Module: SPDX Private

Defined in:
utils/spdx.rb

Overview

This module is part of a private API. This module may only be used in the Homebrew/brew repository. Third parties should avoid using this module if possible, as it may be removed or changed without warning.

Helper module for updating SPDX license data.

Constant Summary collapse

DATA_PATH =

This constant is part of a private API. This constant may only be used in the Homebrew/brew repository. Third parties should avoid using this constant if possible, as it may be removed or changed without warning. 

T.let((HOMEBREW_DATA_PATH/"spdx").freeze, Pathname)
API_URL =

This constant is part of a private API. This constant may only be used in the Homebrew/brew repository. Third parties should avoid using this constant if possible, as it may be removed or changed without warning. 

"https://api.github.com/repos/spdx/license-list-data/releases/latest"
LICENSEREF_PREFIX =

This constant is part of a private API. This constant may only be used in the Homebrew/brew repository. Third parties should avoid using this constant if possible, as it may be removed or changed without warning. 

"LicenseRef-Homebrew-"
ALLOWED_LICENSE_SYMBOLS =

This constant is part of a private API. This constant may only be used in the Homebrew/brew repository. Third parties should avoid using this constant if possible, as it may be removed or changed without warning. 

[
  :public_domain,
  :cannot_represent,
  :truncated,
].freeze
LicenseExpression =

This constant is part of a private API. This constant may only be used in the Homebrew/brew repository. Third parties should avoid using this constant if possible, as it may be removed or changed without warning. 

T.type_alias do
  T.any(
    String,
    Symbol,
    T::Hash[T.any(String, Symbol), T.anything],
  )
end

Class Method Summary collapse

Class Method Details

.deprecated_license?(license) ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Boolean) 


116
117
118
119
120
 
# File 'utils/spdx.rb', line 116

def deprecated_license?(license)
  return false if license.is_a? Symbol

  license_index.fetch(license.delete_suffix("+").downcase, false)
end

.download_latest_license_data!(to: DATA_PATH) ⇒ void

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

This method returns an undefined value.

Parameters:

  • to (Pathname) (defaults to: DATA_PATH) 


59
60
61
62
63
 
# File 'utils/spdx.rb', line 59

def download_latest_license_data!(to: DATA_PATH)
  data_url = "https://raw.githubusercontent.com/spdx/license-list-data/refs/tags/#{latest_tag}/json/"
  Utils::Curl.curl_download("#{data_url}licenses.json", to: to/"spdx_licenses.json")
  Utils::Curl.curl_download("#{data_url}exceptions.json", to: to/"spdx_exceptions.json")
end

.exception_data ⇒ Hash{String => T.untyped}

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



26
27
28
29
 
# File 'utils/spdx.rb', line 26

def exception_data
  @exception_data ||= T.let(JSON.parse((DATA_PATH/"spdx_exceptions.json").read),
                            T.nilable(T::Hash[String, T.untyped]))
end

.exception_index ⇒ Hash{String => Boolean}

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



42
43
44
45
46
47
48
49
50
51
 
# File 'utils/spdx.rb', line 42

def exception_index
  @exception_index ||= T.let(
    exception_data["exceptions"].filter_map do |spdx_exception|
      next if spdx_exception["isDeprecatedLicenseId"]

      [spdx_exception["licenseExceptionId"].downcase, true]
    end.to_h,
    T.nilable(T::Hash[String, T::Boolean]),
  )
end

.forbidden_licenses_include?(license, forbidden_licenses) ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Boolean) 


310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
 
# File 'utils/spdx.rb', line 310

def forbidden_licenses_include?(license, forbidden_licenses)
  return true if forbidden_licenses.key? license

  name, version, = license_version_info license

  forbidden_licenses.each_value do |license_info|
    forbidden_name, forbidden_version, forbidden_or_later = *license_info
    next if forbidden_name != name

    return true if forbidden_or_later && forbidden_version <= version

    return true if forbidden_version == version
  end
  false
end

.latest_tag ⇒ String

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



54
55
56
 
# File 'utils/spdx.rb', line 54

def latest_tag
  @latest_tag ||= T.let(GitHub::API.open_rest(API_URL)["tag_name"], T.nilable(String))
end

.license_data ⇒ Hash{String => T.untyped}

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



21
22
23
 
# File 'utils/spdx.rb', line 21

def license_data
  @license_data ||= T.let(JSON.parse((DATA_PATH/"spdx_licenses.json").read), T.nilable(T::Hash[String, T.untyped]))
end

.license_expression_to_string(license_expression, bracket: false, hash_type: nil) ⇒ String?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
 
# File 'utils/spdx.rb', line 134

def license_expression_to_string(license_expression, bracket: false, hash_type: nil)
  case license_expression
  when String
    license_expression
  when Symbol
    LICENSEREF_PREFIX + license_expression.to_s.tr("_", "-")
  when Hash
    expressions = []

    if license_expression.keys.length == 1
      hash_type = license_expression.keys.first
      if hash_type.is_a? String
        expressions.push "#{hash_type} WITH #{license_expression[hash_type][:with]}"
      else
        expressions += license_expression[hash_type].map do |license|
          license_expression_to_string license, bracket: true, hash_type:
        end
      end
    else
      bracket = false
      license_expression.each do |expression|
        expressions.push license_expression_to_string([expression].to_h, bracket: true)
      end
    end

    operator = if hash_type == :any_of
      " OR "
    else
      " AND "
    end

    if bracket
      "(#{expressions.join operator})"
    else
      expressions.join operator
    end
  end
end

.license_index ⇒ Hash{String => Boolean}

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Returns:



32
33
34
35
36
37
38
39
 
# File 'utils/spdx.rb', line 32

def license_index
  @license_index ||= T.let(
    license_data["licenses"].to_h do |spdx_license|
      [spdx_license["licenseId"].downcase, !!spdx_license["isDeprecatedLicenseId"]]
    end,
    T.nilable(T::Hash[String, T::Boolean]),
  )
end

.license_version_info(license) ⇒ Array<([String, Symbol])>, Array<(String, [String, nil], Boolean)>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



267
268
269
270
271
272
273
274
275
276
277
278
279
 
# File 'utils/spdx.rb', line 267

def license_version_info(license)
  return [license] if ALLOWED_LICENSE_SYMBOLS.include? license

  match = license.match(/-(?<version>[0-9.]+)(?:-.*?)??(?<or_later>\+|-only|-or-later)?$/)
  return [license] if match.blank?

  license_name = license.to_s.split(match[0].to_s).first
  or_later = match["or_later"].present? && %w[+ -or-later].include?(match["or_later"])

  # [name, version, later versions allowed?]
  # e.g. GPL-2.0-or-later --> ["GPL", "2.0", true]
  [license_name, match["version"], or_later]
end

.licenses_forbid_installation?(license_expression, forbidden_licenses) ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Boolean) 


285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
 
# File 'utils/spdx.rb', line 285

def licenses_forbid_installation?(license_expression, forbidden_licenses)
  case license_expression
  when String, Symbol
    forbidden_licenses_include? license_expression, forbidden_licenses
  when Hash
    key = license_expression.keys.first
    return false if key.nil?

    case key
    when :any_of
      license_expression[key].all? { |license| licenses_forbid_installation? license, forbidden_licenses }
    when :all_of
      license_expression[key].any? { |license| licenses_forbid_installation? license, forbidden_licenses }
    else
      forbidden_licenses_include? key, forbidden_licenses
    end
  end
end

.parse_license_expression(license_expression) ⇒ Array<(Array<String, Symbol>, Array<String>)>

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
 
# File 'utils/spdx.rb', line 79

def parse_license_expression(license_expression)
  licenses = T.let([], T::Array[T.any(String, Symbol)])
  exceptions = T.let([], T::Array[String])

  case license_expression
  when String, Symbol
    licenses.push license_expression
  when Hash, Array
    if license_expression.is_a? Hash
      license_expression = license_expression.filter_map do |key, value|
        if key.is_a? String
          licenses.push key
          exceptions.push value[:with]
          next
        end
        value
      end
    end

    license_expression.each do |license|
      sub_license, sub_exception = parse_license_expression license
      licenses += sub_license
      exceptions += sub_exception
    end
  end

  [licenses, exceptions]
end

.string_to_license_expression(string) ⇒ LicenseExpression?

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:



182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
 
# File 'utils/spdx.rb', line 182

def string_to_license_expression(string)
  return if string.blank?

  result = string
  result_type = nil

  and_parts = string.split(/ and (?![^(]*\))/i)
  if and_parts.length > 1
    result = and_parts
    result_type = :all_of
  else
    or_parts = string.split(/ or (?![^(]*\))/i)
    if or_parts.length > 1
      result = or_parts
      result_type = :any_of
    end
  end

  if result_type
    result.map! do |part|
      part = part[1..-2] if part[0] == "(" && part[-1] == ")"
      string_to_license_expression(part)
    end
    { result_type => result }
  else
    with_parts = string.split(/ with /i, 2)
    if with_parts.length > 1
      { with_parts.first => { with: with_parts.second } }
    else
      return result unless result.start_with?(LICENSEREF_PREFIX)

      license_sym = result.delete_prefix(LICENSEREF_PREFIX).downcase.tr("-", "_").to_sym
      ALLOWED_LICENSE_SYMBOLS.include?(license_sym) ? license_sym : result
    end
  end
end

.truncate_license(license, limit: 255) ⇒ String

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

The org.opencontainers.image.licenses OCI annotation only accepts a limited length (limit). GHCR rejects 256-character values on OCI child manifests, so the default is 255. Shorten an over-long licence to a valid prefix rather than discarding it entirely. Only top-level AND expressions can be shortened safely: a prefix of "A AND B AND ..." still holds, whereas dropping OR alternatives would change the licence, so those fall back to :cannot_represent.

Parameters:

Returns:



226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
 
# File 'utils/spdx.rb', line 226

def truncate_license(license, limit: 255)
  return license if license.length <= limit

  fallback = license_expression_to_string(:cannot_represent) || license

  # Split on top-level `AND`, re-joining any segment split inside a bracketed
  # sub-expression so each part stays a valid, balanced licence. A single part
  # means a top-level `OR` (or a lone licence) that cannot be safely shortened.
  parts = T.let([], T::Array[String])
  license.split(" AND ").each do |segment|
    previous = parts.last
    if previous && previous.count("(") > previous.count(")")
      parts[-1] = "#{previous} AND #{segment}"
    else
      parts << segment
    end
  end
  return fallback if parts.length < 2

  marker = license_expression_to_string(:truncated) || "truncated"
  kept = T.let([], T::Array[String])
  parts.each do |part|
    break if [*kept, part, marker].join(" AND ").length > limit

    kept << part
  end
  return fallback if kept.empty?

  [*kept, marker].join(" AND ")
end

.valid_license?(license) ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Boolean) 


109
110
111
112
113
 
# File 'utils/spdx.rb', line 109

def valid_license?(license)
  return ALLOWED_LICENSE_SYMBOLS.include? license if license.is_a? Symbol

  license_index.key?(license.delete_suffix("+").downcase)
end

.valid_license_exception?(exception) ⇒ Boolean

This method is part of a private API. This method may only be used in the Homebrew/brew repository. Third parties should avoid using this method if possible, as it may be removed or changed without warning.

Parameters:

Returns:

  • (Boolean) 


123
124
125
 
# File 'utils/spdx.rb', line 123

def valid_license_exception?(exception)
  exception_index.key?(exception.downcase)
end