aboutcode-org / aboutcode-org/scancode-toolkit

Scan detects Apache-1.1 instead of/in addition to Apache-2.0 in notice files by Apache foundation.

Abierto
#2,266 4 comentarios 1 reacción 0 asignados Ver en GitHub
bug license scan
Lenguaje dominante
Python
Estrellas
2.6k
Forks
791
Merge medio
1 d 12 h
PR fusionados (30 d)
5

Descripción

### Description

When scanning projects from the Apache foundation, such as log4j-core, ScanCode mistakenly detects Apache-1.1 license, in addition to the actually used Apache-2.0. The mistaken detection happens on the "notice" files that refer to the copyright holder and/or the license.

A scan with the default options `-clpeui -n 2 --json-pp ` from the "Getting Started" section of the documentation.

### How To Reproduce

1. Download the source code for [log4j-core](https://github.com/apache/logging-log4j2/tree/master/log4j-core) (or the full log4j, or any other apache foundation project)
2. Run ScanCode Toolkit with the default options from the Getting Started Section: `scancode -clpeui -n 2 --json-pp log4j-core.json logging-log4j2-master/log4j-core`
3. The ["notice" file](https://github.com/apache/logging-log4j2/blob/master/log4j-core/src/main/resources/META-INF/NOTICE) will report both Apache-2.0 and Apache-1.1, see [log4j-core-result.zip](https://github.com/nexB/scancode-toolkit/files/5304822/log4j-core-result.zip)

### System configuration

* What OS are you running on? (Windows/MacOS/Linux): Reproduces in Windows and Ubuntu 20.04, as well as on alpine-based docker images.
* What version of scancode-toolkit was used to generate the scan file? [3.1.1](https://github.com/nexB/scancode-toolkit/releases/tag/v3.1.1)
* What installation method was used to install/run scancode? Tested three approaches: pip, source code download, docker image

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.