aboutcode-org / aboutcode-org/scancode-toolkit

Incorrect identification of lgpl-2.1

Offen
#3,933 3 Kommentare 1 Reaktion 0 zugewiesene Personen Auf GitHub ansehen
bug
Vorherrschende Sprache
Python
Sterne
2.6k
Forks
791
Ø Merge
1 T. 12 Std.
Gemergte PRs (30 T.)
5

Beschreibung

### Description

Scancode incorrectly identifies lgpl-2.1

### How To Reproduce

Get the data and scan it:
```
$ mkdir possible-bug
$ cd possible-bug
$ curl -LJO "https://raw.githubusercontent.com/aws/aws-cdk/refs/heads/main/packages/%40aws-cdk/cli-lib-alpha/NOTICE"
$ scancode -clipe --classify --license-clarity-score --license-text . --json-pp NOTICE-scan.json
```

NOTICE file content
```
$ cat NOTICE
AWS Cloud Development Kit (AWS CDK)
Copyright 2018-2024 Amazon.com, Inc. or its affiliates. All Rights Reserved.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Third party attributions of this package can be found in the THIRD_PARTY_LICENSES file
```

Extract the license info:
```
$ cat NOTICE-scan.json | jq .files[].license_detections
[]
[
{
"license_expression": "apache-2.0 AND lgpl-2.1",
"license_expression_spdx": "Apache-2.0 AND LGPL-2.1-only",
"matches": [
{
"license_expression": "apache-2.0 AND lgpl-2.1",
"spdx_license_expression": "Apache-2.0 AND LGPL-2.1-only",
"from_file": "possible-bug/NOTICE",
"start_line": 4,
"end_line": 16,
"matcher": "3-seq",
"score": 73.02,
"matched_length": 86,
"match_coverage": 81.13,
"rule_relevance": 90,
"rule_identifier": "apache-2.0_and_lgpl-2.1_2.RULE",
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/apache-2.0_and_lgpl-2.1_2.RULE",
"matched_text": "Licensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n\nThird party attributions of this package can be found in the THIRD_PARTY_LICENSES file"
}
],
"identifier": "apache_2_0_and_lgpl_2_1-3985cd0c-fc7a-fd67-4380-a7b00818acf1"
}
]
```

Looking at the RULE file (https://github.com/aboutcode-org/scancode-toolkit/blob/develop/src/licensedcode/data/rules/apache-2.0_and_lgpl-2.1_2.RULE), then the two files are very much looking the same, but with the interesting diff (missing in the NOTICE file):
```
On Debian systems a full copy of the LGPL 2.1 can be found at
```
I would **suspect** this is the problem.

_BTW: match coverage is: 81.13_

### System configuration

Ubuntu 24.04
Python 3.12.3
Scancode 32.2.1

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.