-licenses` provides finer-grained control.
- Will composer/spdx-licenses work in Lumen or standalone PHP scripts outside Laravel?
- Yes, the package is framework-agnostic and works in **Lumen**, standalone PHP scripts, or any Composer-based project. For Lumen, inject `SpdxLicenses` via the container like Laravel. In standalone scripts, instantiate it directly (e.g., `new SpdxLicenses()`). The API remains identical across environments.
Weaver
How can I help you explore Laravel packages today?