fix: evaluate full SPDX license expressions - #98
Conversation
The header regex stopped at the first identifier, so MIT OR GPL-3.0 was recorded as MIT and allowed. Capture the whole expression and fail closed if any symbol is blocked. Fixes NVIDIA#86 Signed-off-by: mimran-khan <mohammed_imran.khan@outlook.com>
rng1995
left a comment
rng1995
left a comment
There was a problem hiding this comment.
The focused license suite passes (28 tests), with Ruff and diff checks clean, but compound SPDX headers still pass in common block/HTML comment forms. Blocking reproduction is inline. The shared Gitleaks failure is from non-ancestor commits on an unrelated branch.
|
|
||
| # SPDX header pattern for source files | ||
| SPDX_LICENSE_PATTERN = r"SPDX-License-Identifier:\s*([A-Za-z0-9.\-+]+)" | ||
| SPDX_LICENSE_PATTERN = r"SPDX-License-Identifier:\s*([^\n]+)" |
There was a problem hiding this comment.
[P1] Stop the capture before comment terminators
Capturing the entire line leaves closing comment syntax attached to the final SPDX symbol. For example, /* SPDX-License-Identifier: MIT OR GPL-3.0 */ in a scanned .js file becomes MIT OR GPL-3.0 */; GPL-3.0 */ is treated as unknown, and default (non-strict) validation passes with only a warning. HTML-comment headers have the same problem. Please parse a valid SPDX expression without *//--> (ideally with the existing SPDX expression parser) so the blocked component cannot be hidden.
There was a problem hiding this comment.
Yep, /* SPDX-License-Identifier: MIT OR GPL-3.0 */ was capturing GPL-3.0 */ as the last symbol, so default mode only warned.
I strip */ and --> after the capture, then evaluate the expression as before. Added JS block-comment and HTML-comment cases; both fail closed on GPL-3.0.
There was a problem hiding this comment.
Thanks for adding the block-comment and HTML cases. This still strips the terminator only when it is at the end of the line. With an inline block comment containing SPDX-License-Identifier: MIT OR GPL-3.0 followed by code on the same line, the GPL identifier retains the terminator and code suffix, so default validation passes with only an unknown-license warning. Please stop the capture at the first comment terminator wherever it occurs and add an inline-code regression.
There was a problem hiding this comment.
Good catch on inline block comments. _strip_spdx_capture now truncates at the first */ or --> anywhere in the captured span, not only at end-of-line. Added a regression with trailing code on the same line.
There was a problem hiding this comment.
Inline */ truncation is in _strip_spdx_capture now, with a same-line code suffix regression.
A JS or HTML SPDX header captured `MIT OR GPL-3.0 */` (or `-->`), so the GPL half looked unknown and default validation warned instead of blocking. Drop `*/` and `-->` before splitting the expression. Fixes NVIDIA#86 Signed-off-by: mimran-khan <mohammed_imran.khan@outlook.com>
# Conflicts: # CHANGELOG.md
|
Merged main and the SPDX comment-terminator fix is still on branch. Ready for re-review. |
Stop SPDX extraction at the first */ or --> anywhere in the captured line, not only when the terminator is at the end. Add a regression for inline block comments that share a line with trailing source code.
|
@mimran-khan : Please resolve the merge conflicts. |
3 participants
Summary
SPDX headers like
MIT OR GPL-3.0were truncated toMIT, so the copyleft half never ran and the license check passed. A plainGPL-3.0header was already blocked.I capture the full expression and fail closed if any symbol is on the blocklist.
MIT OR MIT-0still passes. Fixes #86.Verification
make lintmake testmake buildRelease Impact
CHANGELOG.md