You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

README.md 3.7KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091
  1. This package parses [SPDX license expression](https://spdx.org/spdx-specification-21-web-version#h.jxpfx0ykyb60) strings describing license terms, like [package.json license strings](https://docs.npmjs.com/files/package.json#license), into consistently structured ECMAScript objects. The npm command-line interface depends on this package, as do many automatic license-audit tools.
  2. In a nutshell:
  3. ```javascript
  4. var parse = require('spdx-expression-parse')
  5. var assert = require('assert')
  6. assert.deepEqual(
  7. // Licensed under the terms of the Two-Clause BSD License.
  8. parse('BSD-2-Clause'),
  9. {license: 'BSD-2-Clause'}
  10. )
  11. assert.throws(function () {
  12. // An invalid SPDX license expression.
  13. // Should be `Apache-2.0`.
  14. parse('Apache 2')
  15. })
  16. assert.deepEqual(
  17. // Dual licensed under either:
  18. // - LGPL 2.1
  19. // - a combination of Three-Clause BSD and MIT
  20. parse('(LGPL-2.1 OR BSD-3-Clause AND MIT)'),
  21. {
  22. left: {license: 'LGPL-2.1'},
  23. conjunction: 'or',
  24. right: {
  25. left: {license: 'BSD-3-Clause'},
  26. conjunction: 'and',
  27. right: {license: 'MIT'}
  28. }
  29. }
  30. )
  31. ```
  32. The syntax comes from the [Software Package Data eXchange (SPDX)](https://spdx.org/), a standard from the [Linux Foundation](https://www.linuxfoundation.org) for shareable data about software package license terms. SPDX aims to make sharing and auditing license data easy, especially for users of open-source software.
  33. The bulk of the SPDX standard describes syntax and semantics of XML metadata files. This package implements two lightweight, plain-text components of that larger standard:
  34. 1. The [license list](https://spdx.org/licenses), a mapping from specific string identifiers, like `Apache-2.0`, to standard form license texts and bolt-on license exceptions. The [spdx-license-ids](https://www.npmjs.com/package/spdx-license-ids) and [spdx-exceptions](https://www.npmjs.com/package/spdx-exceptions) packages implement the license list. `spdx-expression-parse` depends on and `require()`s them.
  35. Any license identifier from the license list is a valid license expression:
  36. ```javascript
  37. var identifiers = []
  38. .concat(require('spdx-license-ids'))
  39. .concat(require('spdx-license-ids/deprecated'))
  40. identifiers.forEach(function (id) {
  41. assert.deepEqual(parse(id), {license: id})
  42. })
  43. ```
  44. So is any license identifier `WITH` a standardized license exception:
  45. ```javascript
  46. identifiers.forEach(function (id) {
  47. require('spdx-exceptions').forEach(function (e) {
  48. assert.deepEqual(
  49. parse(id + ' WITH ' + e),
  50. {license: id, exception: e}
  51. )
  52. })
  53. })
  54. ```
  55. 2. The license expression language, for describing simple and complex license terms, like `MIT` for MIT-licensed and `(GPL-2.0 OR Apache-2.0)` for dual-licensing under GPL 2.0 and Apache 2.0. `spdx-expression-parse` itself implements license expression language, exporting a parser.
  56. ```javascript
  57. assert.deepEqual(
  58. // Licensed under a combination of:
  59. // - the MIT License AND
  60. // - a combination of:
  61. // - LGPL 2.1 (or a later version) AND
  62. // - Three-Clause BSD
  63. parse('(MIT AND (LGPL-2.1+ AND BSD-3-Clause))'),
  64. {
  65. left: {license: 'MIT'},
  66. conjunction: 'and',
  67. right: {
  68. left: {license: 'LGPL-2.1', plus: true},
  69. conjunction: 'and',
  70. right: {license: 'BSD-3-Clause'}
  71. }
  72. }
  73. )
  74. ```
  75. The Linux Foundation and its contributors license the SPDX standard under the terms of [the Creative Commons Attribution License 3.0 Unported (SPDX: "CC-BY-3.0")](http://spdx.org/licenses/CC-BY-3.0). "SPDX" is a United States federally registered trademark of the Linux Foundation. The authors of this package license their work under the terms of the MIT License.