aboutcode-org / aboutcode-org/scancode-toolkit

Incorrect identification of lgpl-2.1

Đang mở
#3,933 3 bình luận 1 reaction 0 người được giao Xem trên GitHub
bug
Ngôn ngữ chính
Python
Star
2.6k
Fork
791
Merge trung bình
1 ngày 12 giờ
Pull request đã merge (30 ngày)
5

Mô tả

### Description

Scancode incorrectly identifies lgpl-2.1

### How To Reproduce

Get the data and scan it:
```
$ mkdir possible-bug
$ cd possible-bug
$ curl -LJO "https://raw.githubusercontent.com/aws/aws-cdk/refs/heads/main/packages/%40aws-cdk/cli-lib-alpha/NOTICE"
$ scancode -clipe --classify --license-clarity-score --license-text . --json-pp NOTICE-scan.json
```

NOTICE file content
```
$ cat NOTICE
AWS Cloud Development Kit (AWS CDK)
Copyright 2018-2024 Amazon.com, Inc. or its affiliates. All Rights Reserved.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Third party attributions of this package can be found in the THIRD_PARTY_LICENSES file
```

Extract the license info:
```
$ cat NOTICE-scan.json | jq .files[].license_detections
[]
[
{
"license_expression": "apache-2.0 AND lgpl-2.1",
"license_expression_spdx": "Apache-2.0 AND LGPL-2.1-only",
"matches": [
{
"license_expression": "apache-2.0 AND lgpl-2.1",
"spdx_license_expression": "Apache-2.0 AND LGPL-2.1-only",
"from_file": "possible-bug/NOTICE",
"start_line": 4,
"end_line": 16,
"matcher": "3-seq",
"score": 73.02,
"matched_length": 86,
"match_coverage": 81.13,
"rule_relevance": 90,
"rule_identifier": "apache-2.0_and_lgpl-2.1_2.RULE",
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/apache-2.0_and_lgpl-2.1_2.RULE",
"matched_text": "Licensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n\nThird party attributions of this package can be found in the THIRD_PARTY_LICENSES file"
}
],
"identifier": "apache_2_0_and_lgpl_2_1-3985cd0c-fc7a-fd67-4380-a7b00818acf1"
}
]
```

Looking at the RULE file (https://github.com/aboutcode-org/scancode-toolkit/blob/develop/src/licensedcode/data/rules/apache-2.0_and_lgpl-2.1_2.RULE), then the two files are very much looking the same, but with the interesting diff (missing in the NOTICE file):
```
On Debian systems a full copy of the LGPL 2.1 can be found at
```
I would **suspect** this is the problem.

_BTW: match coverage is: 81.13_

### System configuration

Ubuntu 24.04
Python 3.12.3
Scancode 32.2.1

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.