License expressions need to support SPDX IDs

[silverhook]

In the specification.rst the license IDs are still limited to DejaCode instead of SPDX.

• license_expression: The DejaCode license expression that apply to the component. You can separate each identifier using ” or ” and ” and ” to document the relationship between multiple license identifiers, such as a choice among multiple licenses (No special characters are allowed).
• license_name: The DejaCode license short name for the license (No special characters are allowed).
• license_key: The DejaCode license key(s) for the component (No special characters are allowed).

@pombredanne says this is wrong and should be fixed to allow for SPDX (at the very least LicenseRef-scancode-*).

[chinyeungli]

We already have spdx_license_key and spdx_license_expression supported https://github.com/nexB/aboutcode-toolkit/blob/develop/src/attributecode/model.py#L905

However, the spec hasn't included the spdx_license_expression yet which I will do the update https://github.com/nexB/aboutcode-toolkit/blob/develop/docs/source/specification.rst#optional-licensing-fields

[chinyeungli]

The spdx_license_expression is added in the specs. @silverhook would that be enough?

[silverhook]

Thanks, that would be enough.

I would only much prefer the spdx_license_key (and as result spdx_license_expression) to not be limited to ScanCode’s list, but allow for SPDX IDs that are not (yet) in it. SPDX specification allows for any LicenseRef-* license name; while ScanCode’s list is very long, it is ultimately a list with an end.

[chinyeungli]

closing it as SPDX License is supported.