aboutcode-org / aboutcode-org/scancode-toolkit

Scan detects Apache-1.1 instead of/in addition to Apache-2.0 in notice files by Apache foundation.

Ouverte
#2,266 4 commentaires 1 réaction 0 personnes assignées Voir sur GitHub
bug license scan
Langage dominant
Python
Étoiles
2.6k
Forks
791
Merge moyen
1 j 12 h
PR mergées (30 j)
5

Description

### Description

When scanning projects from the Apache foundation, such as log4j-core, ScanCode mistakenly detects Apache-1.1 license, in addition to the actually used Apache-2.0. The mistaken detection happens on the "notice" files that refer to the copyright holder and/or the license.

A scan with the default options `-clpeui -n 2 --json-pp ` from the "Getting Started" section of the documentation.

### How To Reproduce

1. Download the source code for [log4j-core](https://github.com/apache/logging-log4j2/tree/master/log4j-core) (or the full log4j, or any other apache foundation project)
2. Run ScanCode Toolkit with the default options from the Getting Started Section: `scancode -clpeui -n 2 --json-pp log4j-core.json logging-log4j2-master/log4j-core`
3. The ["notice" file](https://github.com/apache/logging-log4j2/blob/master/log4j-core/src/main/resources/META-INF/NOTICE) will report both Apache-2.0 and Apache-1.1, see [log4j-core-result.zip](https://github.com/nexB/scancode-toolkit/files/5304822/log4j-core-result.zip)

### System configuration

* What OS are you running on? (Windows/MacOS/Linux): Reproduces in Windows and Ubuntu 20.04, as well as on alpine-based docker images.
* What version of scancode-toolkit was used to generate the scan file? [3.1.1](https://github.com/nexB/scancode-toolkit/releases/tag/v3.1.1)
* What installation method was used to install/run scancode? Tested three approaches: pip, source code download, docker image

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.