Zephyr SPDX does not pass validation

[JarmouniA]

Discussed in #89371

^{Originally posted by im-sampm May 1, 2025}
Hello! I wanted to bring it to the team's attention that the current Zephyr SPDX file does not pass validation.

To recreate this bug, download the zephyr-v4.1.0.spdx file here: link

And upload it to the SPDX validator here: link (using the File Type "V2 Tag/Value").

Which returns the following error:

My team was able to narrow the issue down to this line in the SPDX:

This line is generated from the following file:

zephyr/tests/drivers/virtualization/ivshmem/plain/boards/qemu_kvm_arm64.overlay

Line 5 in 5615e46

* SPDX-License-Identifier: Apache-2.0 and UNLICENSED

According to the SPDX v2 Spec, UNLICENSED is an invalid entry because it is not part of the SPDX License List and if it is a custom license, it should be prefixed with LicenseRef-.

This is also the only file which includes the UNLICENSED entry: link

To fix this issue, the license should either be removed or updated IN qemu_kvm_arm64.overlay to match the SPDX spec. Until then, every SPDX file generated by the Zephyr project will be out of spec.

Here is the git blame for the line:

@mikeg-infomagnus @sivakinfomagnus