Spdx Licenses Laravel Package

Getting Started

1. Install the package via Composer:

   composer require composer/spdx-licenses
   

2. Start validating licenses in your own code or tools:

   use Composer\Spdx\SpdxLicenses;
   
   $license = 'MIT';
   if (SpdxLicenses::isValid($license)) {
       echo "Valid SPDX ID: $license\n";
   }
   
   // Get full license data
   $data = SpdxLicenses::getLicenseById($license);
   echo "Name: " . $data['name'] . "\n";
   echo "OSI Approved: " . ($data['osiApproved'] ? 'Yes' : 'No') . "\n";
   

3. Explore available identifiers (e.g., for autocomplete in tooling):

   $ids = SpdxLicenses::getAllLicenseIds();
   // Returns array like ['0BSD', 'AAL', 'Abstyles', ...]
   

First use case: Add a license validation step to your CI pipeline using this package to prevent invalid or deprecated license IDs from creeping into your project.

Implementation Patterns

• CI/CD Validation Hook:
  Integrate into Composer scripts or GitHub Actions to run license checks on composer.json or installed dependencies:

  # In composer.json
  "scripts": {
      "check-licenses": "php ./scripts/validate-licenses.php"
  }
  

• Composer Plugin Integration:
  Build or extend a Composer plugin (e.g., for license auditing) using the package’s API to:

  • Validate license field in composer.json
  • Normalize user-supplied license IDs (e.g., mit → MIT)
  • Warn about non-OSI-approved or deprecated IDs

• CLI Tooling / Audit Scripts:
  Scan vendor directories or JSON export (composer show -i --format=json) and cross-check against SPDX:

  $packages = json_decode(file_get_contents('composer.json'), true)['require'] ?? [];
  foreach ($packages as $pkg => $version) {
      $info = SpdxLicenses::getLicenseById($pkgLicense);
      if (!$info) { /* handle unknown license */ }
  }
  

• Metadata-Driven UI/Reports:
  Leverage nested data for richer reporting:

  • Highlight deprecated licenses ('deprecated' => true)
  • Flag see-also links or special exceptions ('exceptions' => [...])
  • Filter only OSI-approved licenses for compliance dashboards

Gotchas and Tips

• ⚠️ Case Sensitivity: SPDX IDs are case-sensitive (MIT, not mit). Use SpdxLicenses::validate($license, true) to normalize (enforce uppercase) before validation.

• ⚠️ UNKNOWN vs NOASSERTION vs NONE:
  These special identifiers (e.g., used in composer.json) are not real SPDX IDs and will return false from isValid(). Handle them explicitly if needed:

  $id = $json['license'];
  if (in_array($id, ['UNLICENSED', 'NOASSERTION', 'NONE'], true)) {
      // Handle special cases manually
  } else {
      SpdxLicenses::isValid($id);
  }
  

• 🔍 Missing License Data?
  getLicenseById() returns null for unknown IDs — always null check before accessing keys (e.g., $data['osiApproved'] ?? false).

• 📦 Data Source:
  License metadata is bundled via data/spdx-licenses.json. Update frequency depends on package releases — check SPDX’s official site for latest IDs. For bleeding-edge accuracy, contribute PRs or pin to latest commit.

• 🔄 Extending Metadata:
  You can safely override or augment license data in your app by copying SpdxLicenses::getAllLicenses() and adding custom keys — but avoid modifying the package’s source.

• 🐞 Debugging Tip:
  If isValid() fails unexpectedly, compare against the raw list:

  $id = 'GPL-3.0-only';
  var_dump(in_array($id, SpdxLicenses::getAllLicenseIds(), true));