aboutcode-org / aboutcode-org/scancode-toolkit
GPL-2.0-only detection rather than Apache-2.0
- Langage dominant
- Python
- Étoiles
- 2.6k
- Forks
- 791
- Merge moyen
- 1 j 12 h
- PR mergées (30 j)
- 5
Description
### Description
I use ORT that uses ScanCode v3.2.1rc2.
I scan a project that has a transitive dependency on Maven:org.wildfly.common:wildfly-common:1.5.2.Final.
The result of the scan show a wrong GPL-2.0-only detection in the pom.xml of wildfly-common.
Here is a extract of the report:
```
"id" : "Maven:org.wildfly.common:wildfly-common:1.5.2.Final",
"results" : [ {
"provenance" : {
"download_time" : "2020-10-02T09:56:16.468892Z",
"source_artifact" : {
"url" : "https://repo.maven.apache.org/maven2/org/wildfly/common/wildfly-common/1.5.2.Final/wildfly-common-1.5.2.Final-sources.jar",
"hash" : {
"value" : "de915776b7676d4de7b7545bdc707540ded940a1",
"algorithm" : "SHA-1"
}
}
},
"scanner" : {
"name" : "ScanCode",
"version" : "3.2.1-rc2",
"configuration" : "--copyright --license --ignore *.ort.yml --info --strip-root --timeout 300 --ignore HERE_NOTICE --ignore META-INF/DEPENDENCIES --ignore **/test/** --ignore **/tests/** --ignore **/__tests__/** --ignore **/qunit/** --ignore spring-boot-tests/** --ignore doc/** --ignore docs/** --ignore documentation/** --ignore documentations/** --ignore demo/** --ignore **/example/** --ignore **/examples/** --ignore **/sample/** --ignore **/samples/** --ignore changelog.txt --json-pp"
},
"summary" : {
"start_time" : "2020-10-02T09:56:16.538742Z",
"end_time" : "2020-10-02T09:56:57.405241Z",
"file_count" : 154,
"package_verification_code" : "962abf96dc560bcfae89d1d17ee419ffc048a478",
"licenses" : [ {
"license" : "Apache-2.0",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 7,
"end_line" : 17
}
}, {
"license" : "Apache-2.0",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 38,
"end_line" : 38
}
}, {
"license" : "Apache-2.0",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 39,
"end_line" : 39
}
},
[... others files]
}, {
"license" : "GPL-2.0-only",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 36,
"end_line" : 42
}
} ],
"copyrights" : [ {
"statement" : "Copyright (c) 2019 JBoss",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 121,
"end_line" : 121
}
}, {
```
I had done another scan with an older version of ORT with ScanCode 3.0.2, and there was no GPL-2.0-Only detected in the POM
### How To Reproduce
> Tell us how to reproduce the issue.
With ScanCode in version : "3.2.1-rc2",
With the configuration : "--copyright --license --ignore *.ort.yml --info --strip-root --timeout 300 --ignore HERE_NOTICE --ignore META-INF/DEPENDENCIES --ignore **/test/** --ignore **/tests/** --ignore **/__tests__/** --ignore **/qunit/** --ignore spring-boot-tests/** --ignore doc/** --ignore docs/** --ignore documentation/** --ignore documentations/** --ignore demo/** --ignore **/example/** --ignore **/examples/** --ignore **/sample/** --ignore **/samples/** --ignore changelog.txt --json-pp"
Do a scan on a project that has a dependency on Maven:org.wildfly.common:wildfly-common:1.5.2.Final
### System configuration
> For bug reports, it really helps us to know:
* What OS are you running on? (Windows/MacOS/Linux) : Linux (Docker)
* What version of scancode-toolkit was used to generate the scan file? : 3.2.1-rc2
* What installation method was used to install/run scancode? (pip/source download/other) : With ORT Docker Image
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.