aboutcode-org / aboutcode-org/scancode-toolkit

Incorrect lgpl-3.0 detection

Ouverte
#2,063 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
bug improve-license-detection license scan
Langage dominant
Python
Étoiles
2.6k
Forks
791
Merge moyen
1 j 12 h
PR mergées (30 j)
5

Description

```
Format: http://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
Upstream-Name: AppStream
Upstream-Contact: Matthias Klumpp
Source: http://www.freedesktop.org/wiki/Distributions/AppStream/

Files: *
Copyright: Matthias Klumpp
License: GPL-2+ and LGPL-2.1+

License: GPL-2+
This package is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
.
This package is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
.
You should have received a copy of the GNU General Public License
along with this program. If not, see
.
On Debian systems, the complete text of the GNU General
Public License version 2 can be found in "/usr/share/common-licenses/GPL-2".

License: LGPL-2.1+
This library is free software: you can redistribute it and/or modify
it under the terms of the GNU Lesser General Public License as published by
the Free Software Foundation, either version 2.1 of the License, or
(at your option) any later version.
.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Lesser General Public License for more details.
.
You should have received a copy of the GNU Lesser General Public License
along with this library. If not, see .
.
On Debian systems, the complete text of the GNU Lesser General
Public License version 2.1 can be found in "/usr/share/common-licenses/LGPL-2.1".

Files: ./src/appstream.h
./src/as-cache-builder.c
./src/as-cache-builder.h
./src/as-category.c
./src/as-category.h
./src/as-component-private.h
./src/as-component.c
./src/as-component.h
./src/as-data-pool.c
./src/as-data-pool.h
./src/as-database.c
./src/as-database.h
./src/as-distro-details.c
./src/as-distro-details.h
./src/as-enums.c
./src/as-enums.h
./src/as-icon.c
./src/as-icon.h
./src/as-image.c
./src/as-image.h
./src/as-menu-parser.c
./src/as-menu-parser.h
./src/as-metadata.c
./src/as-metadata.h
./src/as-provided.c
./src/as-provided.h
./src/as-release.c
./src/as-release.h
./src/as-screenshot.c
./src/as-screenshot.h
./src/as-settings-private.h
./src/as-utils-private.h
./src/as-utils.h
./src/as-validator-issue.c
./src/as-validator.c
./src/as-validator.h
./src/as-xmldata.c
./src/as-xmldata.h
./src/as-yamldata.c
./src/as-yamldata.h
./src/xapian/database-schema.hpp
./src/xapian/database-cwrap.hpp
./src/xapian/database-read.hpp
./src/xapian/database-write.cpp
./src/xapian/database-write.hpp
Copyright: 2012-2016, Matthias Klumpp
License: LGPL-2.1+

Files: ./qt/component.cpp
./qt/component.h
./qt/database.h
./qt/image.cpp
./qt/image.h
./qt/provides.cpp
./qt/provides.h
./qt/screenshot.cpp
./qt/screenshot.h
Copyright: 2014, Sune Vuorela
2016, Matthias Klumpp
License: LGPL-2.1+

Files: ./tools/*
Copyright: 2012-2016, Matthias Klumpp
License: GPL-2+

Files: ./src/xapian/database-read.cpp
Copyright: 2009, Michael Vogt
2012-2014, Matthias Klumpp
License: LGPL-2.1+

Files: ./qt/database.cpp
Copyright: 2012-2016, Matthias Klumpp
2014, Sune Vuorela
License: LGPL-2.1+
```
For the above licese notice, lgpl-3.0-plus is detected with a high score
```
{
"key": "lgpl-3.0-plus",
"score": 91.18,
"name": "GNU Lesser General Public License 3.0 or later",
"short_name": "LGPL 3.0 or later",
"category": "Copyleft Limited",
"is_exception": false,
"owner": "Free Software Foundation (FSF)",
"homepage_url": "http://www.gnu.org/licenses/lgpl-3.0-standalone.html",
"text_url": "http://www.gnu.org/licenses/lgpl-3.0-standalone.html",
"reference_url": "https://enterprise.dejacode.com/urn/urn:dje:license:lgpl-3.0-plus",
"spdx_license_key": "LGPL-3.0-or-later",
"spdx_url": "https://spdx.org/licenses/LGPL-3.0-or-later",
"start_line": 27,
"end_line": 42,
"matched_rule": {
"identifier": "lgpl-3.0-plus_96.RULE",
"license_expression": "lgpl-3.0-plus",
"licenses": [
"lgpl-3.0-plus"
],
"is_license_text": false,
"is_license_notice": true,
"is_license_reference": false,
"is_license_tag": false,
"matcher": "3-seq",
"rule_length": 136,
"matched_length": 124,
"match_coverage": 91.18,
"rule_relevance": 100.0
}
},
```
However, if I extract and only scan the text string from the start/end line
```
License: LGPL-2.1+
This library is free software: you can redistribute it and/or modify
it under the terms of the GNU Lesser General Public License as published by
the Free Software Foundation, either version 2.1 of the License, or
(at your option) any later version.
.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Lesser General Public License for more details.
.
You should have received a copy of the GNU Lesser General Public License
along with this library. If not, see .
.
On Debian systems, the complete text of the GNU Lesser General
Public License version 2.1 can be found in "/usr/share/common-licenses/LGPL-2.1".
```
only the `lgpl-2.1` is detected and no `lgpl-3.0` is detected.

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.