aboutcode-org / aboutcode-org/scancode-toolkit

Incorrect identification of lgpl-2.1

未關閉
#3,933 3 則留言 1 個 reaction 已指派 0 人 在 GitHub 檢視
bug
主要語言
Python
星號
2.6k
分支
791
平均合併
1 天 12 小時
30 天內合併 PR
5

描述

### Description

Scancode incorrectly identifies lgpl-2.1

### How To Reproduce

Get the data and scan it:
```
$ mkdir possible-bug
$ cd possible-bug
$ curl -LJO "https://raw.githubusercontent.com/aws/aws-cdk/refs/heads/main/packages/%40aws-cdk/cli-lib-alpha/NOTICE"
$ scancode -clipe --classify --license-clarity-score --license-text . --json-pp NOTICE-scan.json
```

NOTICE file content
```
$ cat NOTICE
AWS Cloud Development Kit (AWS CDK)
Copyright 2018-2024 Amazon.com, Inc. or its affiliates. All Rights Reserved.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Third party attributions of this package can be found in the THIRD_PARTY_LICENSES file
```

Extract the license info:
```
$ cat NOTICE-scan.json | jq .files[].license_detections
[]
[
{
"license_expression": "apache-2.0 AND lgpl-2.1",
"license_expression_spdx": "Apache-2.0 AND LGPL-2.1-only",
"matches": [
{
"license_expression": "apache-2.0 AND lgpl-2.1",
"spdx_license_expression": "Apache-2.0 AND LGPL-2.1-only",
"from_file": "possible-bug/NOTICE",
"start_line": 4,
"end_line": 16,
"matcher": "3-seq",
"score": 73.02,
"matched_length": 86,
"match_coverage": 81.13,
"rule_relevance": 90,
"rule_identifier": "apache-2.0_and_lgpl-2.1_2.RULE",
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/apache-2.0_and_lgpl-2.1_2.RULE",
"matched_text": "Licensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n\nThird party attributions of this package can be found in the THIRD_PARTY_LICENSES file"
}
],
"identifier": "apache_2_0_and_lgpl_2_1-3985cd0c-fc7a-fd67-4380-a7b00818acf1"
}
]
```

Looking at the RULE file (https://github.com/aboutcode-org/scancode-toolkit/blob/develop/src/licensedcode/data/rules/apache-2.0_and_lgpl-2.1_2.RULE), then the two files are very much looking the same, but with the interesting diff (missing in the NOTICE file):
```
On Debian systems a full copy of the LGPL 2.1 can be found at
```
I would **suspect** this is the problem.

_BTW: match coverage is: 81.13_

### System configuration

Ubuntu 24.04
Python 3.12.3
Scancode 32.2.1

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。