SPDX backend

I like this project and I think it would be really helpful for our Software Foundation; since we are increasingly adopting SPDX, I though it would have been cool to add a backend for it, which replaces the local licenses folder and also validates the license Identifier passed by the user.

I’ve dropped some code on https://github.com/maoo/legit/tree/spdx-backend ; although it’s not final, it runs locally without blowing up, hopefully (my Node skills are very humble); the README file explains how to use and configure it.

This is the way it works:

1. A user runs the script passing a license with the -l option, as before; the only difference is that now it must be a valid SPDX Identifier, otherwise it will fail
2. legit validates the SPDX Identifier against SPDX using spdx-licenses npm
3. legit downloads and parses the license text from https://spdx.org/licenses/<Identifier>.html
4. If a placeholder configuration is available for that license, legit will try to resolve those values from command-line options and replace them in the license text

Placeholder definitions are hosted on github and can be extended by the community.

The implementation is not complete, there are some known issues that I’ve also reported in the README

• placeholder list is hardcoded (user,year,oneline), should be parametric
• add more items in license-placeholders.yml
• make license-placeholders.yml url configurable
• allow to resolve license-placeholders.yml with a file-system path
• placeholders including ' character don’t work
• Regexp support for license placeholders

I’m eager to know what others think about SPDX and this implementation; if you like the idea, I’d be happy to work on it further and send a Pull Request.

Thanks for sharing this work in the open!

[jacobmischka]

This is pretty much what I did in my sort-of-fork https://github.com/jacobmischka/papers, though it allows any of the name, spdx id, or nickname of a license (as listed in github/choosealicense.com, using a quick json I made of the licenses.

Edit: That sounds like an advertisement, which I didn’t really mean it to be. I just mean you can take any bits you want or use that JSON file I threw together. I only created it because I wanted something to use myself that reads from package.json which is out of scope for this package.

[pombredanne]

You could also use this https://github.com/spdx/license-list-data repo of as part of your npm build with a clone and/or a .gitmodule to avoid any fetching/network dep at run time.