aboutcode-org / aboutcode-org/scancode-toolkit
Scan detects Apache-1.1 instead of/in addition to Apache-2.0 in notice files by Apache foundation.
- Vorherrschende Sprache
- Python
- Sterne
- 2.6k
- Forks
- 791
- Ø Merge
- 1 T. 12 Std.
- Gemergte PRs (30 T.)
- 5
Beschreibung
### Description
When scanning projects from the Apache foundation, such as log4j-core, ScanCode mistakenly detects Apache-1.1 license, in addition to the actually used Apache-2.0. The mistaken detection happens on the "notice" files that refer to the copyright holder and/or the license.
A scan with the default options `-clpeui -n 2 --json-pp ` from the "Getting Started" section of the documentation.
### How To Reproduce
1. Download the source code for [log4j-core](https://github.com/apache/logging-log4j2/tree/master/log4j-core) (or the full log4j, or any other apache foundation project)
2. Run ScanCode Toolkit with the default options from the Getting Started Section: `scancode -clpeui -n 2 --json-pp log4j-core.json logging-log4j2-master/log4j-core`
3. The ["notice" file](https://github.com/apache/logging-log4j2/blob/master/log4j-core/src/main/resources/META-INF/NOTICE) will report both Apache-2.0 and Apache-1.1, see [log4j-core-result.zip](https://github.com/nexB/scancode-toolkit/files/5304822/log4j-core-result.zip)
### System configuration
* What OS are you running on? (Windows/MacOS/Linux): Reproduces in Windows and Ubuntu 20.04, as well as on alpine-based docker images.
* What version of scancode-toolkit was used to generate the scan file? [3.1.1](https://github.com/nexB/scancode-toolkit/releases/tag/v3.1.1)
* What installation method was used to install/run scancode? Tested three approaches: pip, source code download, docker image
Beitragsleitfaden
Bewertung
Dieses Issue wurde noch nicht bewertet.