aboutcode-org / aboutcode-org/scancode-toolkit

Scan detects Apache-1.1 instead of/in addition to Apache-2.0 in notice files by Apache foundation.

Open
#2,266 4 comments 1 reaction 0 assignees View on GitHub
bug license scan
Dominant language
Python
Stars
2.6k
Forks
791
Avg merge
1d 12h
Merged PRs (30d)
5

Description

### Description

When scanning projects from the Apache foundation, such as log4j-core, ScanCode mistakenly detects Apache-1.1 license, in addition to the actually used Apache-2.0. The mistaken detection happens on the "notice" files that refer to the copyright holder and/or the license.

A scan with the default options `-clpeui -n 2 --json-pp ` from the "Getting Started" section of the documentation.

### How To Reproduce

1. Download the source code for [log4j-core](https://github.com/apache/logging-log4j2/tree/master/log4j-core) (or the full log4j, or any other apache foundation project)
2. Run ScanCode Toolkit with the default options from the Getting Started Section: `scancode -clpeui -n 2 --json-pp log4j-core.json logging-log4j2-master/log4j-core`
3. The ["notice" file](https://github.com/apache/logging-log4j2/blob/master/log4j-core/src/main/resources/META-INF/NOTICE) will report both Apache-2.0 and Apache-1.1, see [log4j-core-result.zip](https://github.com/nexB/scancode-toolkit/files/5304822/log4j-core-result.zip)

### System configuration

* What OS are you running on? (Windows/MacOS/Linux): Reproduces in Windows and Ubuntu 20.04, as well as on alpine-based docker images.
* What version of scancode-toolkit was used to generate the scan file? [3.1.1](https://github.com/nexB/scancode-toolkit/releases/tag/v3.1.1)
* What installation method was used to install/run scancode? Tested three approaches: pip, source code download, docker image

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.