aboutcode-org / aboutcode-org/scancode-toolkit

GPL-2.0-only detection rather than Apache-2.0

オープン
#2,294 コメント 8 件 リアクション 1 件 担当者 0 名 GitHub で見る
bug
主要言語
Python
スター
2.6k
フォーク
791
平均マージ
1日 12時間
マージ済み PR(30日)
5

説明

### Description

I use ORT that uses ScanCode v3.2.1rc2.
I scan a project that has a transitive dependency on Maven:org.wildfly.common:wildfly-common:1.5.2.Final.

The result of the scan show a wrong GPL-2.0-only detection in the pom.xml of wildfly-common.

Here is a extract of the report:
```
"id" : "Maven:org.wildfly.common:wildfly-common:1.5.2.Final",
"results" : [ {
"provenance" : {
"download_time" : "2020-10-02T09:56:16.468892Z",
"source_artifact" : {
"url" : "https://repo.maven.apache.org/maven2/org/wildfly/common/wildfly-common/1.5.2.Final/wildfly-common-1.5.2.Final-sources.jar",
"hash" : {
"value" : "de915776b7676d4de7b7545bdc707540ded940a1",
"algorithm" : "SHA-1"
}
}
},
"scanner" : {
"name" : "ScanCode",
"version" : "3.2.1-rc2",
"configuration" : "--copyright --license --ignore *.ort.yml --info --strip-root --timeout 300 --ignore HERE_NOTICE --ignore META-INF/DEPENDENCIES --ignore **/test/** --ignore **/tests/** --ignore **/__tests__/** --ignore **/qunit/** --ignore spring-boot-tests/** --ignore doc/** --ignore docs/** --ignore documentation/** --ignore documentations/** --ignore demo/** --ignore **/example/** --ignore **/examples/** --ignore **/sample/** --ignore **/samples/** --ignore changelog.txt --json-pp"
},
"summary" : {
"start_time" : "2020-10-02T09:56:16.538742Z",
"end_time" : "2020-10-02T09:56:57.405241Z",
"file_count" : 154,
"package_verification_code" : "962abf96dc560bcfae89d1d17ee419ffc048a478",
"licenses" : [ {
"license" : "Apache-2.0",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 7,
"end_line" : 17
}
}, {
"license" : "Apache-2.0",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 38,
"end_line" : 38
}
}, {
"license" : "Apache-2.0",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 39,
"end_line" : 39
}
},
[... others files]
}, {
"license" : "GPL-2.0-only",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 36,
"end_line" : 42
}
} ],
"copyrights" : [ {
"statement" : "Copyright (c) 2019 JBoss",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 121,
"end_line" : 121
}
}, {
```

I had done another scan with an older version of ORT with ScanCode 3.0.2, and there was no GPL-2.0-Only detected in the POM

### How To Reproduce

> Tell us how to reproduce the issue.
With ScanCode in version : "3.2.1-rc2",
With the configuration : "--copyright --license --ignore *.ort.yml --info --strip-root --timeout 300 --ignore HERE_NOTICE --ignore META-INF/DEPENDENCIES --ignore **/test/** --ignore **/tests/** --ignore **/__tests__/** --ignore **/qunit/** --ignore spring-boot-tests/** --ignore doc/** --ignore docs/** --ignore documentation/** --ignore documentations/** --ignore demo/** --ignore **/example/** --ignore **/examples/** --ignore **/sample/** --ignore **/samples/** --ignore changelog.txt --json-pp"

Do a scan on a project that has a dependency on Maven:org.wildfly.common:wildfly-common:1.5.2.Final

### System configuration

> For bug reports, it really helps us to know:

* What OS are you running on? (Windows/MacOS/Linux) : Linux (Docker)
* What version of scancode-toolkit was used to generate the scan file? : 3.2.1-rc2
* What installation method was used to install/run scancode? (pip/source download/other) : With ORT Docker Image

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。