spdx_identifier_valid

Validate every SPDX-License-Identifier: value as a strict SPDX license expression.

The offline SPDX License List 3.29.0 table recognizes current licenses and exceptions; AND, OR, WITH, and parentheses follow SPDX precedence, and valid LicenseRef-*, AdditionRef-*, and document-qualified custom references are accepted. Unknown, malformed, and deprecated standard identifiers fail. Files with no tag are silent—pair this kind with file_content_matches when a tag is mandatory. Binary-looking files are skipped. Check-only because selecting or changing a license is not a mechanical formatting decision.

---

Options

This rule takes no kind-specific options.

Plus the common paths, level, id, when, scope_filter, and expect_matches fields. This table is generated from the JSON Schema; option types and defaults are authoritative.

Example

An unknown identifier cannot masquerade as an SPDX expression

The rule fires on this repository:

• src/
• src/lib.rs✗

  ✗ error valid-spdx

  1:29 invalid SPDX license expression: Apach-2.0 OR MIT ^^^^^^^^^ unknown term

src/lib.rs

// SPDX-License-Identifier: Apach-2.0 OR MIT

pub fn answer() -> u8 { 42 }

With this .alint.yml:

version: 1
rules:
  - id: valid-spdx
    kind: spdx_identifier_valid
    paths: "src/**/*.rs"
    level: error

alint check reports:

--- src/lib.rs -----------------------------------------------------------------
  x  error    valid-spdx
              1:29  invalid SPDX license expression: Apach-2.0 OR MIT
              ^^^^^^^^^ unknown term

Summary (1 violation):
  x 1 error
  0 passing * 1 failing

A current license expression and exception are accepted

This repository is compliant:

• src/
• src/lib.rs✓

src/lib.rs

// SPDX-License-Identifier: MIT OR Apache-2.0 WITH LLVM-exception

pub fn answer() -> u8 { 42 }

With this .alint.yml:

version: 1
rules:
  - id: valid-spdx
    kind: spdx_identifier_valid
    paths: "src/**/*.rs"
    level: error

alint check reports:

v All 1 rule(s) passed.