Skip to main content
← Back to list
01Issue
FeatureOpenSwamp CLIPublic
Assigneesskunk-ape

Relationships

#3391 extension push: read dependency licenses with the shared SPDX parser (OR, AND, WITH)

Opened by skunk-ape · 10/13/2026

Split out of #3350 (Seth, 2026-10-13) so the rest of the dependency trust plan doesn't wait on the license work. Plan: Extension dependency trust plan (https://claude.ai/code/artifact/c333312a-ca26-4056-a7f2-cabd7f30457c).

Problem

The push gate reads dependency licenses with parseSpdxLicense/licenseAllowed (src/domain/extensions/extension_dependency_trust_checker.ts). Both split the expression and require every term to be allowed, so MIT OR GPL-3.0 fails even though MIT is allowed. A WITH exception is split wrongly too.

Change

  • Use the SPDX expression parser from #3324 (src/domain/licensing/spdx_expression.ts), with the existing 9-entry allowlist as the policy.
  • OR passes if any branch is allowed, AND needs every term, and WITH judges the base license.
  • A missing license is a warning.
  • Add a shared test-vector file of expressions and verdicts, which the registry side (the companion swamp-club issue) also reads.

Depends on

#3324 merged (the parser).

Acceptance

  • Unit tests over the vectors.
  • UAT: an OR license verdict at push. The test skips itself until the binary has the capability.
02Bog Flow
◉OPEN○TRIAGED○IN PROGRESS○SHIPPED+ 1 MOREASSIGNED

Open

10/13/2026, 7:51:22 PM

Click a lifecycle step above to view its details.

03Sludge Pulse
skunk-ape assigned skunk-ape10/13/2026, 10:23:41 PM
Editable. Press Enter to edit.

skunk-ape commented 10/13/2026, 10:50:31 PM

Parked (Seth, 2026-10-13).

Why: the dependency license check only warns, and those warnings never block a push (they print outside the warnings gate). The plan never makes the license check an error. The current split also errs only toward warning: compound SPDX expressions with an allowed branch (MIT OR GPL-3.0, Apache-2.0 WITH LLVM-exception) warn wrongly, but nothing passes that should warn. npm does not enforce SPDX either: missing, free-text and SEE LICENSE IN values warn before and after this change. So the fix only removes false warnings for compound expressions, which a small sample suggests are a minority of dependencies.

Decisions already made, for whoever picks this up:

  1. Uppercase AND/OR/WITH before parsing, so lowercase operators stay accepted as they are today.
  2. Match license ids against the allowlist ignoring case.
  3. Read an array license value (legacy licenses: [{type}]) as an OR of its types. Keep reading the {type} object as today.
  4. Warnings: a disallowed license keeps license "X" not in allowlist. A missing license gets its own message (no license declared). A value that does not parse gets a "not an SPDX expression" message. UNLICENSED stays under "not in allowlist".
  5. Move the 9-entry allowlist into a JSON file in src/domain/licensing/, alongside the shared test vectors, so swamp-club copies one allowlist the way it copies the SPDX lists.

Open, unanswered: how the UAT controls a dependency's license offline. A proposal was to read NPM_CONFIG_REGISTRY in the trust check (swamp-uat#665). Undecided.

Sign in to post a ripple.