aboutcode-org / aboutcode-org/scancode-toolkit

False-positive `proprietary-license` finding in Guava source code

Abierto
#2,865 10 comentarios 0 reacciones 0 asignados Ver en GitHub
bug license scan
Lenguaje dominante
Python
Estrellas
2.6k
Forks
791
Merge medio
1 d 12 h
PR fusionados (30 d)
5

Descripción

### Description

Scanning https://github.com/google/guava/blob/v31.0.1/guava/src/com/google/common/graph/StandardValueGraph.java#L36 results in a false-positive license finding of `proprietary-license`, although no licenses declaration is present at all. (Thanks to @PatteSI for finding this.)

The matched text just says

changes to the graph (if the graph is mutable) but may not be modified by the user.

I guess the "modified by the user" words are what triggers the finding. However, what's a bit disturbing is that the license score is 100.0 for this match... so ScanCode is ultimatively confident that this is a license match, and we can't get rid of it by adjusting the `--license-score`.

### How To Reproduce

scancode --license --json-pp - StandardValueGraph.java

### System configuration

Ubuntu Linux 18.04

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.