aboutcode-org / aboutcode-org/scancode-toolkit
Clarification on license rules with openssl exception
- Linguagem predominante
- Python
- Estrelas
- 2.6k
- Forks
- 791
- Merge médio
- 1d 12h
- PRs com merge (30d)
- 5
Descrição
When reviewing the scan results for the copyright file from the Ubuntu package `libcryptsetup12` (http://changelogs.ubuntu.com/changelogs/pool/main/c/cryptsetup/cryptsetup_2.2.2-3ubuntu2.4/copyright), we ran across the license expressions that look incorrect because `openssl-exception-gpl-3.0-plus` is present in the expression when `gpl-3.0` is not mentioned in the copyright file:
- `lgpl-2.1-plus WITH openssl-exception-gpl-3.0-plus`
- `gpl-2.0-plus WITH openssl-exception-gpl-3.0-plus`
I think that the following license expressions would be more accurate:
- `lgpl-2.1-plus WITH openssl-exception-lgpl-2.0-plus`
- `gpl-2.0-plus WITH openssl-exception-gpl-2.0-plus`
I see that we have rules that enforce the detection of `lgpl-2.1-plus WITH openssl-exception-gpl-3.0-plus` and `gpl-2.0-plus WITH openssl-exception-gpl-3.0-plus`:
- https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/rules/lgpl-2.1-plus_with_openssl-exception-gpl-3.0-plus_1.RULE
- https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/rules/lgpl-2.1-plus_with_openssl-exception-gpl-3.0-plus_1.yml
- https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/rules/lgpl-2.1-plus_with_openssl-exception-gpl-3.0-plus_3.RULE
- https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/rules/lgpl-2.1-plus_with_openssl-exception-gpl-3.0-plus_3.yml
I would like to know why `openssl-exception-gpl-3.0-plus` is favored over `openssl-exception-gpl-2.0-plus` or `openssl-exception-lgpl-2.0-plus` in these cases.
Guia de contribuição
Avaliação
Esta issue ainda não foi avaliada.