wary onyx
fyi, to anyone who comes along...
tl;dr - dual licensed Apache-2 / GPL-2 at your choice
$ go mod graph | grep github.com/spdx/tools-golang
github.com/dagger/dagger@v0.19.11 github.com/spdx/tools-golang@v0.5.5
https://github.com/dagger/dagger/blob/7c83409eee972e0e5eacb71427f3553158d33dfa/go.mod#L141
https://github.com/search?q=repo%3Adagger%2Fdagger github.com%2Fspdx%2Ftools-golang&type=code