🪪 Improvements to spdx license validation (#1634)

jupyter-book · Nov 13, 2024 · 8ea9365 · 8ea9365
1 parent 6f23a6e
commit 8ea9365
Show file tree

Hide file tree

Showing 3 changed files with 80 additions and 7 deletions.
diff --git a/.changeset/curly-readers-compete.md b/.changeset/curly-readers-compete.md
@@ -0,0 +1,5 @@
+---
+'myst-frontmatter': patch
+---
+
+Improvements to spdx license validation
diff --git a/packages/myst-frontmatter/src/licenses/licenses.yml b/packages/myst-frontmatter/src/licenses/licenses.yml
@@ -280,6 +280,53 @@ cases:
         content:
           url: https://example.com
     warnings: 1
+  - title: url string coerces to license from spdx list
+    raw:
+      license: https://creativecommons.org/licenses/by/4.0/
+    normalized:
+      license:
+        content:
+          id: CC-BY-4.0
+          name: Creative Commons Attribution 4.0 International
+          url: https://creativecommons.org/licenses/by/4.0/
+          CC: true
+          free: true
+  - title: url coerces to license from spdx list
+    raw:
+      license:
+        url: https://creativecommons.org/licenses/by/4.0/
+    normalized:
+      license:
+        content:
+          id: CC-BY-4.0
+          name: Creative Commons Attribution 4.0 International
+          url: https://creativecommons.org/licenses/by/4.0/
+          CC: true
+          free: true
+  - title: url coerces to license from spdx list with http
+    raw:
+      license:
+        url: http://creativecommons.org/licenses/by/4.0/
+    normalized:
+      license:
+        content:
+          id: CC-BY-4.0
+          name: Creative Commons Attribution 4.0 International
+          url: https://creativecommons.org/licenses/by/4.0/
+          CC: true
+          free: true
+  - title: url coerces to license from spdx list without trailing slash
+    raw:
+      license:
+        url: https://creativecommons.org/licenses/by/4.0
+    normalized:
+      license:
+        content:
+          id: CC-BY-4.0
+          name: Creative Commons Attribution 4.0 International
+          url: https://creativecommons.org/licenses/by/4.0/
+          CC: true
+          free: true
   - title: string with no spaces coerces to unknown id (and warns)
     raw:
       license: my-custom-license
@@ -288,7 +335,7 @@ cases:
         content:
           id: my-custom-license
     warnings: 1
-  - title: Other short string coerces to note (and warns)
+  - title: Other long string coerces to note (and warns)
     raw:
       license: |
         my custom license but this is really long, like, more than one hundred characters long.
@@ -300,11 +347,21 @@ cases:
             my custom license but this is really long, like, more than one hundred characters long.
             clearly if it is this long it cannot be a name but must be a note.
     warnings: 1
-  - title: Other long string coerces to name (and warns)
+  - title: Other short string coerces to name (and warns)
     raw:
       license: my custom license
     normalized:
       license:
         content:
           name: my custom license
     warnings: 1
+  - title: Long string with "mit" buried in it is not coerced to MIT license
+    raw:
+      license: |
+        This is an open access article. Unrestricted non-commercial use is permitted provided the original work is properly cited
+    normalized:
+      license:
+        content:
+          note: |
+            This is an open access article. Unrestricted non-commercial use is permitted provided the original work is properly cited
+    warnings: 1
diff --git a/packages/myst-frontmatter/src/licenses/validators.ts b/packages/myst-frontmatter/src/licenses/validators.ts
@@ -103,7 +103,8 @@ export function validateLicense(input: any, opts: ValidationOptions): License |
   if (typeof input === 'string') {
     const value = validateString(input, opts);
     if (value === undefined) return undefined;
-    const valueSpdx = correctLicense(value);
+    // Do not try to coerce long values into SPDX licenses
+    const valueSpdx = value.length < 15 ? correctLicense(value) : undefined;
     if (URL_ID_LOOKUP[cleanUrl(value)]) {
       input = { id: URL_ID_LOOKUP[cleanUrl(value)] };
     } else if (isUrl(value)) {
@@ -144,10 +145,20 @@ export function validateLicense(input: any, opts: ValidationOptions): License |
     }
     output.id = idSpdx ?? id;
   } else {
-    validationWarning(
-      `no license ID - using a SPDX license ID is recommended, see https://spdx.org/licenses/`,
-      opts,
-    );
+    if (value.url) {
+      const url = validateUrl(value.url, { property: '', messages: {} }) ?? '';
+      const idFromUrl = URL_ID_LOOKUP[cleanUrl(url)];
+      if (idFromUrl) {
+        output.id = idFromUrl;
+        value.url = ID_LICENSE_LOOKUP[idFromUrl].url;
+      }
+    }
+    if (!output.id) {
+      validationWarning(
+        `no license ID - using a SPDX license ID is recommended, see https://spdx.org/licenses/`,
+        opts,
+      );
+    }
   }
   const expected = output.id ? ID_LICENSE_LOOKUP[output.id] : undefined;
   if (value.url != null) {