--- id: pyspdx version: "1.2.0" license: GPL-2.0-only license_treatment: copyleft maintenance: dormant --- # pyspdx — Validate SPDX expressions License: copyleft · Maintenance: dormant · Downloads: 95.3K/mo ## What it is and what it does pyspdx is a small Python library that validates and tokenizes SPDX license expressions—the standardized format for describing software licenses and their combinations. It exposes two functions: validate() checks whether a license expression conforms to the SPDX v2.3 specification and raises ValueError if it does not, while tokenize() breaks an expression into its constituent license identifiers. The library handles complex expressions with logical operators (OR, AND, WITH) and document references, relying on pyparsing for the underlying grammar implementation. The package is useful for tools that need to parse or validate license metadata in software bills of materials, dependency manifests, or compliance workflows. It is dormant but recently maintained; however, its GPL-2.0-only copyleft license means it can only be used in projects that are themselves distributed under compatible copyleft terms. Use it for: - Validate license expressions in SBOM (software bill of materials) files before processing or storing them. - Parse complex license combinations in dependency metadata to extract individual license identifiers for compliance audits. - Build license compliance tooling that needs to reject malformed or non-standard SPDX expressions early. - Tokenize license strings to feed into downstream license compatibility or risk analysis systems. ## Worth the install? AI-flagged interpretation of the facts above — verify before relying. Validates and tokenizes SPDX license expressions according to the SPDX v2.3 specification, parsing complex license combinations with operators like OR, AND, and WITH. Yes, if your project is copyleft-licensed or can accommodate GPL-2.0-only. The package is lightweight, has no security vulnerabilities, and solves a specific problem (SPDX expression validation) with a minimal API. Dormant maintenance is acceptable for a narrow, stable utility. If your project is proprietary or permissively licensed, the copyleft license makes this a blocker. ## Install pip install pyspdx uv add pyspdx poetry add pyspdx ## Installing pyspdx Before you install: Low install friction with a single lightweight dependency (pyparsing). Repository is dormant but not archived; last commit was recent (2025-02-10), suggesting minimal maintenance rather than abandonment. License in practice: Licensed under GPL-2.0-only (copyleft). Any code that imports this library must be distributed under compatible copyleft terms; proprietary or permissive-licensed projects cannot use it without license conflict. Quickstart: pip install pyspdx from pyspdx import validate, tokenize validate("MIT") # Valid, does nothing validate("(Apache-2.0 OR MIT) AND BSD-3-Clause") # Valid tokenize("MIT") # Returns ["MIT"] Requires Python 3.9 or later (supports 3.9–3.13); GPL-2.0-only license means consuming code must be copyleft-compatible. Verify before relying: - Whether the package handles all SPDX v2.3 license expression edge cases or has known limitations beyond what the description states. - Performance characteristics when parsing very large or deeply nested license expressions. - Whether the tokenize function output format is stable across versions or documented beyond the single example shown. ## Package facts - License: GPL-2.0-only (copyleft) - Python support: supports_current - Install friction: low - Maintenance: dormant - Downloads: 95.3K/month (top 15,000 on PyPI) - Known vulnerabilities: none known ## Tags spdx license expression validation, parse spdx license strings, validate license expressions, spdx expression parser, license compliance checking, license-compliance, spdx [View on SkillFed](https://skillfed.io/packages/pyspdx) · [View on PyPI](https://pypi.org/project/pyspdx/)