aboutcode-org / aboutcode-org/scancode-toolkit

GPL-2.0-only detection rather than Apache-2.0

未關閉
#2,294 8 則留言 1 個 reaction 已指派 0 人 在 GitHub 檢視
bug
主要語言
Python
星號
2.6k
分支
791
平均合併
1 天 12 小時
30 天內合併 PR
5

描述

### Description

I use ORT that uses ScanCode v3.2.1rc2.
I scan a project that has a transitive dependency on Maven:org.wildfly.common:wildfly-common:1.5.2.Final.

The result of the scan show a wrong GPL-2.0-only detection in the pom.xml of wildfly-common.

Here is a extract of the report:
```
"id" : "Maven:org.wildfly.common:wildfly-common:1.5.2.Final",
"results" : [ {
"provenance" : {
"download_time" : "2020-10-02T09:56:16.468892Z",
"source_artifact" : {
"url" : "https://repo.maven.apache.org/maven2/org/wildfly/common/wildfly-common/1.5.2.Final/wildfly-common-1.5.2.Final-sources.jar",
"hash" : {
"value" : "de915776b7676d4de7b7545bdc707540ded940a1",
"algorithm" : "SHA-1"
}
}
},
"scanner" : {
"name" : "ScanCode",
"version" : "3.2.1-rc2",
"configuration" : "--copyright --license --ignore *.ort.yml --info --strip-root --timeout 300 --ignore HERE_NOTICE --ignore META-INF/DEPENDENCIES --ignore **/test/** --ignore **/tests/** --ignore **/__tests__/** --ignore **/qunit/** --ignore spring-boot-tests/** --ignore doc/** --ignore docs/** --ignore documentation/** --ignore documentations/** --ignore demo/** --ignore **/example/** --ignore **/examples/** --ignore **/sample/** --ignore **/samples/** --ignore changelog.txt --json-pp"
},
"summary" : {
"start_time" : "2020-10-02T09:56:16.538742Z",
"end_time" : "2020-10-02T09:56:57.405241Z",
"file_count" : 154,
"package_verification_code" : "962abf96dc560bcfae89d1d17ee419ffc048a478",
"licenses" : [ {
"license" : "Apache-2.0",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 7,
"end_line" : 17
}
}, {
"license" : "Apache-2.0",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 38,
"end_line" : 38
}
}, {
"license" : "Apache-2.0",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 39,
"end_line" : 39
}
},
[... others files]
}, {
"license" : "GPL-2.0-only",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 36,
"end_line" : 42
}
} ],
"copyrights" : [ {
"statement" : "Copyright (c) 2019 JBoss",
"location" : {
"path" : "META-INF/maven/org.wildfly.common/wildfly-common/pom.xml",
"start_line" : 121,
"end_line" : 121
}
}, {
```

I had done another scan with an older version of ORT with ScanCode 3.0.2, and there was no GPL-2.0-Only detected in the POM

### How To Reproduce

> Tell us how to reproduce the issue.
With ScanCode in version : "3.2.1-rc2",
With the configuration : "--copyright --license --ignore *.ort.yml --info --strip-root --timeout 300 --ignore HERE_NOTICE --ignore META-INF/DEPENDENCIES --ignore **/test/** --ignore **/tests/** --ignore **/__tests__/** --ignore **/qunit/** --ignore spring-boot-tests/** --ignore doc/** --ignore docs/** --ignore documentation/** --ignore documentations/** --ignore demo/** --ignore **/example/** --ignore **/examples/** --ignore **/sample/** --ignore **/samples/** --ignore changelog.txt --json-pp"

Do a scan on a project that has a dependency on Maven:org.wildfly.common:wildfly-common:1.5.2.Final

### System configuration

> For bug reports, it really helps us to know:

* What OS are you running on? (Windows/MacOS/Linux) : Linux (Docker)
* What version of scancode-toolkit was used to generate the scan file? : 3.2.1-rc2
* What installation method was used to install/run scancode? (pip/source download/other) : With ORT Docker Image

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。