---
id: spdx3-validate
version: "0.0.7"
license: unclear
license_treatment: permissive
maintenance: active
---

# spdx3-validate — Validates SPDX 3 data files

License: permissive · Maintenance: active · Downloads: 133.1K/mo

## What it is and what it does

spdx3-validate is a Python library that validates SPDX 3 documents with awareness of external references and merged document graphs. While tools like pyshacl and check-jsonschema can validate SPDX 3 files against their schema, this package adds context-specific logic: it ignores SHACL errors for missing spdxIds when they are defined in an ExternalMap, validates that ExternalMap spdxIds are not duplicated in the document itself, and can validate merged document graphs to ensure referenced external spdxIds have compatible types when both documents are provided together.

The package can be used as a command-line tool or imported as a library. The validate() function accepts a single document path or URL, or an iterable of sources, and returns a ValidationResult object containing structured errors. SPDX version is auto-detected from each document's @context, though you can override it. It depends on pyshacl, rdflib, jsonschema, and halo for progress indication.

Use it for:

- Validate SPDX 3 software bill-of-materials documents before submission to compliance systems.
- Check that external component references in an SPDX document are correctly declared and not duplicated.
- Validate merged SPDX graphs when combining multiple documents with external references.
- Programmatically inspect validation errors in a Python application for custom error handling.
- Detect missing or incompatible @context declarations in SPDX 3 JSON files.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Validates SPDX 3 documents with context-aware checks for external references, merged graphs, and improved error reporting beyond standard SHACL and JSON schema validation.

Yes, if you need to validate SPDX 3 documents with external reference awareness. The package is actively maintained, has low install friction, carries a permissive MIT license, and adds real value over generic SHACL validation for SPDX-specific use cases. Beta status and early release history suggest caution in production deployments, but the recent activity and zero known vulnerabilities are positive signals.

## Install

pip install spdx3-validate
uv add spdx3-validate
poetry add spdx3-validate

## Installing spdx3-validate

Before you install: Low friction: pure Python wheel with four runtime dependencies (halo, jsonschema, pyshacl, rdflib). Active maintenance with a release within days of the fact sheet date. Supports Python 3.8 through 3.14.

License in practice: MIT license (permissive) means you can use, modify, and distribute this package freely in commercial and private projects with minimal restrictions.

Quickstart:

pip install spdx3-validate

import spdx3_validate

result = spdx3_validate.validate("doc.spdx3.json")
if not result:
    print(result)  # prints errors, one per line

Requires Python 3.8 or later; SPDX documents must include a valid @context field for version detection.

Verify before relying:

- Whether pyshacl, rdflib, and jsonschema are lightweight or bring significant transitive dependencies.
- Performance characteristics when validating large or complex SPDX documents.
- Whether the library is suitable for production use or primarily experimental (beta status).

## Package facts

- License: not declared (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 133.1K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

SPDX 3 validation, validate SPDX documents, SPDX compliance checking, software bill of materials validation, SBOM validator, SHACL validation SPDX, external map validation, spdx, sbom, validation

[View on SkillFed](https://skillfed.io/packages/spdx3-validate) · [View on PyPI](https://pypi.org/project/spdx3-validate/)