feat(spdx-utils)!: Remove simple license mappings without matching digits

sschuberth · sschuberth · commit ba1a9bf73698 · 2025-06-18T12:49:44.000+02:00
In order to remove the already identified ambiguous mappings, stricten
the check to require matching digits (disregarding trailing zeros) in keys
and values for each mapping.

This logic works for all ambiguous mappings except for `ALv2: Apache-2.0`,
which is now accepted as being non-ambiguous because "2.0" is reduced to
"2" which matches the digit in the key.

Additionally, this logic identified 12 previously "Non-ambiguous mappings"
to be in fact ambiguous because they have no or too little indication of
a version.

BREAKING CHANGE: Users who rely on the previous mappings need to create
package curations with respective `declaredLicenseMapping`s.

Signed-off-by: Sebastian Schuberth &lt;sebastian@doubleopen.org&gt;
diff --git a/plugins/package-managers/cocoapods/src/funTest/assets/projects/synthetic/version-resolution-expected-output.yml b/plugins/package-managers/cocoapods/src/funTest/assets/projects/synthetic/version-resolution-expected-output.yml
@@ -508,9 +508,8 @@ packages:
   declared_licenses:
   - "BSD"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD: "BSD-3-Clause"
+    unmapped:
+    - "BSD"
   description: "Methods to allow using HTML code with CoreText."
   homepage_url: "https://github.com/Cocoanetics/DTCoreText"
   binary_artifact:
@@ -538,9 +537,8 @@ packages:
   declared_licenses:
   - "BSD"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD: "BSD-3-Clause"
+    unmapped:
+    - "BSD"
   description: "Methods to allow using HTML code with CoreText."
   homepage_url: "https://github.com/Cocoanetics/DTCoreText"
   binary_artifact:
@@ -568,9 +566,8 @@ packages:
   declared_licenses:
   - "BSD"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD: "BSD-3-Clause"
+    unmapped:
+    - "BSD"
   description: "Standard toolset classes and categories."
   homepage_url: "https://github.com/Cocoanetics/DTFoundation"
   binary_artifact:
@@ -598,9 +595,8 @@ packages:
   declared_licenses:
   - "BSD"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD: "BSD-3-Clause"
+    unmapped:
+    - "BSD"
   description: "Standard toolset classes and categories."
   homepage_url: "https://github.com/Cocoanetics/DTFoundation"
   binary_artifact:
@@ -628,9 +624,8 @@ packages:
   declared_licenses:
   - "BSD"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD: "BSD-3-Clause"
+    unmapped:
+    - "BSD"
   description: "Standard toolset classes and categories."
   homepage_url: "https://github.com/Cocoanetics/DTFoundation"
   binary_artifact:
@@ -658,9 +653,8 @@ packages:
   declared_licenses:
   - "BSD"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD: "BSD-3-Clause"
+    unmapped:
+    - "BSD"
   description: "Standard toolset classes and categories."
   homepage_url: "https://github.com/Cocoanetics/DTFoundation"
   binary_artifact:
@@ -716,9 +710,8 @@ packages:
   declared_licenses:
   - "BSD"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD: "BSD-3-Clause"
+    unmapped:
+    - "BSD"
   description: "A set of in-app debugging and exploration tools for iOS"
   homepage_url: "https://github.com/Flipboard/FLEX"
   binary_artifact:
diff --git a/plugins/package-managers/node/src/funTest/assets/projects/synthetic/npm/node-modules-expected-output.yml b/plugins/package-managers/node/src/funTest/assets/projects/synthetic/npm/node-modules-expected-output.yml
@@ -300,9 +300,8 @@ packages:
   declared_licenses:
   - "BSD-like"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD-like: "BSD-3-Clause"
+    unmapped:
+    - "BSD-like"
   description: "a CSS selector compiler/engine"
   homepage_url: "https://github.com/fb55/css-select#readme"
   binary_artifact:
diff --git a/plugins/package-managers/node/src/funTest/assets/projects/synthetic/npm/project-with-lockfile-expected-output.yml b/plugins/package-managers/node/src/funTest/assets/projects/synthetic/npm/project-with-lockfile-expected-output.yml
@@ -311,9 +311,8 @@ packages:
   declared_licenses:
   - "BSD-like"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD-like: "BSD-3-Clause"
+    unmapped:
+    - "BSD-like"
   description: "a CSS selector compiler/engine"
   homepage_url: "https://github.com/fb55/css-select#readme"
   binary_artifact:
diff --git a/plugins/package-managers/node/src/funTest/assets/projects/synthetic/npm/shrinkwrap-expected-output.yml b/plugins/package-managers/node/src/funTest/assets/projects/synthetic/npm/shrinkwrap-expected-output.yml
@@ -300,9 +300,8 @@ packages:
   declared_licenses:
   - "BSD-like"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD-like: "BSD-3-Clause"
+    unmapped:
+    - "BSD-like"
   description: "a CSS selector compiler/engine"
   homepage_url: "https://github.com/fb55/css-select#readme"
   binary_artifact:
diff --git a/plugins/package-managers/node/src/funTest/assets/projects/synthetic/npm/shrinkwrap-skip-excluded-scopes-expected-output.yml b/plugins/package-managers/node/src/funTest/assets/projects/synthetic/npm/shrinkwrap-skip-excluded-scopes-expected-output.yml
@@ -172,9 +172,8 @@ packages:
   declared_licenses:
   - "BSD-like"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD-like: "BSD-3-Clause"
+    unmapped:
+    - "BSD-like"
   description: "a CSS selector compiler/engine"
   homepage_url: "https://github.com/fb55/css-select#readme"
   binary_artifact:
diff --git a/plugins/package-managers/node/src/funTest/assets/projects/synthetic/pnpm/nested-project-expected-output.yml b/plugins/package-managers/node/src/funTest/assets/projects/synthetic/pnpm/nested-project-expected-output.yml
@@ -335,9 +335,8 @@ packages:
   declared_licenses:
   - "BSD-like"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD-like: "BSD-3-Clause"
+    unmapped:
+    - "BSD-like"
   description: "a CSS selector compiler/engine"
   homepage_url: "https://github.com/fb55/css-select#readme"
   binary_artifact:
diff --git a/plugins/package-managers/node/src/funTest/assets/projects/synthetic/pnpm/project-with-lockfile-expected-output.yml b/plugins/package-managers/node/src/funTest/assets/projects/synthetic/pnpm/project-with-lockfile-expected-output.yml
@@ -311,9 +311,8 @@ packages:
   declared_licenses:
   - "BSD-like"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD-like: "BSD-3-Clause"
+    unmapped:
+    - "BSD-like"
   description: "a CSS selector compiler/engine"
   homepage_url: "https://github.com/fb55/css-select#readme"
   binary_artifact:
diff --git a/plugins/package-managers/node/src/funTest/assets/projects/synthetic/pnpm/project-with-lockfile-skip-excluded-scopes-expected-output.yml b/plugins/package-managers/node/src/funTest/assets/projects/synthetic/pnpm/project-with-lockfile-skip-excluded-scopes-expected-output.yml
@@ -174,9 +174,8 @@ packages:
   declared_licenses:
   - "BSD-like"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD-like: "BSD-3-Clause"
+    unmapped:
+    - "BSD-like"
   description: "a CSS selector compiler/engine"
   homepage_url: "https://github.com/fb55/css-select#readme"
   binary_artifact:
diff --git a/plugins/package-managers/node/src/funTest/assets/projects/synthetic/yarn/project-with-lockfile-expected-output.yml b/plugins/package-managers/node/src/funTest/assets/projects/synthetic/yarn/project-with-lockfile-expected-output.yml
@@ -311,9 +311,8 @@ packages:
   declared_licenses:
   - "BSD-like"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD-like: "BSD-3-Clause"
+    unmapped:
+    - "BSD-like"
   description: "a CSS selector compiler/engine"
   homepage_url: "https://github.com/fb55/css-select#readme"
   binary_artifact:
diff --git a/plugins/package-managers/node/src/funTest/assets/projects/synthetic/yarn/project-with-lockfile-skip-excluded-scopes-expected-output.yml b/plugins/package-managers/node/src/funTest/assets/projects/synthetic/yarn/project-with-lockfile-skip-excluded-scopes-expected-output.yml
@@ -174,9 +174,8 @@ packages:
   declared_licenses:
   - "BSD-like"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD-like: "BSD-3-Clause"
+    unmapped:
+    - "BSD-like"
   description: "a CSS selector compiler/engine"
   homepage_url: "https://github.com/fb55/css-select#readme"
   binary_artifact:
diff --git a/plugins/package-managers/node/src/funTest/assets/projects/synthetic/yarn2/project-with-lockfile-expected-output.yml b/plugins/package-managers/node/src/funTest/assets/projects/synthetic/yarn2/project-with-lockfile-expected-output.yml
@@ -311,9 +311,8 @@ packages:
   declared_licenses:
   - "BSD-like"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD-like: "BSD-3-Clause"
+    unmapped:
+    - "BSD-like"
   description: "a CSS selector compiler/engine"
   homepage_url: "https://github.com/fb55/css-select#readme"
   binary_artifact:
diff --git a/plugins/package-managers/node/src/funTest/assets/projects/synthetic/yarn2/project-with-lockfile-skip-excluded-scopes-expected-output.yml b/plugins/package-managers/node/src/funTest/assets/projects/synthetic/yarn2/project-with-lockfile-skip-excluded-scopes-expected-output.yml
@@ -174,9 +174,8 @@ packages:
   declared_licenses:
   - "BSD-like"
   declared_licenses_processed:
-    spdx_expression: "BSD-3-Clause"
-    mapped:
-      BSD-like: "BSD-3-Clause"
+    unmapped:
+    - "BSD-like"
   description: "a CSS selector compiler/engine"
   homepage_url: "https://github.com/fb55/css-select#readme"
   binary_artifact:
diff --git a/utils/spdx/src/main/resources/simple-license-mapping.yml b/utils/spdx/src/main/resources/simple-license-mapping.yml
@@ -22,34 +22,8 @@
 # Sort the entries below via IntelliJ's "Edit" -> "Sort Lines".
 ---
 
-# Ambiguous mappings (mapping reason not obvious without additional information)
-ALv2: Apache-2.0
-ASL: Apache-2.0
-Apache-style: Apache-2.0
-Apache: Apache-2.0
-BSD-like: BSD-3-Clause
-BSD-style: BSD-3-Clause
-BSD: BSD-3-Clause
-GPL: GPL-2.0-or-later
-MPL: MPL-2.0
-afl: AFL-3.0
-agpl: AGPL-3.0-or-later
-apache-license: Apache-2.0
-bsd-license: BSD-3-Clause
-bsd-licensed: BSD-3-Clause
-cddl: CDDL-1.0
-efl: EFL-2.0
-epl: EPL-1.0
-eupl: EUPL-1.0
-fdl: GFDL-1.3-or-later
-gfdl: GFDL-1.3-or-later
-gpl-license: GPL-2.0-or-later
-psf: PSF-2.0
-psfl: PSF-2.0
-python: Python-2.0
-
-# Non-ambiguous mappings
 AFLv2.1: AFL-2.1
+ALv2: Apache-2.0
 APACHEv2: Apache-2.0
 APL2: Apache-2.0
 APLv2.0: Apache-2.0
@@ -59,11 +33,7 @@ Apache2: Apache-2.0
 BSD-3: BSD-3-Clause
 BSD2: BSD-2-Clause
 BSD3: BSD-3-Clause
-Boost: BSL-1.0
 Bouncy: MIT
-CC0: CC0-1.0
-CPL: CPL-1.0
-CeCILL: CECILL-1.1
 EDL-1.0: BSD-3-Clause
 FreeBSD: BSD-2-Clause-Views
 GPL-2: GPL-2.0-only
@@ -74,31 +44,24 @@ GPLv3+: GPL-3.0-or-later
 GPLv3: GPL-3.0-only
 ISCL: ISC
 LGPL-3: LGPL-3.0-only
-LGPL2: LGPL-2.1-only
 LGPL3: LGPL-3.0-only
-LGPL: LGPL-2.0-or-later
-LGPLv2: LGPL-2.1-only
 LGPLv3+: LGPL-3.0-or-later
 LGPLv3: LGPL-3.0-only
 MIT-like: MIT
 MIT-style: MIT
 MPLv2.0: MPL-2.0
 MPLv2: MPL-2.0
-ODBL: ODbL-1.0
 PSF2: PSF-2.0
 UNLICENSED: Unlicense
 Unlicence: Unlicense
-Vovida: VSL-1.0
 afl-2: AFL-2.0
 afl2.0: AFL-2.0
 afl2.1: AFL-2.1
 afl2: AFL-2.0
 bouncy-license: MIT
 bsl1.0: BSL-1.0
-bsl: BSL-1.0
 cddl1.0: CDDL-1.0
 cddl1.1: CDDL-1.1
-cpal: CPAL-1.0
 epl1.0: EPL-1.0
 epl2.0: EPL-2.0
 eupl1.0: EUPL-1.0
@@ -113,4 +76,3 @@ mpl2.0: MPL-2.0
 mpl2: MPL-2.0
 w3cl: W3C
 wtf: WTFPL
-zope: ZPL-2.1
diff --git a/utils/spdx/src/test/kotlin/SpdxSimpleLicenseMappingTest.kt b/utils/spdx/src/test/kotlin/SpdxSimpleLicenseMappingTest.kt
@@ -57,6 +57,23 @@ class SpdxSimpleLicenseMappingTest : WordSpec({
                 if (license.id.endsWith("-only")) key should containADigit()
             }
         }
+
+        "contain matching digits disregarding trailing zeros" {
+            val exceptions = mapOf(
+                // See https://www.eclipse.org/org/documents/edl-v10.php.
+                "EDL-1.0" to SpdxLicense.BSD_3_CLAUSE,
+                // See https://spdx.org/licenses/BSD-2-Clause-Views.html.
+                "FreeBSD" to SpdxLicense.BSD_2_CLAUSE_VIEWS
+            )
+
+            SpdxSimpleLicenseMapping.simpleLicenseMapping.filterNot {
+                it in exceptions.entries
+            }.forAll { (key, license) ->
+                val digitsInKey = key.filter { it.isDigit() }.dropLastWhile { it == '0' }
+                val digitsInLicense = license.id.filter { it.isDigit() }.dropLastWhile { it == '0' }
+                digitsInKey shouldBe digitsInLicense
+            }
+        }
     }
 
     "The simple expression mapping" should {
