Refactor/compare complex expressions

[neodmy]

Description

This change focuses on two aspects:

• Addressing the current issue when comparing two SPDX expressions
• Allowing the use of an array of licenses as the second argument, following this comment and based on this change.

Our main goal is to make both approaches compatible, so users can decide whether to compare SPDX expressions or an allowed list of licenses.

Related Issue

#14

Motivation and Context

The main problem right now is that the library doesn't function properly when comparing certain SPDX expressions, such as satisfies("MIT", "MIT AND Apache-2.0"). In this case, the function should return false.

With the following example MIT AND Apache-2.0 OR GPL-1.0+, the expand function returns the following:

[
  ["MIT", "Apache-2.0"],
  ["GPL-1.0+"]
]

This implies that the elements in the outer array are alternatives based on the OR operator. The licenses in the inner arrays are grouped based on the AND operator. If second were MIT OR GPL-2.0, the result would be:

[
  ["MIT"],
  ["GPL-2.0"]
]

In our opinion, the algorithm should check if there's any inner element within the outer array of first that is satisfied by any inner element of second.

When comparing ["MIT", "Apache-2.0"] and ["MIT"], the result is negative. Similarly, when comparing ["MIT", "Apache-2.0"] and ["GPL-2.0"], as well as ["GPL-1.0+"] and ["MIT"], the result is again negative. However, when comparing ["GPL-1.0+"] and ["GPL-2.0"], the result is positive since first should be MIT AND Apache-2.0 OR GPL-1.0+, which we understand is correct.

On the other hand, we believe that the suggestion mentioned in this comment and this change can be compatible with second as an SPDX expression. This way, backwards compatibility is ensured because there may be users who expect to use satisfies with two expressions, while other users expect second as an allowList.

We have interpreted that the licenses in second would be alternatives that first should comply with. So the following usages would be equivalent:

satisfies("MIT", "MIT OR Apache-2.0")
satisfies("MIT", ["MIT", "Apache-2.0"])

In the event that the interpretation of second as an allowList implies that the licenses are not alternatives but requirements that first must fulfill, the PR would need a slight modification. In that case, the following examples would be equivalent:

satisfies("MIT", "MIT AND Apache-2.0")
satisfies("MIT", ["MIT", "Apache-2.0"])

@kemitchell please, let us know which of the above approaches you have in mind. Thanks

cc/ @inigomarquinez @nanotower

[kemitchell]

@neodmy I am going to take this package in the direction of satisfies(expression, arrayOfIDs). I understand that is not your preferred interface. Please feel free to fork from v5.0.1 and elaborate the satisfies(expression, expression) semantics however suits you and your users.

[neodmy]

@neodmy I am going to take this package in the direction of satisfies(expression, arrayOfIDs). I understand that is not your preferred interface. Please feel free to fork from v5.0.1 and elaborate the satisfies(expression, expression) semantics however suits you and your users.

Thanks @kemitchell, will surely do.