aboutcode-org / aboutcode-org/scancode-toolkit

GPL-2.0-only detection rather than Apache-2.0

Abierto
#2,294 8 comentarios 1 reacción 0 asignados Ver en GitHub
bug
Lenguaje dominante
Python
Estrellas
2.6k
Forks
791
Merge medio
1 d 12 h
PR fusionados (30 d)
5

Descripción

### Description

I use ORT that uses ScanCode v3.2.1rc2.
I scan a project that has a transitive dependency on Maven:org.wildfly.common:wildfly-common:1.5.2.Final.

The result of the scan show a wrong GPL-2.0-only detection in the pom.xml of wildfly-common.

Here is a extract of the report:
```
"id" : "Maven:org.wildfly.common:wildfly-common:1.5.2.Final",
"results" : [ {
"provenance" : {
"download_time" : "2020-10-02T09:56:16.468892Z",
"source_artifact" : {
"url" : "https://repo.maven.apache.org/maven2/org/wildfly/common/wildfly-common/1.5.2.Final/wildfly-common-1.5.2.Final-sources.jar",
"hash" : {
"value" : "de915776b7676d4de7b7545bdc707540ded940a1",
"algorithm" : "SHA-1"
}
}
},
"scanner" : {
"name" : "ScanCode",
"version" : "3.2.1-rc2",
"configuration" : "--copyright --license --ignore *.ort.yml --info --strip-root --timeout 300 --ignore HERE_NOTICE --ignore META-INF/DEPENDENCIES --ignore **/test/** --ignore **/tests/** --ignore **/__tests__/** --ignore **/qunit/** --ignore spring-boot-tests/** --ignore doc/** --ignore docs/** --ignore documentation/** --ignore documentations/** --ignore demo/** --ignore **/example/** --ignore **/examples/** --ignore **/sample/** --ignore **/samples/** --ignore changelog.txt --json-pp"
},
"summary" : {
"start_time" : "2020-10-02T09:56:16.538742Z",
"end_time" : "2020-10-02T09:56:57.405241Z",
"file_count" : 154,
"package_verification_code" : "962abf96dc560bcfae89d1d17ee419ffc048a478",
"licenses" : [ {
"license" : "Apache-2.0",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 7,
"end_line" : 17
}
}, {
"license" : "Apache-2.0",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 38,
"end_line" : 38
}
}, {
"license" : "Apache-2.0",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 39,
"end_line" : 39
}
},
[... others files]
}, {
"license" : "GPL-2.0-only",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 36,
"end_line" : 42
}
} ],
"copyrights" : [ {
"statement" : "Copyright (c) 2019 JBoss",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 121,
"end_line" : 121
}
}, {
```

I had done another scan with an older version of ORT with ScanCode 3.0.2, and there was no GPL-2.0-Only detected in the POM

### How To Reproduce

> Tell us how to reproduce the issue.
With ScanCode in version : "3.2.1-rc2",
With the configuration : "--copyright --license --ignore *.ort.yml --info --strip-root --timeout 300 --ignore HERE_NOTICE --ignore META-INF/DEPENDENCIES --ignore **/test/** --ignore **/tests/** --ignore **/__tests__/** --ignore **/qunit/** --ignore spring-boot-tests/** --ignore doc/** --ignore docs/** --ignore documentation/** --ignore documentations/** --ignore demo/** --ignore **/example/** --ignore **/examples/** --ignore **/sample/** --ignore **/samples/** --ignore changelog.txt --json-pp"

Do a scan on a project that has a dependency on Maven:org.wildfly.common:wildfly-common:1.5.2.Final

### System configuration

> For bug reports, it really helps us to know:

* What OS are you running on? (Windows/MacOS/Linux) : Linux (Docker)
* What version of scancode-toolkit was used to generate the scan file? : 3.2.1-rc2
* What installation method was used to install/run scancode? (pip/source download/other) : With ORT Docker Image

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.