aboutcode-org / aboutcode-org/scancode-toolkit
Clarification on license rules with openssl exception
- Lenguaje dominante
- Python
- Estrellas
- 2.6k
- Forks
- 791
- Merge medio
- 1 d 12 h
- PR fusionados (30 d)
- 5
Descripción
When reviewing the scan results for the copyright file from the Ubuntu package `libcryptsetup12` (http://changelogs.ubuntu.com/changelogs/pool/main/c/cryptsetup/cryptsetup_2.2.2-3ubuntu2.4/copyright), we ran across the license expressions that look incorrect because `openssl-exception-gpl-3.0-plus` is present in the expression when `gpl-3.0` is not mentioned in the copyright file:
- `lgpl-2.1-plus WITH openssl-exception-gpl-3.0-plus`
- `gpl-2.0-plus WITH openssl-exception-gpl-3.0-plus`
I think that the following license expressions would be more accurate:
- `lgpl-2.1-plus WITH openssl-exception-lgpl-2.0-plus`
- `gpl-2.0-plus WITH openssl-exception-gpl-2.0-plus`
I see that we have rules that enforce the detection of `lgpl-2.1-plus WITH openssl-exception-gpl-3.0-plus` and `gpl-2.0-plus WITH openssl-exception-gpl-3.0-plus`:
- https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/rules/lgpl-2.1-plus_with_openssl-exception-gpl-3.0-plus_1.RULE
- https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/rules/lgpl-2.1-plus_with_openssl-exception-gpl-3.0-plus_1.yml
- https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/rules/lgpl-2.1-plus_with_openssl-exception-gpl-3.0-plus_3.RULE
- https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/rules/lgpl-2.1-plus_with_openssl-exception-gpl-3.0-plus_3.yml
I would like to know why `openssl-exception-gpl-3.0-plus` is favored over `openssl-exception-gpl-2.0-plus` or `openssl-exception-lgpl-2.0-plus` in these cases.
Guía de contribución
Evaluación
Este issue todavía no se ha evaluado.