aboutcode-org / aboutcode-org/scancode-toolkit

Incorrect identification of lgpl-2.1

Aperta
#3,933 3 commenti 1 reazione 0 assegnatari Vedi su GitHub
bug
Lingua principale
Python
Stelle
2.6k
Fork
791
Merge medio
1g 12h
PR unite (30g)
5

Descrizione

### Description

Scancode incorrectly identifies lgpl-2.1

### How To Reproduce

Get the data and scan it:
```
$ mkdir possible-bug
$ cd possible-bug
$ curl -LJO "https://raw.githubusercontent.com/aws/aws-cdk/refs/heads/main/packages/%40aws-cdk/cli-lib-alpha/NOTICE"
$ scancode -clipe --classify --license-clarity-score --license-text . --json-pp NOTICE-scan.json
```

NOTICE file content
```
$ cat NOTICE
AWS Cloud Development Kit (AWS CDK)
Copyright 2018-2024 Amazon.com, Inc. or its affiliates. All Rights Reserved.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Third party attributions of this package can be found in the THIRD_PARTY_LICENSES file
```

Extract the license info:
```
$ cat NOTICE-scan.json | jq .files[].license_detections
[]
[
{
"license_expression": "apache-2.0 AND lgpl-2.1",
"license_expression_spdx": "Apache-2.0 AND LGPL-2.1-only",
"matches": [
{
"license_expression": "apache-2.0 AND lgpl-2.1",
"spdx_license_expression": "Apache-2.0 AND LGPL-2.1-only",
"from_file": "possible-bug/NOTICE",
"start_line": 4,
"end_line": 16,
"matcher": "3-seq",
"score": 73.02,
"matched_length": 86,
"match_coverage": 81.13,
"rule_relevance": 90,
"rule_identifier": "apache-2.0_and_lgpl-2.1_2.RULE",
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/apache-2.0_and_lgpl-2.1_2.RULE",
"matched_text": "Licensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n\nThird party attributions of this package can be found in the THIRD_PARTY_LICENSES file"
}
],
"identifier": "apache_2_0_and_lgpl_2_1-3985cd0c-fc7a-fd67-4380-a7b00818acf1"
}
]
```

Looking at the RULE file (https://github.com/aboutcode-org/scancode-toolkit/blob/develop/src/licensedcode/data/rules/apache-2.0_and_lgpl-2.1_2.RULE), then the two files are very much looking the same, but with the interesting diff (missing in the NOTICE file):
```
On Debian systems a full copy of the LGPL 2.1 can be found at
```
I would **suspect** this is the problem.

_BTW: match coverage is: 81.13_

### System configuration

Ubuntu 24.04
Python 3.12.3
Scancode 32.2.1

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.