Consider using the spdx-lookup package instead of the committed spdx_licenselist.csv file.

CSV is not great indeed. There is one issue though: package namespaces. Per https://github.com/bbqsrc/spdx-lookup-python/blob/4f5c2f540525421025e498289f9e84721683d7f9/spdx_lookup/__init__.py#L8 spdx_lookup from @bbqsrc depends on https://github.com/bbqsrc/spdx-python from the same author that provides the license lists proper but also uses the same spdx package namespace that this tool here is using.

As such this could not be re-used as is unless we do on of these:

1. we vendor spdx-python
2. we rename the packages used here or there to distinct names
3. we adopt a shared package namespace strategy
4. we merge together

This is an issue I raised here bbqsrc/spdx-python#1

You can have the entire spdx.* namespace as long as the current interface of the spdx module can continue to exist, and the spdx package stays a minimal database package as it already is so it can be consumed by other projects.

If that works, then I'm open to any other suggestions. 😄

(I note my preferred option is still as I said in the other issue: name it spdx_tools and just depend on the already existing module.)