Reject duplicate extracted-license identifiers

src/spdx_tools/spdx/validation/extracted_licensing_info_validator.py

@@ -15,8 +15,20 @@ def validate_extracted_licensing_infos(
     extracted_licensing_infos: Optional[List[ExtractedLicensingInfo]],
 ) -> List[ValidationMessage]:
     validation_messages = []
+    seen_license_ids = set()
     for extracted_licensing_info in extracted_licensing_infos:
         validation_messages.extend(validate_extracted_licensing_info(extracted_licensing_info))
+        license_id = extracted_licensing_info.license_id
+        if license_id and license_id in seen_license_ids:
+            validation_messages.append(
+                ValidationMessage(
+                    f"license_id must be unique within the document, but is repeated: {license_id}",
+                    ValidationContext(
+                        element_type=SpdxElementType.EXTRACTED_LICENSING_INFO, full_element=extracted_licensing_info
+                    ),
+                )
+            )
+        seen_license_ids.add(license_id)
 
     return validation_messages
 

tests/spdx/validation/test_document_validator.py

@@ -11,7 +11,14 @@
 from spdx_tools.spdx.parser.parse_anything import parse_file
 from spdx_tools.spdx.validation.document_validator import validate_full_spdx_document
 from spdx_tools.spdx.validation.validation_message import SpdxElementType, ValidationContext, ValidationMessage
-from tests.spdx.fixtures import creation_info_fixture, document_fixture, file_fixture, package_fixture, snippet_fixture
+from tests.spdx.fixtures import (
+    creation_info_fixture,
+    document_fixture,
+    extracted_licensing_info_fixture,
+    file_fixture,
+    package_fixture,
+    snippet_fixture,
+)
 
 
 def test_valid_document():
@@ -21,6 +28,34 @@ def test_valid_document():
     assert validation_messages == []
 
 
+@pytest.mark.parametrize(
+    "license_id, expected_message",
+    [
+        ("LicenseRef-1", "license_id must be unique within the document, but is repeated: LicenseRef-1"),
+        ("LicenseRef-2", None),
+    ],
+)
+def test_document_extracted_licensing_info_unique_ids(license_id, expected_message):
+    extracted_licensing_info = extracted_licensing_info_fixture(license_id=license_id, extracted_text="different text")
+    document = document_fixture(
+        extracted_licensing_info=[extracted_licensing_info_fixture(), extracted_licensing_info]
+    )
+    validation_messages = validate_full_spdx_document(document)
+
+    expected = []
+    if expected_message:
+        expected.append(
+            ValidationMessage(
+                expected_message,
+                ValidationContext(
+                    element_type=SpdxElementType.EXTRACTED_LICENSING_INFO, full_element=extracted_licensing_info
+                ),
+            )
+        )
+
+    assert validation_messages == expected
+
+
 def test_spdx_lite_validation():
     document = parse_file(os.path.join(os.path.dirname(__file__), "../data/SPDXLite.spdx"))
 

tests/spdx/validation/test_extracted_licensing_info_validator.py

@@ -6,7 +6,10 @@
 
 import pytest
 
-from spdx_tools.spdx.validation.extracted_licensing_info_validator import validate_extracted_licensing_info
+from spdx_tools.spdx.validation.extracted_licensing_info_validator import (
+    validate_extracted_licensing_info,
+    validate_extracted_licensing_infos,
+)
 from spdx_tools.spdx.validation.validation_message import SpdxElementType, ValidationContext, ValidationMessage
 from tests.spdx.fixtures import extracted_licensing_info_fixture
 
@@ -18,6 +21,33 @@ def test_valid_extracted_licensing_info():
     assert validation_messages == []
 
 
+@pytest.mark.parametrize(
+    "license_id, expected_message",
+    [
+        ("LicenseRef-1", "license_id must be unique within the document, but is repeated: LicenseRef-1"),
+        ("LicenseRef-2", None),
+    ],
+)
+def test_extracted_licensing_infos_unique_ids(license_id, expected_message):
+    extracted_licensing_info = extracted_licensing_info_fixture(license_id=license_id, extracted_text="different text")
+    validation_messages = validate_extracted_licensing_infos(
+        [extracted_licensing_info_fixture(), extracted_licensing_info]
+    )
+
+    expected = []
+    if expected_message:
+        expected.append(
+            ValidationMessage(
+                expected_message,
+                ValidationContext(
+                    element_type=SpdxElementType.EXTRACTED_LICENSING_INFO, full_element=extracted_licensing_info
+                ),
+            )
+        )
+
+    assert validation_messages == expected
+
+
 # TODO: tests for licenses not on the SPDX License list (i.e. they must provide id, name and cross-references)
 @pytest.mark.parametrize(
     "extracted_licensing_info, expected_message",