Skip to content

fix LicenseRef handled incorrectly during satisfies check #167

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
elrayle merged 3 commits into from
Oct 6, 2026
Merged

fix LicenseRef handled incorrectly during satisfies check #167

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
299e69e
fix LicenseRef handled incorrectly during satisfies check
elrayle Oct 5, 2026
086377d
test and fix satisfies for deep nested licenseRefs
elrayle Oct 5, 2026
c1ef0d0
handle deeper more complex licenses for satisfies
elrayle Oct 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions spdxexp/satisfies.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -346,15 +346,15 @@ func (n *node) expandOr() [][]*node {

// expandOrTerm expands the terms of an OR expression.
func expandOrTerm(term *node, result [][]*node) [][]*node {
if term.isLicense() {
if term.isLicense() || term.isLicenseRef() {
Comment thread
elrayle marked this conversation as resolved.
result = append(result, []*node{term})
} else if term.isExpression() {
if term.isOrExpression() {
left := term.expandOr()
result = append(result, left...)
} else if term.isAndExpression() {
left := term.expandAnd()[0]
result = append(result, left)
left := term.expandAnd()
result = append(result, left...)
}
}
return result
Expand Down Expand Up @@ -412,7 +412,8 @@ func appendTerms(left, right [][]*node) [][]*node {
var result [][]*node
for _, r := range right {
for _, l := range left {
tmp := l
tmp := make([]*node, 0, len(l)+len(r))
tmp = append(tmp, l...)
tmp = append(tmp, r...)
result = append(result, tmp)
}
Expand Down
41 changes: 41 additions & 0 deletions spdxexp/satisfies_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -641,6 +641,31 @@ func TestSatisfies(t *testing.T) {
{"licenseRef alone not allowed, but with documentRef allowed",
"MIT AND LicenseRef-X-BSD-3-Clause-Golang",
[]string{"MIT", "Apache-2.0", "DocumentRef-spdx-tool-1.2:LicenseRef-X-BSD-3-Clause-Golang"}, false, nil},
{"first licenseRef satisfies (licenseRef OR licenseRef)", "LicenseRef-x OR LicenseRef-y", []string{"LicenseRef-x"}, true, nil},
{"second licenseRef satisfies (licenseRef OR licenseRef)", "LicenseRef-x OR LicenseRef-y", []string{"LicenseRef-y"}, true, nil},
{"licenseRef satisfies (license OR licenseRef)", "MIT OR LicenseRef-x", []string{"LicenseRef-x"}, true, nil},
{"2nd license satisfies (license OR license)", "MIT OR ISC", []string{"ISC"}, true, nil},
{"licenseRef alone does not satisfy (license AND (licenseRef OR licenseRef))", "MIT AND (LicenseRef-a OR LicenseRef-b)", []string{"MIT"}, false, nil},
{"ORed license alone does not satisfy (license AND (license OR license))", "MIT AND (ISC OR BSD-3-Clause)", []string{"MIT"}, false, nil},
{"licenseRef satisfies (licenseRef OR license)", "LicenseRef-x OR MIT", []string{"LicenseRef-x"}, true, nil},
{"licenseRef alone does not satisfy ((licenseRef OR licenseRef) AND license)", "(LicenseRef-a OR LicenseRef-b) AND MIT", []string{"MIT"}, false, nil},
{"documentRef satisfies (license OR documentRef)", "MIT OR DocumentRef-x:LicenseRef-y", []string{"DocumentRef-x:LicenseRef-y"}, true, nil},
{"deep nested (license AND (licenseRef OR licenseRef)) satisfied by license, first licenseRef", "MIT OR (ISC AND (LicenseRef-a OR LicenseRef-b))", []string{"ISC", "LicenseRef-a"}, true, nil},
{"deep nested (license AND (licenseRef OR licenseRef)) satisfied by license, second licenseRef", "MIT OR (ISC AND (LicenseRef-a OR LicenseRef-b))", []string{"ISC", "LicenseRef-b"}, true, nil},
{"deep nested (license AND (licenseRef OR licenseRef)) not satisfied by licenseRef alone", "MIT OR (ISC AND (LicenseRef-a OR LicenseRef-b))", []string{"LicenseRef-a"}, false, nil},
{"nested AND on left of OR satisfied by second licenseRef", "(ISC AND (LicenseRef-a OR LicenseRef-b)) OR MIT", []string{"ISC", "LicenseRef-b"}, true, nil},
{"nested AND on either side of OR satisfied by left second licenseRef", "(MIT AND (LicenseRef-a OR LicenseRef-b)) OR (ISC AND (LicenseRef-c OR LicenseRef-d))", []string{"MIT", "LicenseRef-b"}, true, nil},
{"nested AND on either side of OR satisfied by right second licenseRef", "(MIT AND (LicenseRef-a OR LicenseRef-b)) OR (ISC AND (LicenseRef-c OR LicenseRef-d))", []string{"ISC", "LicenseRef-d"}, true, nil},
{"two licenseRef OR groups produce Cartesian alternatives", "(LicenseRef-a OR LicenseRef-b) AND (LicenseRef-c OR LicenseRef-d)", []string{"LicenseRef-b", "LicenseRef-d"}, true, nil},
{"two licenseRef OR groups require one licenseRef from each", "(LicenseRef-a OR LicenseRef-b) AND (LicenseRef-c OR LicenseRef-d)", []string{"LicenseRef-b"}, false, nil},
{"nested license and licenseRef OR groups satisfy second alternatives", "MIT OR ((ISC OR BSD-3-Clause) AND (LicenseRef-a OR LicenseRef-b))", []string{"BSD-3-Clause", "LicenseRef-b"}, true, nil},
{"nested documentRef OR satisfies second alternative", "MIT OR (ISC AND (DocumentRef-x:LicenseRef-a OR DocumentRef-x:LicenseRef-b))", []string{"ISC", "DocumentRef-x:LicenseRef-b"}, true, nil},
{"deep AND with licenseRef and documentRef is satisfied", "MIT AND ISC AND LicenseRef-a AND DocumentRef-x:LicenseRef-b", []string{"MIT", "ISC", "LicenseRef-a", "DocumentRef-x:LicenseRef-b"}, true, nil},
{"deep AND with licenseRef and documentRef requires every term", "MIT AND ISC AND LicenseRef-a AND DocumentRef-x:LicenseRef-b", []string{"MIT", "ISC", "LicenseRef-a"}, false, nil},
{"deep mixed AND satisfies first alternatives", "(MIT OR Apache-2.0) AND (LicenseRef-a OR LicenseRef-b) AND (DocumentRef-x:LicenseRef-c OR DocumentRef-x:LicenseRef-d)", []string{"MIT", "LicenseRef-a", "DocumentRef-x:LicenseRef-c"}, true, nil},
{"deep mixed AND satisfies second alternatives", "(MIT OR Apache-2.0) AND (LicenseRef-a OR LicenseRef-b) AND (DocumentRef-x:LicenseRef-c OR DocumentRef-x:LicenseRef-d)", []string{"Apache-2.0", "LicenseRef-b", "DocumentRef-x:LicenseRef-d"}, true, nil},
{"deep mixed AND requires one term from every OR group", "(MIT OR Apache-2.0) AND (LicenseRef-a OR LicenseRef-b) AND (DocumentRef-x:LicenseRef-c OR DocumentRef-x:LicenseRef-d)", []string{"Apache-2.0", "LicenseRef-b"}, false, nil},
{"deep mixed AND requires matching documentRef", "(MIT OR Apache-2.0) AND (LicenseRef-a OR LicenseRef-b) AND (DocumentRef-x:LicenseRef-c OR DocumentRef-x:LicenseRef-d)", []string{"Apache-2.0", "LicenseRef-b", "DocumentRef-y:LicenseRef-d"}, false, nil},
}

for _, test := range tests {
Expand Down Expand Up @@ -851,6 +876,22 @@ func TestExpandAnd(t *testing.T) {
}
}

func TestAppendTermsDoesNotAliasBranches(t *testing.T) {
mit := getLicenseNode("MIT", false)
isc := getLicenseNode("ISC", false)
apache := getLicenseNode("Apache-2.0", false)

leftTerm := make([]*node, 1, 2)
leftTerm[0] = mit

actual := appendTerms(
[][]*node{leftTerm},
[][]*node{{isc}, {apache}},
)

assert.Equal(t, [][]*node{{mit, isc}, {mit, apache}}, actual)
}

type testCaseData struct {
name string
expression string
Expand Down
Loading