aboutcode-org / aboutcode-org/scancode-toolkit

Clarification on license rules with openssl exception

Open
#2,890 0 comments 0 reactions 1 assignee Claimed by @pombredanne View on GitHub
bug license scan
Dominant language
Python
Stars
2.6k
Forks
791
Avg merge
1d 12h
Merged PRs (30d)
5

Description

When reviewing the scan results for the copyright file from the Ubuntu package `libcryptsetup12` (http://changelogs.ubuntu.com/changelogs/pool/main/c/cryptsetup/cryptsetup_2.2.2-3ubuntu2.4/copyright), we ran across the license expressions that look incorrect because `openssl-exception-gpl-3.0-plus` is present in the expression when `gpl-3.0` is not mentioned in the copyright file:

- `lgpl-2.1-plus WITH openssl-exception-gpl-3.0-plus`
- `gpl-2.0-plus WITH openssl-exception-gpl-3.0-plus`

I think that the following license expressions would be more accurate:

- `lgpl-2.1-plus WITH openssl-exception-lgpl-2.0-plus`
- `gpl-2.0-plus WITH openssl-exception-gpl-2.0-plus`

I see that we have rules that enforce the detection of `lgpl-2.1-plus WITH openssl-exception-gpl-3.0-plus` and `gpl-2.0-plus WITH openssl-exception-gpl-3.0-plus`:

- https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/rules/lgpl-2.1-plus_with_openssl-exception-gpl-3.0-plus_1.RULE
- https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/rules/lgpl-2.1-plus_with_openssl-exception-gpl-3.0-plus_1.yml
- https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/rules/lgpl-2.1-plus_with_openssl-exception-gpl-3.0-plus_3.RULE
- https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/rules/lgpl-2.1-plus_with_openssl-exception-gpl-3.0-plus_3.yml

I would like to know why `openssl-exception-gpl-3.0-plus` is favored over `openssl-exception-gpl-2.0-plus` or `openssl-exception-lgpl-2.0-plus` in these cases.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.