SPDX 3 Validation Tool

Validates SPDX 3 documents

While standalone tools like pyshacl and check-jsonschema can be used to validate SPDX 3 documents, there are a few context-aware checks that can be useful. This includes:

Ignored SHACL errors for missing spdxIds if they are defined in an ExternalMap
Validation that any spdxId defined in an ExternalMap are not present in the document
SHACL Validation of merged documents (in this way, if you reference an spdxId from an ExternalMap and then pass the document that provides that spdxId, the type can be validated)
(Hopefully) More useful JSON schema error output

Installation

spdx3-validate can be installed using pip:

python3 -m pip install spdx3-validate

Using as a library

spdx3-validate can also be used programmatically. validate() takes a single source or an iterable of sources (a path or a URL) and returns a ValidationResult:

import spdx3_validate

result = spdx3_validate.validate("doc.spdx3.json")
if not result:
    print(result)  # prints the errors, one per line

# Or inspect the individual findings:
for error in result.errors:
    print(error)

The SPDX version is detected from each document's @context; pass version="X.Y" to force one.
Set check_merged=True to also validate the merged graph of several documents together.
A document that cannot be loaded (missing @context, unknown version, incompatible versions) raises spdx3_validate.SpdxValidateError.

Developing

Developing on spdx3-validate is best done using a virtual environment. You can configure one and install spdx3-validate in editable mode with all necessary development dependencies by running:

python3 -m venv .venv
. .venv/bin/activate
pip install -e ".[dev]"

TODO

Option to automatically download dependencies based on locationHint
Offline validation?
Cache downloaded context

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

spdx3_validate-0.0.7.tar.gz (13.3 kB view details)

Uploaded Aug 10, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

spdx3_validate-0.0.7-py3-none-any.whl (12.2 kB view details)

Uploaded Aug 10, 2026 Python 3

File details

Details for the file spdx3_validate-0.0.7.tar.gz.

File metadata

Download URL: spdx3_validate-0.0.7.tar.gz
Upload date: Aug 10, 2026
Size: 13.3 kB
Tags: Source
Uploaded using Trusted Publishing? Yes
Uploaded via: twine/6.1.0 CPython/3.13.13

File hashes

Hashes for spdx3_validate-0.0.7.tar.gz
Algorithm	Hash digest
SHA256	`167d4f18ecd643af80290d8b3edde16e9142f528a013b7e45be712e539b5b93a`
MD5	`98c3d84b8ee239e1665f7b12cd7c9d55`
BLAKE2b-256	`5297ddfbdf43953f7f284ce4b1b495b86091e1c30253fe5218297d934070e4de`

See more details on using hashes here.

Provenance

The following attestation bundles were made for spdx3_validate-0.0.7.tar.gz:

Publisher: publish.yaml on JPEWdev/spdx3-validate

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Statement:
- Statement type: https://in-toto.io/Statement/v1
- Predicate type: https://docs.pypi.org/attestations/publish/v1
- Subject name: spdx3_validate-0.0.7.tar.gz
- Subject digest: 167d4f18ecd643af80290d8b3edde16e9142f528a013b7e45be712e539b5b93a
- Sigstore transparency entry: 2409300515
- Sigstore integration time: Aug 10, 2026
Source repository:
- Permalink: JPEWdev/spdx3-validate@1a167d0ff50b38c55aed9e802c02012696830107
- Branch / Tag: refs/tags/v0.0.7
- Owner: https://github.com/JPEWdev
- Access: public
Publication detail:
- Token Issuer: https://token.actions.githubusercontent.com
- Runner Environment: github-hosted
- Publication workflow: publish.yaml@1a167d0ff50b38c55aed9e802c02012696830107
- Trigger Event: release