Normalize messy license names by mapping each string to an SPDX identifier through a reviewed alias table, parsing expressions with AND, OR and WITH, and sending anything that does not match cleanly to an unknown bucket. Never guess. A wrong mapping turns a review item into a false approval.
Why it is needed
Ecosystems differ. Maven's name field is free text and the reference only recommends SPDX. Older Python packages used free text and classifiers. npm accepts SPDX expressions and a pointer to a custom file. A policy engine needs one vocabulary, and SPDX is the common one. The SPDX License List, currently at version 3.29.0 dated 16 September 2026, gives each license a stable short identifier and has a separate list of exceptions.
A mapping method
- Collect every distinct license string in your inventory, with a count.
- Build an alias table: for example several spellings of the Apache license map to Apache-2.0.
- Have a person review the table once. Review the long tail by frequency.
- Parse expressions as expressions. Split on AND, OR and WITH, and map each part.
- Keep deprecated identifiers mapped to their current form, since deprecated ones remain valid but should no longer be used.
- Mark every mapped result with its source string, so reviewers can see the original.
| Input | Output | Confidence |
|---|---|---|
| MIT | MIT | High, already an id |
| Apache Software License 2.0 | Apache-2.0 | High after review |
| GPL | Unknown | Low, version is missing |
| BSD | Unknown | Low, which BSD? |
| See license file | Read the file | Manual |
Cases that must stay unknown
A bare GPL could be version 2 or 3, only or or later, and the difference matters. A bare BSD could be two, three or four clauses. A string that names a license plus an extra sentence is not the standard license. See GPL only versus or later identifiers.
Keep the table alive
Review new strings weekly. Re-run normalization when the SPDX list updates. Store overrides with a reason, so one decision serves every project.
Try it yourself
Click through it at your own pace, or open it full screen.
Scan the component list for license values and judge which ones would map cleanly.
Safeguard offers SBOM and dependency scanning, plus a free scan.
Quick check
Can I map a bare GPL to GPL-3.0-only?
No. Version and the only or later choice are unknown, so keep it unknown until someone checks.
Should deprecated identifiers be rejected?
No. SPDX says they remain valid. Map them to the current identifier when you can.
Sources
- SPDX License List: https://spdx.org/licenses/
- Apache Maven, POM Reference, Licenses: https://maven.apache.org/pom.html#Licenses
- npm Docs, package.json, license: https://docs.npmjs.com/cli/v10/configuring-npm/package-json#license
Last reviewed: 19 October 2026.
