aboutcode-org / aboutcode-org/scancode-toolkit

False positive `gpl-1.0-plus` license reported for `node-forge`

Abierto
#3,722 2 comentarios 1 reacción 0 asignados Ver en GitHub
bug
Lenguaje dominante
Python
Estrellas
2.6k
Forks
791
Merge medio
1 d 12 h
PR fusionados (30 d)
5

Descripción

### Description

When running the current version of `scancode-toolkit` on https://www.npmjs.com/package/node-forge, it will report a declared license expression in the summary of `(bsd-new AND gpl-2.0 AND gpl-1.0-plus) AND (bsd-new AND gpl-2.0)`. The inclusion of `gpl-1.0-plus` here is wrong.

I believe this is due to a lax text matching in the `gpl-1.0-plus_351.RULE`. The `LICENSE` file of `node-forge` includes a preamble by the package author explaining the licenses:

> ...
> If the GPL suits your project better you are also free to use Forge under
that license.
> …

From the ScanCode result, it appears that it's simply matching on "the GPL" in the above sentence which triggers this license detection:

```json
{
"score": 85,
"start_line": 8,
"end_line": 8,
"matched_length": 2,
"match_coverage": 100,
"matcher": "2-aho",
"license_expression": "gpl-1.0-plus",
"rule_identifier": "gpl-1.0-plus_351.RULE",
"rule_relevance": 85,
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/gpl-1.0-plus_351.RULE",
"matched_text": "the GPL"
}
```

Perhaps the required matched text needs to be expanded?

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.