Replace the spdx-rs dependency with a minimal in-tree SPDX tag-value parser by jakubadamw · Pull Request #154823 · rust-lang/rust

jakubadamw · 2026-04-04T17:44:21Z

The spdx-rs crate is no longer maintained and is behind on its own dependency updates. It is currently used in the collect-license-metadata tool, employing a single function therefrom: spdx_rs::parsers::spdx_from_tag_value, which parses the output of the reuse tool to extract file names, licences and copyright text.

This PR replaces the use of said function with a small minimal parser that handles just the subset of the SPDX tag-value format that is needed: Tag: Value line pairs and multi-line <text>...</text> blocks.

Coincidentally, this gets rid of the last transitive dependency on syn v1.

rustbot · 2026-04-04T17:44:25Z

These commits modify the Cargo.lock file. Unintentional changes to Cargo.lock can be introduced when switching branches and rebasing PRs.

If this was unintentional then you should revert the changes before this PR is merged.
Otherwise, you can ignore this comment.

rustbot · 2026-04-04T17:44:26Z

r? @Mark-Simulacrum

rustbot has assigned @Mark-Simulacrum.
They will have a look at your PR within the next two weeks and either review your PR or reassign to another reviewer.

Use r? to explicitly pick a reviewer

Why was this reviewer chosen?

The reviewer was selected based on:

Owners of files modified in this PR: @Mark-Simulacrum

Mark-Simulacrum · 2026-04-11T15:07:20Z

 serde = { version = "1.0.147", features = ["derive"] }
 serde_json = "1.0.85"
 similar = "2.7.0"
-spdx-rs = "0.5.1"


View changes since the review

It looks like crates.io is using spdx (no -rs). Maybe we can do the same?

If that doesn't work, I'd like to see a few unit tests added for the inlined code that exercise the parsing.

@Mark-Simulacrum, the spdx crate deals with parsing SPDX licence expressions (e.g. ”MIT OR Apache-2.0”) as described in the annex B of the spec – it validates and decomposes them. What we need here is a parser for the SPDX 2.3 tag-value document format as produced by the reuse tool. The spdx crate’s features don’t extend to that, as far as I can tell, and there's no actively maintained crate on crates.io that would be helpful here.

I've now added a number of unit tests for the inlined parser, covering both the happy paths (single and multiple file entries, compound licence expressions, single-line and multi-line blocks) and a few error paths (missing fields, unterminated blocks). The examples used are extracted from the SPDX 2.3 specification.

@Mark-Simulacrum, thanks for reviewing this!

@rustbot ready

rustbot · 2026-04-11T15:08:58Z

Reminder, once the PR becomes ready for a review, use @rustbot ready.

…parser The spdx-rs crate is no longer maintained and is behind on its own dependency updates. The only function that collect-license-metadata uses from it is `spdx_rs::parsers::spdx_from_tag_value`, which parses the output of the `reuse` tool to extract file names, licences and copyright text. Replace this with a small minimal parser that handles just the subset of the SPDX tag-value format that is needed: `Tag: Value` line pairs and multi-line `<text>...</text>` blocks. Coincidentally, this gets rid of the last transitive dependency on syn v1.

rustbot · 2026-04-12T21:08:10Z

This PR was rebased onto a different main commit. Here's a range-diff highlighting what actually changed.

Rebasing is a normal part of keeping PRs up to date, so no action is needed—this note is just to help reviewers.

Mark-Simulacrum · 2026-04-18T18:38:59Z

@bors r+

rust-bors · 2026-04-18T18:39:01Z

📌 Commit 1bdbde5 has been approved by Mark-Simulacrum

It is now in the queue for this repository.

…Mark-Simulacrum Replace the spdx-rs dependency with a minimal in-tree SPDX tag-value parser The spdx-rs crate [is no longer maintained](https://github.com/doubleopen-project/spdx-rs/pulls) and is behind on its own dependency updates. It is currently used in [the collect-license-metadata tool](https://github.com/rust-lang/rust/tree/main/src/tools/collect-license-metadata), employing a single function therefrom: `spdx_rs::parsers::spdx_from_tag_value`, which parses the output of the `reuse` tool to extract file names, licences and copyright text. This PR replaces the use of said function with a small minimal parser that handles just the subset of the SPDX tag-value format that is needed: `Tag: Value` line pairs and multi-line `<text>...</text>` blocks. Coincidentally, this gets rid of the last transitive dependency on syn v1.

Rollup of 8 pull requests Successful merges: - #155370 (Add regression test for dead code elimination with drop + panic) - #154823 (Replace the spdx-rs dependency with a minimal in-tree SPDX tag-value parser) - #155352 (triagebot.toml: Sync `assign.owners` with `autolabel."T-compiler"`) - #155431 (Add temporary scope to assert_matches) - #152995 (ACP Implementation of PermissionsExt for Windows ) - #153873 (deprecate `std::char` constants and functions) - #154654 (Move `std::io::ErrorKind` to `core::io`) - #154865 (libtest: use binary search for --exact test filtering)

…Mark-Simulacrum Replace the spdx-rs dependency with a minimal in-tree SPDX tag-value parser The spdx-rs crate [is no longer maintained](https://github.com/doubleopen-project/spdx-rs/pulls) and is behind on its own dependency updates. It is currently used in [the collect-license-metadata tool](https://github.com/rust-lang/rust/tree/main/src/tools/collect-license-metadata), employing a single function therefrom: `spdx_rs::parsers::spdx_from_tag_value`, which parses the output of the `reuse` tool to extract file names, licences and copyright text. This PR replaces the use of said function with a small minimal parser that handles just the subset of the SPDX tag-value format that is needed: `Tag: Value` line pairs and multi-line `<text>...</text>` blocks. Coincidentally, this gets rid of the last transitive dependency on syn v1.

Rollup of 9 pull requests Successful merges: - #155370 (Add regression test for dead code elimination with drop + panic) - #154823 (Replace the spdx-rs dependency with a minimal in-tree SPDX tag-value parser) - #154972 (Implement `core::arch::return_address` and tests) - #155294 (Add test for coalescing of diagnostic attribute duplicates) - #155352 (triagebot.toml: Sync `assign.owners` with `autolabel."T-compiler"`) - #155431 (Add temporary scope to assert_matches) - #152995 (ACP Implementation of PermissionsExt for Windows ) - #153873 (deprecate `std::char` constants and functions) - #154865 (libtest: use binary search for --exact test filtering)

…Mark-Simulacrum Replace the spdx-rs dependency with a minimal in-tree SPDX tag-value parser The spdx-rs crate [is no longer maintained](https://github.com/doubleopen-project/spdx-rs/pulls) and is behind on its own dependency updates. It is currently used in [the collect-license-metadata tool](https://github.com/rust-lang/rust/tree/main/src/tools/collect-license-metadata), employing a single function therefrom: `spdx_rs::parsers::spdx_from_tag_value`, which parses the output of the `reuse` tool to extract file names, licences and copyright text. This PR replaces the use of said function with a small minimal parser that handles just the subset of the SPDX tag-value format that is needed: `Tag: Value` line pairs and multi-line `<text>...</text>` blocks. Coincidentally, this gets rid of the last transitive dependency on syn v1.

Rollup of 10 pull requests Successful merges: - #155370 (Add regression test for dead code elimination with drop + panic) - #154823 (Replace the spdx-rs dependency with a minimal in-tree SPDX tag-value parser) - #155294 (Add test for coalescing of diagnostic attribute duplicates) - #155352 (triagebot.toml: Sync `assign.owners` with `autolabel."T-compiler"`) - #155431 (Add temporary scope to assert_matches) - #152995 (ACP Implementation of PermissionsExt for Windows ) - #153873 (deprecate `std::char` constants and functions) - #154865 (libtest: use binary search for --exact test filtering) - #154979 (add #[must_use] macros for floats) - #155504 (Remove `AttributeLintKind` variants - part 2)

…uwer Rollup of 12 pull requests Successful merges: - #155370 (Add regression test for dead code elimination with drop + panic) - #154823 (Replace the spdx-rs dependency with a minimal in-tree SPDX tag-value parser) - #155294 (Add test for coalescing of diagnostic attribute duplicates) - #155352 (triagebot.toml: Sync `assign.owners` with `autolabel."T-compiler"`) - #155431 (Add temporary scope to assert_matches) - #153873 (deprecate `std::char` constants and functions) - #154865 (libtest: use binary search for --exact test filtering) - #154979 (add #[must_use] macros for floats) - #155486 (c-variadic: add roundtrip test) - #155504 (Remove `AttributeLintKind` variants - part 2) - #155510 (Update Tidy python executable path) - #155514 (codegen-options docs: remove -Csoft-float)

Rollup merge of #154823 - jakubadamw:spdx-rs-replacement, r=Mark-Simulacrum Replace the spdx-rs dependency with a minimal in-tree SPDX tag-value parser The spdx-rs crate [is no longer maintained](https://github.com/doubleopen-project/spdx-rs/pulls) and is behind on its own dependency updates. It is currently used in [the collect-license-metadata tool](https://github.com/rust-lang/rust/tree/main/src/tools/collect-license-metadata), employing a single function therefrom: `spdx_rs::parsers::spdx_from_tag_value`, which parses the output of the `reuse` tool to extract file names, licences and copyright text. This PR replaces the use of said function with a small minimal parser that handles just the subset of the SPDX tag-value format that is needed: `Tag: Value` line pairs and multi-line `<text>...</text>` blocks. Coincidentally, this gets rid of the last transitive dependency on syn v1.

rustbot added the S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. label Apr 4, 2026

rustbot assigned Mark-Simulacrum Apr 4, 2026

cyrgani linked an issue Apr 5, 2026 that may be closed by this pull request

Tracking issue for syn 2.0 inside rust-lang/rust #109302

Closed

Mark-Simulacrum requested changes Apr 11, 2026

View reviewed changes

rustbot added S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Apr 11, 2026

jakubadamw added 3 commits April 12, 2026 22:06

Add a bunch of unit tests for the in-house parser

57de72c

Move spdx.rs to spdx/mod.rs

1bdbde5

jakubadamw force-pushed the spdx-rs-replacement branch from 197a2da to 1bdbde5 Compare April 12, 2026 21:08

rustbot added S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. and removed S-waiting-on-author Status: This is awaiting some action (such as code changes or more information) from the author. labels Apr 12, 2026

jakubadamw requested a review from Mark-Simulacrum April 14, 2026 21:40

rust-bors Bot added S-waiting-on-bors Status: Waiting on bors to run and complete tests. Bors will change the label on completion. and removed S-waiting-on-review Status: Awaiting review from the assignee but also interested parties. labels Apr 18, 2026

jhpratt mentioned this pull request Apr 19, 2026

Rollup of 8 pull requests #155503

Closed

jhpratt mentioned this pull request Apr 19, 2026

Rollup of 9 pull requests #155506

Closed

jhpratt mentioned this pull request Apr 19, 2026

Rollup of 10 pull requests #155511

Closed

JonathanBrouwer mentioned this pull request Apr 19, 2026

Rollup of 12 pull requests #155519

Merged

GrigorenkoPV mentioned this pull request Apr 19, 2026

Tracking issue for syn 2.0 inside rust-lang/rust #109302

Closed

rust-bors Bot merged commit 0883b8c into rust-lang:main Apr 19, 2026
11 checks passed

rustbot added this to the 1.97.0 milestone Apr 19, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Replace the spdx-rs dependency with a minimal in-tree SPDX tag-value parser#154823

Replace the spdx-rs dependency with a minimal in-tree SPDX tag-value parser#154823
rust-bors[bot] merged 3 commits intorust-lang:mainfrom
jakubadamw:spdx-rs-replacement

jakubadamw commented Apr 4, 2026 •

edited

Loading

Uh oh!

rustbot commented Apr 4, 2026

Uh oh!

rustbot commented Apr 4, 2026

Uh oh!

Mark-Simulacrum Apr 11, 2026 •

edited by rustbot

Loading

Uh oh!

jakubadamw Apr 12, 2026 •

edited

Loading

Uh oh!

jakubadamw Apr 12, 2026

Uh oh!

rustbot commented Apr 11, 2026

Uh oh!

rustbot commented Apr 12, 2026

Uh oh!

Mark-Simulacrum commented Apr 18, 2026

Uh oh!

rust-bors Bot commented Apr 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

jakubadamw commented Apr 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rustbot commented Apr 4, 2026

Uh oh!

rustbot commented Apr 4, 2026

Uh oh!

Mark-Simulacrum Apr 11, 2026 • edited by rustbot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jakubadamw Apr 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jakubadamw Apr 12, 2026

Choose a reason for hiding this comment

Uh oh!

rustbot commented Apr 11, 2026

Uh oh!

rustbot commented Apr 12, 2026

Uh oh!

Mark-Simulacrum commented Apr 18, 2026

Uh oh!

rust-bors Bot commented Apr 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jakubadamw commented Apr 4, 2026 •

edited

Loading

Mark-Simulacrum Apr 11, 2026 •

edited by rustbot

Loading

jakubadamw Apr 12, 2026 •

edited

Loading