x/pkgsite: support SPDX or URL license declarations

[makew0rld]

What is the URL of the page with the issue?

https://pkg.go.dev/github.com/hyphacoop/go-dasl@v0.1.0/drisl

What is your user agent?

Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0

Screenshot

What did you do?

My project is dual licensed. There is an appropriately recognized LICENSE-MIT and LICENSE-APACHE file. But the LICENSE file looks like this:

SPDX-License-Identifier: MIT OR Apache-2.0

This work is dual-licensed under the MIT and Apache 2.0.
You can choose between one of them to use this work.

MIT: https://www.opensource.org/licenses/mit
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0

I contend this is a very human and machine readable license file, and pkg.go.dev should be able to recognize it. Maybe by updating licensechecker to support SPDX declarations? Or by having pkg.go.dev use the URL detection functionality? Not sure what's going on here. Thanks.

[makew0rld]

Once I add in some license text, it correctly detects the license file as representing a dual license, even though I only added the text of the MIT.

Example (working):

SPDX-License-Identifier: MIT OR Apache-2.0

This work is dual-licensed under the MIT and Apache 2.0.
You can choose between one of them to use this work.

MIT: https://www.opensource.org/licenses/mit
Apache-2.0: https://www.apache.org/licenses/LICENSE-2.0

The text of the MIT license follows:

MIT License

Copyright (c) 2025 Hypha Worker Co-operative Inc.

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.

[seankhliao]

see #36840

[makew0rld]

But this is not an unknown or unsupported license. pkg.go.dev already supports Apache 2.0 and MIT, as well as the concept of dual licensing. I'm asking for better license recognition, either based on SPDX (an established standard) or URLs (already supported by license-checker).

[seankhliao]

specifically #36840 (comment)

[makew0rld]

I see, thanks.

[gabyhelp]

Related Issues

• x/pkgsite: documentation not shown for dual licensed repos with an unrecognized license #68351 (closed)
• x/pkgsite: Apache 2.0 License detected but package documentation is still hidden #48068 (closed)
• x/pkgsite: trouble with Apache 2 LICENSE file at repository root #59782 (closed)
• x/pkgsite: licence not yet showing up after it was added to a module #40863 (closed)
• x/pkgsite: LICENSE not detected #64524 (closed)
• x/pkgsite: valid license after undetected license doesn't update docs #43392 (closed)
• x/pkgsite: incorrect license parse of github.com/octokit/go-sdk-enterprise-cloud #68705 (closed)
• x/pkgsite: MIT license not recognized #74480 (closed)
• x/pkgsite: #47438 (closed)
• x/pkgsite: docs not shown for packages with broken licenses #39388 (closed)

_{(Emoji vote if this was helpful or unhelpful; more detailed feedback welcome in this discussion.)}