pyspdx

What it is and what it does

pyspdx is a small Python library that validates and tokenizes SPDX license expressions—the standardized format for describing software licenses and their combinations. It exposes two functions: validate() checks whether a license expression conforms to the SPDX v2.3 specification and raises ValueError if it does not, while tokenize() breaks an expression into its constituent license identifiers. The library handles complex expressions with logical operators (OR, AND, WITH) and document references, relying on pyparsing for the underlying grammar implementation.

The package is useful for tools that need to parse or validate license metadata in software bills of materials, dependency manifests, or compliance workflows. It is dormant but recently maintained; however, its GPL-2.0-only copyleft license means it can only be used in projects that are themselves distributed under compatible copyleft terms.

Use it for:

• Validate license expressions in SBOM (software bill of materials) files before processing or storing them.
• Parse complex license combinations in dependency metadata to extract individual license identifiers for compliance audits.
• Build license compliance tooling that needs to reject malformed or non-standard SPDX expressions early.
• Tokenize license strings to feed into downstream license compatibility or risk analysis systems.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Validates and tokenizes SPDX license expressions according to the SPDX v2.3 specification, parsing complex license combinations with operators like OR, AND, and WITH.

Yes, if your project is copyleft-licensed or can accommodate GPL-2.0-only. The package is lightweight, has no security vulnerabilities, and solves a specific problem (SPDX expression validation) with a minimal API. Dormant maintenance is acceptable for a narrow, stable utility. If your project is proprietary or permissively licensed, the copyleft license makes this a blocker.

Install

pyspdx on PyPI

pip install pyspdx

uv add pyspdx

poetry add pyspdx

Installing pyspdx

Before you install

Low install friction with a single lightweight dependency (pyparsing). Repository is dormant but not archived; last commit was recent (2025-02-10), suggesting minimal maintenance rather than abandonment.

License in practice

Licensed under GPL-2.0-only (copyleft). Any code that imports this library must be distributed under compatible copyleft terms; proprietary or permissive-licensed projects cannot use it without license conflict.

Quickstart

pip install pyspdx

from pyspdx import validate, tokenize

validate("MIT")  # Valid, does nothing
validate("(Apache-2.0 OR MIT) AND BSD-3-Clause")  # Valid
tokenize("MIT")  # Returns ["MIT"]

Requires Python 3.9 or later (supports 3.9–3.13); GPL-2.0-only license means consuming code must be copyleft-compatible.

Verify before relying

• Whether the package handles all SPDX v2.3 license expression edge cases or has known limitations beyond what the description states.
• Performance characteristics when parsing very large or deeply nested license expressions.
• Whether the tokenize function output format is stable across versions or documented beyond the single example shown.

Package facts

Evidence: pyspdx-1.2.0-py3-none-any.whl

Tags

More Quality Assurance packages