aboutcode-org / aboutcode-org/scancode-toolkit

Beginner: What am I supposed to do with this category of false positives?

Abierto
#3,809 5 comentarios 0 reacciones 0 asignados Ver en GitHub
bug
Lenguaje dominante
Python
Estrellas
2.6k
Forks
791
Merge medio
1 d 12 h
PR fusionados (30 d)
5

Descripción

It seems I can only create this as a bug, but this is likely not a bug, this is some fundamental problem with the system _as I see/expect it_.

Disclaimer: This is by no means meant to bash on scancode - it's more about aligning expectations.

I have scanned https://github.com/mcmilk/7-Zip-zstd/tree/19.00-v1.4.9-R2 as part of our dependency chain with
```
"C:\tools\scancode\scancode-toolkit-v32.1.0"\scancode.bat --version
ScanCode version: 32.1.0
ScanCode Output Format version: 3.1.0
SPDX License list version: 3.23

// Options: -lci --license-text --only-findings --json-pp
```

And one part finding we get is this: (snippet from the result file):
```
{
"identifier": "lgpl_2_0_plus_and_lgpl_2_1_plus-49ac7398-3df4-a8f7-5cc3-3b7bff032f44",
"license_expression": "lgpl-2.0-plus AND lgpl-2.1-plus",
"license_expression_spdx": "LGPL-2.0-or-later AND LGPL-2.1-or-later",
"detection_count": 1,
"reference_matches": [
{
"license_expression": "lgpl-2.0-plus",
"license_expression_spdx": "LGPL-2.0-or-later",
"from_file": "Build1/DOC/License.txt",
"start_line": 22,
"end_line": 22,
"matcher": "2-aho",
"score": 100.0,
"matched_length": 2,
"match_coverage": 100.0,
"rule_relevance": 100,
"rule_identifier": "lgpl_48.RULE",
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl_48.RULE",
"matched_text": " GNU LGPL information"
},
{
"license_expression": "lgpl-2.1-plus",
"license_expression_spdx": "LGPL-2.1-or-later",
"from_file": "Build1/DOC/License.txt",
"start_line": 25,
"end_line": 37,
"matcher": "2-aho",
"score": 100.0,
"matched_length": 117,
"match_coverage": 100.0,
"rule_relevance": 100,
"rule_identifier": "lgpl-2.1-plus_6.RULE",
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl-2.1-plus_6.RULE",
"matched_text": " This library is free software; you can redistribute it (...snipped for github issue...) either
version 2.1 of the License, or (at your option) any later version ...."
}
```

As you can see, we have one file [`License.txt`](https://github.com/mcmilk/7-Zip-zstd/blob/19.00-v1.4.9-R2/DOC/License.txt) that contains a (rather clear) reference to the `SPDIX:LGPL-2.1-or-later`.

In the very same file we also have another match for a small string " GNU LGPL information" with score:100 that is clearly just the heading of the "correct" section.

For the subsystems I'm currently looking at, I can identify dozens and dozens of such or similar false positives.

I'm trying to make the best of the output, but so far, I'm drowning in noise with my scan results.

**So to me it humbly seems that I'm doing -- or expecting! -- something fundamentally wrong from the tool.**

Yes, there's the [workbench](https://scancode-toolkit.readthedocs.io/en/stable/tutorials/how_to_visualize_scan_results.html#how-to-visualize-scan-results), but this just presents these results in a different way.

Additional Background:
I am currently tasked with automating license detection in our products' source code using scancode, and I'm rather at a loss at how the raw result is in any way automatically processable.

Any help, points or comments welcome, thanks!

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.