aboutcode-org / aboutcode-org/scancode-toolkit

Disambiguate closely related and versioned licenses

未关闭
#2,399 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
license scan new feature
主要语言
Python
星标
2.6k
派生
791
平均合并
1 天 12 小时
30 天内合并 PR
5

描述

#### Problem

There is a class of license notice that is problematic, for instance short GPL notices such as this one (which is not a real one but made up for illustration):

> we prefer to use the GPL
> therefore this is licensed under the GPL 2.0

The scan yields these licenses (scan has been edited for brevity):
```JSON
"licenses": [
{
"key": "gpl-1.0-plus",
"score": 85.0,
"start_line": 1,
"end_line": 1,
"matched_text": "the gpl"
},
{
"key": "gpl-3.0-plus",
"score": 4.0,
"start_line": 2,
"end_line": 2,
"matched_text": "therefore [this] is licensed under [the] gpl"
},
{
"key": "gpl-2.0",
"score": 100.0,
"start_line": 2,
"end_line": 2,
"matched_text": "licensed under the gpl 2."
}
],
```

This is obviously both more or less correct and superbly wrong. The right answer
should be GPL-2.0 and nothing else.
The licenses involved with this class of ambiguous detections are:
- mostly the A/L/GPL with and without versions
- to a lesser extent, other GFDL license

#### Solution elements

While I would hate to have code that is specific to the A/L/GPL licenses these are likely two few licenses and too common not to treat these specially, though there may be some ways to address this in some data-driven way:

1. using the upcoming https://github.com/nexB/scancode-results-analyzer/ should be helpful and is generic for a start
2. today there is no explicit relationship stored in the data between a) the versions of a license (GPL 1,2,3 and or-later variants b) closely related licenses such as the A/L/GPL or closely related BSD variants or MITs. Tracking this explicitly as extra attributes in the License record could then enable data-driven refined disambiguation and merging

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。