aboutcode-org / aboutcode-org/scancode-toolkit

GPL-2.0-only detection rather than Apache-2.0

Đang mở
#2,294 8 bình luận 1 reaction 0 người được giao Xem trên GitHub
bug
Ngôn ngữ chính
Python
Star
2.6k
Fork
791
Merge trung bình
1 ngày 12 giờ
Pull request đã merge (30 ngày)
5

Mô tả

### Description

I use ORT that uses ScanCode v3.2.1rc2.
I scan a project that has a transitive dependency on Maven:org.wildfly.common:wildfly-common:1.5.2.Final.

The result of the scan show a wrong GPL-2.0-only detection in the pom.xml of wildfly-common.

Here is a extract of the report:
```
"id" : "Maven:org.wildfly.common:wildfly-common:1.5.2.Final",
"results" : [ {
"provenance" : {
"download_time" : "2020-10-02T09:56:16.468892Z",
"source_artifact" : {
"url" : "https://repo.maven.apache.org/maven2/org/wildfly/common/wildfly-common/1.5.2.Final/wildfly-common-1.5.2.Final-sources.jar",
"hash" : {
"value" : "de915776b7676d4de7b7545bdc707540ded940a1",
"algorithm" : "SHA-1"
}
}
},
"scanner" : {
"name" : "ScanCode",
"version" : "3.2.1-rc2",
"configuration" : "--copyright --license --ignore *.ort.yml --info --strip-root --timeout 300 --ignore HERE_NOTICE --ignore META-INF/DEPENDENCIES --ignore **/test/** --ignore **/tests/** --ignore **/__tests__/** --ignore **/qunit/** --ignore spring-boot-tests/** --ignore doc/** --ignore docs/** --ignore documentation/** --ignore documentations/** --ignore demo/** --ignore **/example/** --ignore **/examples/** --ignore **/sample/** --ignore **/samples/** --ignore changelog.txt --json-pp"
},
"summary" : {
"start_time" : "2020-10-02T09:56:16.538742Z",
"end_time" : "2020-10-02T09:56:57.405241Z",
"file_count" : 154,
"package_verification_code" : "962abf96dc560bcfae89d1d17ee419ffc048a478",
"licenses" : [ {
"license" : "Apache-2.0",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 7,
"end_line" : 17
}
}, {
"license" : "Apache-2.0",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 38,
"end_line" : 38
}
}, {
"license" : "Apache-2.0",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 39,
"end_line" : 39
}
},
[... others files]
}, {
"license" : "GPL-2.0-only",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 36,
"end_line" : 42
}
} ],
"copyrights" : [ {
"statement" : "Copyright (c) 2019 JBoss",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 121,
"end_line" : 121
}
}, {
```

I had done another scan with an older version of ORT with ScanCode 3.0.2, and there was no GPL-2.0-Only detected in the POM

### How To Reproduce

> Tell us how to reproduce the issue.
With ScanCode in version : "3.2.1-rc2",
With the configuration : "--copyright --license --ignore *.ort.yml --info --strip-root --timeout 300 --ignore HERE_NOTICE --ignore META-INF/DEPENDENCIES --ignore **/test/** --ignore **/tests/** --ignore **/__tests__/** --ignore **/qunit/** --ignore spring-boot-tests/** --ignore doc/** --ignore docs/** --ignore documentation/** --ignore documentations/** --ignore demo/** --ignore **/example/** --ignore **/examples/** --ignore **/sample/** --ignore **/samples/** --ignore changelog.txt --json-pp"

Do a scan on a project that has a dependency on Maven:org.wildfly.common:wildfly-common:1.5.2.Final

### System configuration

> For bug reports, it really helps us to know:

* What OS are you running on? (Windows/MacOS/Linux) : Linux (Docker)
* What version of scancode-toolkit was used to generate the scan file? : 3.2.1-rc2
* What installation method was used to install/run scancode? (pip/source download/other) : With ORT Docker Image

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.