False positives with SPDX license classifiers

[juhannc]

Please complete the following tasks

• I have searched the open and rejected issues

Example data

CC-BY-ND-1.0

Incorrect correction

ND should be AND

Description of data format

CC-BY-ND-1.0
CC-BY-ND-2.0
CC-BY-ND-2.5
CC-BY-ND-3.0-DE
CC-BY-ND-3.0
CC-BY-ND-4.0
CC-BY-NC-ND-1.0
CC-BY-NC-ND-2.0
CC-BY-NC-ND-2.5
CC-BY-NC-ND-3.0-DE
CC-BY-NC-ND-3.0-IGO
CC-BY-NC-ND-3.0
CC-BY-NC-ND-4.0
iMatix
Unicode-TOU

Justification

Multiple SPDX license classifiers get wrongly corrected:

CC-BY-ND-1.0, CC-BY-ND-2.0, CC-BY-ND-2.5, CC-BY-ND-3.0-DE, CC-BY-ND-3.0, CC-BY-ND-4.0, CC-BY-NC-ND-1.0, CC-BY-NC-ND-2.0, CC-BY-NC-ND-2.5, CC-BY-NC-ND-3.0-DE, CC-BY-NC-ND-3.0-IGO, CC-BY-NC-ND-3.0, CC-BY-NC-ND-4.0:
error: ND should be AND

iMatix:
error: Matix should be Matrix

Unicode-TOU:
error: TOU should be YOU

Given the rise of reuse and SPDX in general, those classifiers are often at the top of every file in a repository, thereby triggering substantial false positives.

Notes

Full list of SPDX classifiers (as of 2026-02-02):

3D-Slicer-1.0
Glide
Abstyles
AFL-1.1
AFL-1.2
AFL-2.0
AFL-2.1
AFL-3.0
AMPAS
AdaCore-doc
APL-1.0
Adobe-Display-PostScript
Adobe-Glyph
APAFML
Adobe-2006
Adobe-Utopia
AGPL-1.0-only
AGPL-1.0-or-later
Afmparse
Aladdin
ADSL
AMD-newlib
AMDPLPA
AML-glslang
ANTLR-PD
ANTLR-PD-fallback
any-OSI
any-OSI-perl-modules
Apache-1.0
Apache-1.1
Apache-2.0
App-s2p
AML
APSL-1.0
APSL-1.1
APSL-1.2
APSL-2.0
Arphic-1999
Artistic-1.0
Artistic-dist
Artistic-1.0-Perl
Artistic-1.0-cl8
Artistic-2.0
Aspell-RU
ASWF-Digital-Assets-1.1
ASWF-Digital-Assets-1.0
AAL
Baekmuk
Bahyph
Barr
bcrypt-Solar-Designer
Beerware
Bitstream-Charter
Bitstream-Vera
BitTorrent-1.0
BitTorrent-1.1
BlueOak-1.0.0
Boehm-GC
Boehm-GC-without-fee
BSL-1.0
Borceux
Brian-Gladman-2-Clause
Brian-Gladman-3-Clause
BSD-1-Clause
BSD-2-Clause-first-lines
BSD-2-Clause-Darwin
BSD-2-Clause
BSD-2-Clause-pkgconf-disclaimer
BSD-2-Clause-Views
BSD-3-Clause
BSD-3-Clause-acpica
BSD-3-Clause-Clear
BSD-3-Clause-flex
BSD-3-Clause-Modification
BSD-3-Clause-No-Military-License
BSD-3-Clause-No-Nuclear-License
BSD-3-Clause-No-Nuclear-License-2014
BSD-3-Clause-No-Nuclear-Warranty
BSD-3-Clause-Open-MPI
BSD-3-Clause-Sun
BSD-4-Clause-Shortened
BSD-4-Clause
BSD-4.3RENO
BSD-4.3TAHOE
BSD-Advertising-Acknowledgement
BSD-Protection
BSD-Source-Code
BSD-Source-beginning-file
BSD-3-Clause-Attribution
BSD-Attribution-HPND-disclaimer
0BSD
BSD-2-Clause-Patent
BSD-4-Clause-UC
BSD-Inferno-Nettverk
BUSL-1.1
bzip2-1.0.6
Caldera
Caldera-no-preamble
Catharon
CECILL-1.0
CECILL-1.1
CECILL-2.0
CECILL-2.1
CECILL-B
CECILL-C
CERN-OHL-1.1
CERN-OHL-1.2
CERN-OHL-P-2.0
CERN-OHL-S-2.0
CERN-OHL-W-2.0
CFITSIO
check-cvs
checkmk
ClArtistic
Clips
MIT-CMU
CMU-Mach-nodoc
CMU-Mach
CNRI-Jython
CNRI-Python
CNRI-Python-GPL-Compatible
CPOL-1.02
CDDL-1.0
CDDL-1.1
CDL-1.0
LOOP
CPAL-1.0
CPL-1.0
cve-tou
CDLA-Permissive-1.0
CDLA-Permissive-2.0
CDLA-Sharing-1.0
Community-Spec-1.0
C-UDA-1.0
CATOSL-1.1
Condor-1.1
COIL-1.0
copyleft-next-0.3.0
copyleft-next-0.3.1
Cornell-Lossless-JPEG
CC-BY-1.0
CC-BY-2.0
CC-BY-2.5-AU
CC-BY-2.5
CC-BY-3.0-AU
CC-BY-3.0-AT
CC-BY-3.0-DE
CC-BY-3.0-IGO
CC-BY-3.0-NL
CC-BY-3.0-US
CC-BY-3.0
CC-BY-4.0
CC-BY-ND-1.0
CC-BY-ND-2.0
CC-BY-ND-2.5
CC-BY-ND-3.0-DE
CC-BY-ND-3.0
CC-BY-ND-4.0
CC-BY-NC-1.0
CC-BY-NC-2.0
CC-BY-NC-2.5
CC-BY-NC-3.0-DE
CC-BY-NC-3.0
CC-BY-NC-4.0
CC-BY-NC-ND-1.0
CC-BY-NC-ND-2.0
CC-BY-NC-ND-2.5
CC-BY-NC-ND-3.0-DE
CC-BY-NC-ND-3.0-IGO
CC-BY-NC-ND-3.0
CC-BY-NC-ND-4.0
CC-BY-NC-SA-1.0
CC-BY-NC-SA-2.0-UK
CC-BY-NC-SA-2.0
CC-BY-NC-SA-2.0-DE
CC-BY-NC-SA-2.5
CC-BY-NC-SA-3.0-DE
CC-BY-NC-SA-3.0-IGO
CC-BY-NC-SA-3.0
CC-BY-NC-SA-4.0
CC-BY-SA-1.0
CC-BY-SA-2.0-UK
CC-BY-SA-2.0
CC-BY-SA-2.1-JP
CC-BY-SA-2.5
CC-BY-SA-3.0-AT
CC-BY-SA-3.0-DE
CC-BY-SA-3.0
CC-BY-SA-4.0
CC-BY-NC-SA-2.0-FR
CC-BY-SA-3.0-IGO
CC-PDDC
CC-PDM-1.0
CC-SA-1.0
CC0-1.0
Cronyx
Crossword
CAL-1.0
CAL-1.0-Combined-Work-Exception
CryptoSwift
CrystalStacker
CUA-OPL-1.0
Cube
curl
DL-DE-BY-2.0
DL-DE-ZERO-2.0
dtoa
DEC-3-Clause
DRL-1.0
DRL-1.1
D-FSL-1.0
diffmark
WTFPL
DOC
DocBook-DTD
DocBook-Schema
DocBook-Stylesheet
DocBook-XML
Dotseqn
DSDP
dvipdfm
EPL-1.0
EPL-2.0
ECL-1.0
ECL-2.0
eGenix
EFL-1.0
EFL-2.0
Elastic-2.0
MIT-advertising
MIT-enna
Entessa
EPICS
ErlPL-1.1
etalab-2.0
EUDatagrid
EUPL-1.0
EUPL-1.1
EUPL-1.2
Eurosym
Fair
MIT-feh
Ferguson-Twofish
Frameworx-1.0
FDK-AAC
FreeBSD-DOC
FreeImage
FTL
FSFAP
FSFAP-no-warranty-disclaimer
FSFUL
FSFULLRSD
FSFULLRWD
FSFULLR
FSL-1.1-ALv2
FSL-1.1-MIT
Furuseth
FBM
fwlw
Game-Programming-Gems
GD
generic-xts
Giftware
GL2PS
Glulxe
GCR-docs
AGPL-3.0-only
AGPL-3.0-or-later
GFDL-1.1-only
GFDL-1.1-invariants-only
GFDL-1.1-no-invariants-only
GFDL-1.1-or-later
GFDL-1.1-invariants-or-later
GFDL-1.1-no-invariants-or-later
GFDL-1.2-only
GFDL-1.2-invariants-only
GFDL-1.2-no-invariants-only
GFDL-1.2-or-later
GFDL-1.2-invariants-or-later
GFDL-1.2-no-invariants-or-later
GFDL-1.3-only
GFDL-1.3-invariants-only
GFDL-1.3-no-invariants-only
GFDL-1.3-or-later
GFDL-1.3-invariants-or-later
GFDL-1.3-no-invariants-or-later
GPL-1.0-only
GPL-1.0-or-later
GPL-2.0-only
GPL-2.0-or-later
GPL-3.0-only
GPL-3.0-or-later
LGPL-2.1-only
LGPL-2.1-or-later
LGPL-3.0-only
LGPL-3.0-or-later
LGPL-2.0-only
LGPL-2.0-or-later
gnuplot
GLWTPL
Graphics-Gems
gSOAP-1.3b
gtkbook
Gutmann
HaskellReport
HDF5
hdparm
HP-1986
HP-1989
BSD-3-Clause-HP
HIDAPI
Hippocratic-2.1
HPND
HPND-DEC
HPND-doc-sell
HPND-doc
HPND-Fenneberg-Livingston
HPND-INRIA-IMAG
HPND-Intel
HPND-Kevlin-Henney
HPND-Markus-Kuhn
HPND-merchantability-variant
HPND-Netrek
HPND-Pbmplus
HPND-sell-regexpr
HPND-sell-variant
HPND-sell-MIT-disclaimer-xserver
HPND-UC
HPND-UC-export-US
HPND-MIT-disclaimer
HPND-sell-variant-MIT-disclaimer
HPND-sell-variant-MIT-disclaimer-rev
HPND-export2-US
HPND-export-US
HPND-export-US-acknowledgement
HPND-export-US-modify
HTMLTIDY
IBM-pibs
IPL-1.0
ICU
IEC-Code-Components-EULA
ImageMagick
iMatix
Imlib2
IJG
IJG-short
Info-ZIP
Inner-Net-2.0
InnoSetup
Intel-ACPI
Intel
Interbase-1.0
IPA
ISC
ISC-Veillard
Jam
JPNIC
JasPer-2.0
jove
JPL-image
JSON
Kastrup
Kazlib
Knuth-CTAN
LPPL-1.0
LPPL-1.1
LPPL-1.2
LPPL-1.3a
LPPL-1.3c
Latex2e
Latex2e-translated-notice
BSD-3-Clause-LBNL
Leptonica
LGPLLR
Libpng
libselinux-1.0
libtiff
libutil-David-Nugent
LAL-1.2
LAL-1.3
LiLiQ-P-1.1
LiLiQ-Rplus-1.1
LiLiQ-R-1.1
Linux-OpenIB
Linux-man-pages-1-para
Linux-man-pages-copyleft
Linux-man-pages-copyleft-2-para
Linux-man-pages-copyleft-var
LPD-document
lsof
LPL-1.02
LPL-1.0
Lucida-Bitmap-Fonts
LZMA-SDK-9.11-to-9.20
LZMA-SDK-9.22
Mackerras-3-Clause-acknowledgment
Mackerras-3-Clause
magaz
mailprio
MakeIndex
man2html
Martin-Birgmeier
MTLL
McPhee-slideshow
metamail
UMich-Merit
MS-LPL
MS-PL
MS-RL
Minpack
MIPS
MITNFA
MIT-Click
MIT-Festival
MIT-Khronos-old
MIT
MIT-Modern-Variant
MIT-0
MIT-open-group
MIT-testregex
MIT-Wu
MMIXware
Motosoto
MPL-1.0
MPL-1.1
MPL-2.0
MPL-2.0-no-copyleft-exception
MPEG-SSG
mpi-permissive
mpich2
mplus
MulanPSL-1.0
MulanPSL-2.0
Multics
Mup
NAIST-2003
NASA-1.3
Naumen
NCBI-PD
NCL
NBPL-1.0
NetCDF
NGPL
NOSL
NPL-1.0
NPL-1.1
Newsletr
ngrep
NICTA-1.0
NIST-PD
NIST-PD-fallback
NIST-Software
NLPL
Nokia
NCGL-UK-2.0
NPOSL-3.0
NLOD-1.0
NLOD-2.0
Noweb
NRL
NTIA-PD
NTP
NTP-0
OAR
OCLC-2.0
OFFIS
OGC-1.0
OCCT-PL
ODC-By-1.0
ODbL-1.0
PDDL-1.0
OGL-Canada-2.0
OGL-UK-1.0
OGL-UK-2.0
OGL-UK-3.0
OGTSL
OLDAP-2.2.2
OLDAP-1.1
OLDAP-1.2
OLDAP-1.3
OLDAP-1.4
OLDAP-2.0
OLDAP-2.0.1
OLDAP-2.1
OLDAP-2.2
OLDAP-2.2.1
OLDAP-2.3
OLDAP-2.4
OLDAP-2.5
OLDAP-2.6
OLDAP-2.7
OLDAP-2.8
OLFL-1.3
OML
OPL-1.0
OPUBL-1.0
OSL-1.0
OSL-1.1
OSL-2.0
OSL-2.1
OSL-3.0
O-UDA-1.0
OpenPBS-2.3
OpenSSL
OpenSSL-standalone
OpenVision
OSET-PL-2.1
PADL
PPL
PHP-3.0
PHP-3.01
Pixar
pkgconf
Plexus
libpng-1.6.35
libpng-2.0
pnmstitch
PolyForm-Noncommercial-1.0.0
PolyForm-Small-Business-1.0.0
PostgreSQL
psfrag
psutils
python-ldap
Python-2.0
Python-2.0.1
PSF-2.0
QPL-1.0
QPL-1.0-INRIA-2004
Qhull
radvd
Rdisc
RPSL-1.0
RPL-1.1
RPL-1.5
RHeCos-1.1
RSCPL
RSA-MD
Ruby
Ruby-pty
SAX-PD
SAX-PD-2.0
Saxpath
SCEA
SchemeReport
SWL
SMPPL
Sendmail
Sendmail-8.23
Sendmail-Open-Source-1.1
SSPL-1.0
SGI-B-1.0
SGI-B-1.1
SGI-B-2.0
SGI-OpenGL
SGP4
OFL-1.0
OFL-1.0-no-RFN
OFL-1.0-RFN
OFL-1.1
OFL-1.1-no-RFN
OFL-1.1-RFN
SimPL-2.0
SL
Sleepycat
SMAIL-GPL
SNIA
snprintf
SOFA
softSurfer
SHL-0.5
SHL-0.51
Soundex
Spencer-86
Spencer-94
Spencer-99
blessing
SSH-OpenSSH
SSH-short
ssh-keyscan
SSLeay-standalone
SMLNJ
SugarCRM-1.1.3
SISSL
SISSL-1.2
Sun-PPP
Sun-PPP-2000
SPL-1.0
SunPro
SUL-1.0
swrule
Watcom-1.0
Symlinks
BSD-Systemics
BSD-Systemics-W3Works
OGDL-Taiwan-1.0
TAPR-OHL-1.0
TCL
TCP-wrappers
TU-Berlin-1.0
TU-Berlin-2.0
TermReadKey
TTWL
MirOS
Parity-6.0.0
Parity-7.0.0
Unlicense
ThirdEye
TPL-1.0
threeparttable
TPDL
TMate
TORQUE-1.1
TGPPL-1.0
TOSL
TrustedQSL
TTYP0
Ubuntu-font-1.0
UCAR
ulem
Unicode-DFS-2015
Unicode-DFS-2016
Unicode-3.0
Unicode-TOU
OPL-UK-3.0
UPL-1.0
NCSA
UnixCrypt
Unlicense-libtelnet
Unlicense-libwhirlpool
UCL-1.0
URT-RLE
Vim
VOSTROM
VSL-1.0
W3C-20150513
W3C-19980720
W3C
w3m
Widget-Workshop
Wsuipa
wwl
Xnet
X11
X11-distribute-modifications-variant
X11-swapped
Xdebug-1.03
Xerox
Xfig
XFree86-1.1
xinetd
xkeyboard-config-Zinoviev
xlock
xpp
XSkat
xzoom
YPL-1.0
YPL-1.1
Zed
Zeeff
Zend-2.0
Zimbra-1.3
Zimbra-1.4
Zlib
zlib-acknowledgement
ZPL-1.1
ZPL-2.0
ZPL-2.1

[epage]

One question is how we deal with this. Our identifiers don't include - separators, so our options look like:

• Bake these terms directly into our parser
• Set these up as extend-ignore-re with the associated performance hit
• Take only the component parts and put them in as identifiers, so ND would always be a valid identifier.

[juhannc]

I obviously have no authority, but from the sound of it, the first option seems to be the best. The SPDX license classifiers aren't going to change anytime soon. The last option, whitelisting ND and all other component parts sounds risky, especially with Matix which is even more likely to be a legit typo. Option two is probably a feasible middle ground but I understand your concerns regarding the performance impact

[epage]

the first option seems to be the best. The SPDX license classifiers aren't going to change anytime soon.

Not really thrilled with hard coding a bunch of strings that we have to check. Right now the parser is focused on formats and not values. This would also have a significant performance impact.

[juhannc]

In that case, the minimal solution would be the following regex, excluding only the (currently) false positives:

For the ND in Creative Commons licenses:

"CC(-BY)?(-NC)?(-ND|-SA)?-\\d+\\.\\d+(-[A-Z]{2,3})?"

For iMatix:

"iMatix"

For Unicode-TOU:

"Unicode-TOU"