aboutcode-org / aboutcode-org/scancode-toolkit

Consider detected copyrights when determining a declared holder from a package manifest in summary plugin

Open
#2,972 6 comments 0 reactions 1 assignee Claimed by @JonoYang View on GitHub
bug primary-summary
Dominant language
Python
Stars
2.6k
Forks
791
Avg merge
1d 12h
Merged PRs (30d)
5

Description

When scanning the package `atheris v 2.0.11` (https://github.com/google/atheris/archive/refs/tags/2.0.11.tar.gz) using the `--summary` plugin, the `declared_holder` value in the scan summary is `Bitshift`, which is the author of the package. This was determined from the parsed package data from the `setup.py` file of `atheris`. However, the `setup.py` contains a comment that is a copyright statement with the actual copyright holders. The summary plugin should be updated to also consider copyrights detected by the copyright scanner. This value should take precedence over authors.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.