aboutcode-org / aboutcode-org/scancode-toolkit

Apparent MIT license gets discovered as Apache-2.0

Offen
#2,635 9 Kommentare 1 Reaktion 0 zugewiesene Personen Auf GitHub ansehen
bug license scan
Vorherrschende Sprache
Python
Sterne
2.6k
Forks
791
Ø Merge
1 T. 12 Std.
Gemergte PRs (30 T.)
5

Beschreibung

I'm trying to understand what I believe is buggy behavior which manifests itself on a specific version of a README file, but not on another, seemingly similar, version of it.

### Description

When scanning https://github.com/tiangolo/fastapi/blob/0.54.2/README.md, which contains the closing paragraph (it is obviously MIT-licensed)

```
## License

This project is licensed under the terms of the MIT license.
```

`scancode` produces the following result:

```
{
"headers": [
{
"tool_name": "scancode-toolkit",
"tool_version": "21.8.4",
"options": {
"input": [
"README.md"
],
"--json-pp": "scan.json",
"--license": true,
"--license-text": true,
"--license-text-diagnostics": true
},
"notice": "Generated with ScanCode and provided on an \"AS IS\" BASIS, WITHOUT WARRANTIES\nOR CONDITIONS OF ANY KIND, either express or implied. No content created from\nScanCode should be considered or used as legal advice. Consult an Attorney\nfor any legal advice.\nScanCode is a free software code scanning tool from nexB Inc. and others.\nVisit https://github.com/nexB/scancode-toolkit/ for support and download.",
"start_timestamp": "2021-08-12T135230.822744",
"end_timestamp": "2021-08-12T135232.675789",
"duration": 1.8530659675598145,
"message": null,
"errors": [],
"extra_data": {
"files_count": 1
}
}
],
"files": [
{
"path": "README.md",
"type": "file",
"licenses": [
{
"key": "apache-2.0",
"score": 68.75,
"name": "Apache License 2.0",
"short_name": "Apache 2.0",
"category": "Permissive",
"is_exception": false,
"owner": "Apache Software Foundation",
"homepage_url": "http://www.apache.org/licenses/",
"text_url": "http://www.apache.org/licenses/LICENSE-2.0",
"reference_url": "https://scancode-licensedb.aboutcode.org/apache-2.0",
"scancode_text_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/licenses/apache-2.0.LICENSE",
"scancode_data_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/licenses/apache-2.0.yml",
"spdx_license_key": "Apache-2.0",
"spdx_url": "https://spdx.org/licenses/Apache-2.0",
"start_line": 435,
"end_line": 437,
"matched_rule": {
"identifier": "apache-2.0_328.RULE",
"license_expression": "apache-2.0",
"licenses": [
"apache-2.0"
],
"is_license_text": false,
"is_license_notice": true,
"is_license_reference": false,
"is_license_tag": false,
"is_license_intro": false,
"matcher": "3-seq",
"rule_length": 16,
"matched_length": 11,
"match_coverage": 68.75,
"rule_relevance": 100
},
"matched_text": "License\n\nThis project is licensed under the terms of the [MIT] license."
}
],
"license_expressions": [
"apache-2.0"
],
"percentage_of_license_text": 0.45,
"scan_errors": []
}
]
}
```

That is, it is reported as Apache-2.0 even though there is an MIT rule that matches perfectly (`mit_349.RULE`). In fact, the other rule isn't even mentioned as a potential match.

Notable is that if I instead scan a different version of the file (https://github.com/tiangolo/fastapi/blob/0.51.0/README.md), which appears quite similar (only "marginally different" from my perspective), the resulting `scan.json` correctly reports the MIT rule as a match.

### How To Reproduce

This is reported as Apache-2.0:
```
curl https://raw.githubusercontent.com/tiangolo/fastapi/0.54.2/README.md -o readme.md
scancode --json-pp scan.json -l --license-text --license-text-diagnostics readme.md
```

This is reported as MIT:
```
curl https://raw.githubusercontent.com/tiangolo/fastapi/0.51.0/README.md -o readme.md
scancode --json-pp scan.json -l --license-text --license-text-diagnostics readme.md
```

Although the README files are seemingly similar _something_ in the difference between those two files appears to confuse `scancode`.

### System configuration

> For bug reports, it really helps us to know:

* What OS are you running on? Linux
* What version of scancode-toolkit was used to generate the scan file? `21.8.4`
* What installation method was used to install/run scancode? build from source

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.