aboutcode-org / aboutcode-org/scancode-toolkit

Beginner: What am I supposed to do with this category of false positives?

Ouverte
#3,809 5 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
bug
Langage dominant
Python
Étoiles
2.6k
Forks
791
Merge moyen
1 j 12 h
PR mergées (30 j)
5

Description

It seems I can only create this as a bug, but this is likely not a bug, this is some fundamental problem with the system _as I see/expect it_.

Disclaimer: This is by no means meant to bash on scancode - it's more about aligning expectations.

I have scanned https://github.com/mcmilk/7-Zip-zstd/tree/19.00-v1.4.9-R2 as part of our dependency chain with
```
"C:\tools\scancode\scancode-toolkit-v32.1.0"\scancode.bat --version
ScanCode version: 32.1.0
ScanCode Output Format version: 3.1.0
SPDX License list version: 3.23

// Options: -lci --license-text --only-findings --json-pp
```

And one part finding we get is this: (snippet from the result file):
```
{
"identifier": "lgpl_2_0_plus_and_lgpl_2_1_plus-49ac7398-3df4-a8f7-5cc3-3b7bff032f44",
"license_expression": "lgpl-2.0-plus AND lgpl-2.1-plus",
"license_expression_spdx": "LGPL-2.0-or-later AND LGPL-2.1-or-later",
"detection_count": 1,
"reference_matches": [
{
"license_expression": "lgpl-2.0-plus",
"license_expression_spdx": "LGPL-2.0-or-later",
"from_file": "Build1/DOC/License.txt",
"start_line": 22,
"end_line": 22,
"matcher": "2-aho",
"score": 100.0,
"matched_length": 2,
"match_coverage": 100.0,
"rule_relevance": 100,
"rule_identifier": "lgpl_48.RULE",
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl_48.RULE",
"matched_text": " GNU LGPL information"
},
{
"license_expression": "lgpl-2.1-plus",
"license_expression_spdx": "LGPL-2.1-or-later",
"from_file": "Build1/DOC/License.txt",
"start_line": 25,
"end_line": 37,
"matcher": "2-aho",
"score": 100.0,
"matched_length": 117,
"match_coverage": 100.0,
"rule_relevance": 100,
"rule_identifier": "lgpl-2.1-plus_6.RULE",
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl-2.1-plus_6.RULE",
"matched_text": " This library is free software; you can redistribute it (...snipped for github issue...) either
version 2.1 of the License, or (at your option) any later version ...."
}
```

As you can see, we have one file [`License.txt`](https://github.com/mcmilk/7-Zip-zstd/blob/19.00-v1.4.9-R2/DOC/License.txt) that contains a (rather clear) reference to the `SPDIX:LGPL-2.1-or-later`.

In the very same file we also have another match for a small string " GNU LGPL information" with score:100 that is clearly just the heading of the "correct" section.

For the subsystems I'm currently looking at, I can identify dozens and dozens of such or similar false positives.

I'm trying to make the best of the output, but so far, I'm drowning in noise with my scan results.

**So to me it humbly seems that I'm doing -- or expecting! -- something fundamentally wrong from the tool.**

Yes, there's the [workbench](https://scancode-toolkit.readthedocs.io/en/stable/tutorials/how_to_visualize_scan_results.html#how-to-visualize-scan-results), but this just presents these results in a different way.

Additional Background:
I am currently tasked with automating license detection in our products' source code using scancode, and I'm rather at a loss at how the raw result is in any way automatically processable.

Any help, points or comments welcome, thanks!

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.