aboutcode-org / aboutcode-org/scancode-toolkit
Scan detects Apache-1.1 instead of/in addition to Apache-2.0 in notice files by Apache foundation.
- Lenguaje dominante
- Python
- Estrellas
- 2.6k
- Forks
- 791
- Merge medio
- 1 d 12 h
- PR fusionados (30 d)
- 5
Descripción
### Description
When scanning projects from the Apache foundation, such as log4j-core, ScanCode mistakenly detects Apache-1.1 license, in addition to the actually used Apache-2.0. The mistaken detection happens on the "notice" files that refer to the copyright holder and/or the license.
A scan with the default options `-clpeui -n 2 --json-pp ` from the "Getting Started" section of the documentation.
### How To Reproduce
1. Download the source code for [log4j-core](https://github.com/apache/logging-log4j2/tree/master/log4j-core) (or the full log4j, or any other apache foundation project)
2. Run ScanCode Toolkit with the default options from the Getting Started Section: `scancode -clpeui -n 2 --json-pp log4j-core.json logging-log4j2-master/log4j-core`
3. The ["notice" file](https://github.com/apache/logging-log4j2/blob/master/log4j-core/src/main/resources/META-INF/NOTICE) will report both Apache-2.0 and Apache-1.1, see [log4j-core-result.zip](https://github.com/nexB/scancode-toolkit/files/5304822/log4j-core-result.zip)
### System configuration
* What OS are you running on? (Windows/MacOS/Linux): Reproduces in Windows and Ubuntu 20.04, as well as on alpine-based docker images.
* What version of scancode-toolkit was used to generate the scan file? [3.1.1](https://github.com/nexB/scancode-toolkit/releases/tag/v3.1.1)
* What installation method was used to install/run scancode? Tested three approaches: pip, source code download, docker image
Guía de contribución
Evaluación
Este issue todavía no se ha evaluado.