aboutcode-org / aboutcode-org/scancode-toolkit

Beginner: What am I supposed to do with this category of false positives?

Đang mở
#3,809 5 bình luận 0 reaction 0 người được giao Xem trên GitHub
bug
Ngôn ngữ chính
Python
Star
2.6k
Fork
791
Merge trung bình
1 ngày 12 giờ
Pull request đã merge (30 ngày)
5

Mô tả

It seems I can only create this as a bug, but this is likely not a bug, this is some fundamental problem with the system _as I see/expect it_.

Disclaimer: This is by no means meant to bash on scancode - it's more about aligning expectations.

I have scanned https://github.com/mcmilk/7-Zip-zstd/tree/19.00-v1.4.9-R2 as part of our dependency chain with
```
"C:\tools\scancode\scancode-toolkit-v32.1.0"\scancode.bat --version
ScanCode version: 32.1.0
ScanCode Output Format version: 3.1.0
SPDX License list version: 3.23

// Options: -lci --license-text --only-findings --json-pp
```

And one part finding we get is this: (snippet from the result file):
```
{
"identifier": "lgpl_2_0_plus_and_lgpl_2_1_plus-49ac7398-3df4-a8f7-5cc3-3b7bff032f44",
"license_expression": "lgpl-2.0-plus AND lgpl-2.1-plus",
"license_expression_spdx": "LGPL-2.0-or-later AND LGPL-2.1-or-later",
"detection_count": 1,
"reference_matches": [
{
"license_expression": "lgpl-2.0-plus",
"license_expression_spdx": "LGPL-2.0-or-later",
"from_file": "Build1/DOC/License.txt",
"start_line": 22,
"end_line": 22,
"matcher": "2-aho",
"score": 100.0,
"matched_length": 2,
"match_coverage": 100.0,
"rule_relevance": 100,
"rule_identifier": "lgpl_48.RULE",
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl_48.RULE",
"matched_text": " GNU LGPL information"
},
{
"license_expression": "lgpl-2.1-plus",
"license_expression_spdx": "LGPL-2.1-or-later",
"from_file": "Build1/DOC/License.txt",
"start_line": 25,
"end_line": 37,
"matcher": "2-aho",
"score": 100.0,
"matched_length": 117,
"match_coverage": 100.0,
"rule_relevance": 100,
"rule_identifier": "lgpl-2.1-plus_6.RULE",
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl-2.1-plus_6.RULE",
"matched_text": " This library is free software; you can redistribute it (...snipped for github issue...) either
version 2.1 of the License, or (at your option) any later version ...."
}
```

As you can see, we have one file [`License.txt`](https://github.com/mcmilk/7-Zip-zstd/blob/19.00-v1.4.9-R2/DOC/License.txt) that contains a (rather clear) reference to the `SPDIX:LGPL-2.1-or-later`.

In the very same file we also have another match for a small string " GNU LGPL information" with score:100 that is clearly just the heading of the "correct" section.

For the subsystems I'm currently looking at, I can identify dozens and dozens of such or similar false positives.

I'm trying to make the best of the output, but so far, I'm drowning in noise with my scan results.

**So to me it humbly seems that I'm doing -- or expecting! -- something fundamentally wrong from the tool.**

Yes, there's the [workbench](https://scancode-toolkit.readthedocs.io/en/stable/tutorials/how_to_visualize_scan_results.html#how-to-visualize-scan-results), but this just presents these results in a different way.

Additional Background:
I am currently tasked with automating license detection in our products' source code using scancode, and I'm rather at a loss at how the raw result is in any way automatically processable.

Any help, points or comments welcome, thanks!

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.