aboutcode-org / aboutcode-org/scancode-toolkit

Incorrect detection and confusing licenses in https://raw.githubusercontent.com/Stuk/jszip/

Abierto
#4,112 0 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
Python
Estrellas
2.6k
Forks
791
Merge medio
1 d 12 h
PR fusionados (30 d)
5

Descripción

We are not detecting licenses exactly right in https://github.com/Stuk/jszip

- In LICENSE.markdown, we should detect as mit or gpl-3.0. Here the GPL mention does not state other later versions:
```
dual licensed. At your choice you may use it under the MIT license *or* the GPLv3
license.
```
The text further contains a full MIT and a truncated GPL 3 text, where the tail text after `END OF TERMS AND CONDITIONS` has been removed.

- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/bower.json#L14 has a tag `"license": "MIT or GPLv3",`. And here also the GPL mention does not state other later versions, just plain v3.
- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/component.json#L12 as a tag `"license": "MIT or GPLv3",`. And here also the GPL mention does not state other later versions, just plain v3.
- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/README.markdown#L29 has this notice. Again no later GPL versions.
```
License
-------

JSZip is dual-licensed. You may use it under the MIT license *or* the GPLv3
license. See [LICENSE.markdown](LICENSE.markdown).
```
- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/package.json#L66 has a SPDX license expression as ` "license": "(MIT OR GPL-3.0-or-later)"` with a choice of later GPL

- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/dist/jszip.js#L7 and https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/dist/jszip.min.js have another notice:
```
Dual licenced under the MIT license or GPLv3. See https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.

JSZip uses the library pako released under the MIT license :
https://github.com/nodeca/pako/blob/main/LICENSE
```
Here again no other GPL version. The upstream copyright notice has not been carried forward,

A ScanCode.io scan of the code from https://github.com/Stuk/jszip/archive/2ceb998e29d4171b4f3f2ecab1a2195c696543c0.zip attached shows that there is also code under the zlib license likely from https://github.com/nodeca/pako/ (and many other licenses but for the PKzip spec, as well as several test files, examples and documentation, but not core code, therefore I ignore these for now)

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.