{"categories":[{"label":"Build Tools","url":"https://skillfed.io/packages/category/software-development-build-tools/5"}],"enrichment":{"capability":"Validates SPDX 3 documents with context-aware checks for external references, merged graphs, and improved error reporting beyond standard SHACL and JSON schema validation.","skillfed_tags":["spdx","sbom","validation"],"use_cases":["Validate SPDX 3 software bill-of-materials documents before submission to compliance systems.","Check that external component references in an SPDX document are correctly declared and not duplicated.","Validate merged SPDX graphs when combining multiple documents with external references.","Programmatically inspect validation errors in a Python application for custom error handling.","Detect missing or incompatible @context declarations in SPDX 3 JSON files."],"what_it_does":"spdx3-validate is a Python library that validates SPDX 3 documents with awareness of external references and merged document graphs. While tools like pyshacl and check-jsonschema can validate SPDX 3 files against their schema, this package adds context-specific logic: it ignores SHACL errors for missing spdxIds when they are defined in an ExternalMap, validates that ExternalMap spdxIds are not duplicated in the document itself, and can validate merged document graphs to ensure referenced external spdxIds have compatible types when both documents are provided together.\n\nThe package can be used as a command-line tool or imported as a library. The validate() function accepts a single document path or URL, or an iterable of sources, and returns a ValidationResult object containing structured errors. SPDX version is auto-detected from each document's @context, though you can override it. It depends on pyshacl, rdflib, jsonschema, and halo for progress indication.","worth_installing":"Yes, if you need to validate SPDX 3 documents with external reference awareness. The package is actively maintained, has low install friction, carries a permissive MIT license, and adds real value over generic SHACL validation for SPDX-specific use cases. Beta status and early release history suggest caution in production deployments, but the recent activity and zero known vulnerabilities are positive signals."},"id":"spdx3-validate","links":{"html":"https://skillfed.io/packages/spdx3-validate","md":"https://skillfed.io/packages/spdx3-validate.md","pypi":"https://pypi.org/project/spdx3-validate/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-08-10","license_spdx":null,"license_treatment":"permissive","name":"spdx3-validate","python_support":"supports_current","summary":"Validates SPDX 3 data files"},"popularity":{"monthly_downloads":133144,"position":11526,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"0.0.7"}