SPDX Validator

The SPDX Validator is a standards-driven tool that consumes SPDX documents of varying formats (RDF/XML, JSON, tag=value) and returns a structured validation report. It is designed for developers, build engineers, and compliance teams who publish or audit open source components.
The validator checks SPDX 2.2/2.3 conformance, validates required fields (SPDXVersion, dataLicense, DocumentName, DocumentURI, CreationInfo), and confirms license IDs against the SPDX License List. It also validates metadata consistency and document identity to reduce audit risk.
Optional features include configurable strictness, embedded license-list comparisons, and a JSON output schema for integration with CI and ticketing systems.
Inputs are a single SPDX document string (with an optional format hint); outputs are a machine-readable report containing is_valid, errors, warnings, and an exportable summary for downstream tooling.
Conceptually, the tool performs tokenization, grammar-based parsing, and rule-driven checks that map issues to codes, messages, and precise locations. It is designed to provide actionable guidance, not to rewrite documents.
Use cases include pre-publication validation, compliance audits, and automated validation in CI pipelines; it supports large documents and returns structured feedback that teams can act on quickly.