Merge pull request #64 from doubleopen-project/stricter-checks

Implement basic checks on classified licenses

scripts/.gitignore

@@ -0,0 +1,7 @@
+# SPDX-FileCopyrightText: 2024 Double Open Oy <support@doubleopen.org>
+# SPDX-License-Identifier: CC0-1.0
+
+/.gradle/
+/gradle/
+gradlew
+gradlew.bat

scripts/build.gradle.kts

@@ -0,0 +1,5 @@
+// SPDX-FileCopyrightText: 2024 Double Open Oy <support@doubleopen.org>
+// SPDX-License-Identifier: CC0-1.0
+
+// This is a dummy file to make Fleet recognize `.main.kts` scripts in this folder, see
+// https://youtrack.jetbrains.com/issue/FL-22261.

scripts/check-license-classifications.main.kts

@@ -3,15 +3,14 @@
 // SPDX-FileCopyrightText: 2023 Double Open Oy <support@doubleopen.org>
 // SPDX-License-Identifier: CC0-1.0
 
-@file:CompilerOptions("-jvm-target", "17")
-@file:DependsOn("org.ossreviewtoolkit:model:10.0.0")
-
-import java.io.File
+@file:CompilerOptions("-jvm-target", "11")
+@file:DependsOn("org.ossreviewtoolkit:model:18.0.0")
 
 import kotlin.system.exitProcess
 
 import org.ossreviewtoolkit.model.licenses.LicenseClassifications
 import org.ossreviewtoolkit.model.readValue
+import org.ossreviewtoolkit.utils.spdx.SpdxExpression.Strictness
 
 val scriptsDir = __FILE__.parentFile
 val licenseClassificationsFile = scriptsDir.resolve("../license-classifications.yml").canonicalFile
@@ -24,4 +23,14 @@ val licenseClassifications = runCatching {
     exitProcess(1)
 }
 
+val (validLicenses, invalidLicenses) = licenseClassifications.categoriesByLicense.keys.partition {
+    it.isValid(Strictness.ALLOW_ANY)
+}
+
+if (invalidLicenses.isNotEmpty()) {
+    println("The following licenses cannot be parsed as SPDX license expressions:")
+    println(invalidLicenses.joinToString("\n"))
+    exitProcess(1)
+}
+
 println("Check passed for '$licenseClassificationsFile'.")