github / github/go-spdx

Inconsistent Case-Sensitivity for WITH Operator

Open
#148 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
53
Forks
16
PR merge metrics
No merged PRs in 30d

Description

## Description
There is a discrepancy in how license expressions are validated based on their complexity. Simple expressions using the WITH operator are validated case-insensitively (allowing lowercase with), whereas complex expressions (using parentheses or multiple operators) require strict uppercase WITH.

This leads to a confusing user experience where MIT with Bison-exception-2.2 passes validation, but the same expression fails when wrapped in a compound statement.

## Steps to Reproduce
Simple expression (lowercase 'with'):
```
printf "GPL-2.0 with Bison-exception-2.2" | ./spdx-validate
# Result: Success (Exit code 0)
```

Complex Expression (lowercase 'with'):
```
printf "AFL-1.1 OR (GPL-2.0 with Bison-exception-2.2)" | ./spdx-validate
# line 1: invalid SPDX expression: "AFL-1.1 OR (GPL-2.0 with Bison-exception-2.2)"
# no valid expressions found
```

## Desired Behavior
```GPL-2.0 with Bison-exception-2.2``` fails as well. According to the spec, "License expression operators (AND, OR and WITH) should be matched in a case-sensitive manner." (Source: https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/ D2: Case Sensitivity section).

Contributor guide

Open the contributing guide

Research direction

Start with the parser or validation path used by the ./spdx-validate entry point and reproduce both expressions from the issue. Compare operator handling in simple and parenthesized expressions, then confirm that lowercase "with" is rejected consistently according to the SPDX case-sensitivity rule.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.