aboutcode-org / aboutcode-org/scancode-toolkit

Disambiguate closely related and versioned licenses

未關閉
#2,399 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
license scan new feature
主要語言
Python
星號
2.6k
分支
791
平均合併
1 天 12 小時
30 天內合併 PR
5

描述

#### Problem

There is a class of license notice that is problematic, for instance short GPL notices such as this one (which is not a real one but made up for illustration):

> we prefer to use the GPL
> therefore this is licensed under the GPL 2.0

The scan yields these licenses (scan has been edited for brevity):
```JSON
"licenses": [
{
"key": "gpl-1.0-plus",
"score": 85.0,
"start_line": 1,
"end_line": 1,
"matched_text": "the gpl"
},
{
"key": "gpl-3.0-plus",
"score": 4.0,
"start_line": 2,
"end_line": 2,
"matched_text": "therefore [this] is licensed under [the] gpl"
},
{
"key": "gpl-2.0",
"score": 100.0,
"start_line": 2,
"end_line": 2,
"matched_text": "licensed under the gpl 2."
}
],
```

This is obviously both more or less correct and superbly wrong. The right answer
should be GPL-2.0 and nothing else.
The licenses involved with this class of ambiguous detections are:
- mostly the A/L/GPL with and without versions
- to a lesser extent, other GFDL license

#### Solution elements

While I would hate to have code that is specific to the A/L/GPL licenses these are likely two few licenses and too common not to treat these specially, though there may be some ways to address this in some data-driven way:

1. using the upcoming https://github.com/nexB/scancode-results-analyzer/ should be helpful and is generic for a start
2. today there is no explicit relationship stored in the data between a) the versions of a license (GPL 1,2,3 and or-later variants b) closely related licenses such as the A/L/GPL or closely related BSD variants or MITs. Tracking this explicitly as extra attributes in the License record could then enable data-driven refined disambiguation and merging

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。