Inconsistent Case-Sensitivity for WITH Operator
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 65/100
Research direction
Start with the parser or validation path used by the ./spdx-validate entry point and reproduce both expressions from the issue. Compare operator handling in simple and parenthesized expressions, then confirm that lowercase "with" is rejected consistently according to the SPDX case-sensitivity rule.
Written by the indexing model from the issue text.
Description
Description
There is a discrepancy in how license expressions are validated based on their complexity. Simple expressions using the WITH operator are validated case-insensitively (allowing lowercase with), whereas complex expressions (using parentheses or multiple operators) require strict uppercase WITH.
This leads to a confusing user experience where MIT with Bison-exception-2.2 passes validation, but the same expression fails when wrapped in a compound statement.
Steps to Reproduce
Simple expression (lowercase 'with'):
printf "GPL-2.0 with Bison-exception-2.2" | ./spdx-validate
# Result: Success (Exit code 0)
Complex Expression (lowercase 'with'):
printf "AFL-1.1 OR (GPL-2.0 with Bison-exception-2.2)" | ./spdx-validate
# line 1: invalid SPDX expression: "AFL-1.1 OR (GPL-2.0 with Bison-exception-2.2)"
# no valid expressions found
Desired Behavior
GPL-2.0 with Bison-exception-2.2 fails as well. According to the spec, "License expression operators (AND, OR and WITH) should be matched in a case-sensitive manner." (Source: https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/ D2: Case Sensitivity section).
- Dominant language
- Go
- Stars
- 53
- Forks
- 16
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from github/go-spdx
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 3/5 1-2 days Newbie friendliness 38/100
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
-
maintenance
Difficulty 1/5 1-3 hours Newbie friendliness 45/100
-
documentation
Difficulty 5/5 Over a week Newbie friendliness 25/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
-
enhancement needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
kind/cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
kubernetes-sigs/kueue#15947 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sympozium-ai/sympozium#627 ·