aboutcode-org / aboutcode-org/scancode-toolkit
Incorrect detection and confusing licenses in https://raw.githubusercontent.com/Stuk/jszip/
- Langage dominant
- Python
- Étoiles
- 2.6k
- Forks
- 791
- Merge moyen
- 1 j 12 h
- PR mergées (30 j)
- 5
Description
We are not detecting licenses exactly right in https://github.com/Stuk/jszip
- In LICENSE.markdown, we should detect as mit or gpl-3.0. Here the GPL mention does not state other later versions:
```
dual licensed. At your choice you may use it under the MIT license *or* the GPLv3
license.
```
The text further contains a full MIT and a truncated GPL 3 text, where the tail text after `END OF TERMS AND CONDITIONS` has been removed.
- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/bower.json#L14 has a tag `"license": "MIT or GPLv3",`. And here also the GPL mention does not state other later versions, just plain v3.
- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/component.json#L12 as a tag `"license": "MIT or GPLv3",`. And here also the GPL mention does not state other later versions, just plain v3.
- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/README.markdown#L29 has this notice. Again no later GPL versions.
```
License
-------
JSZip is dual-licensed. You may use it under the MIT license *or* the GPLv3
license. See [LICENSE.markdown](LICENSE.markdown).
```
- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/package.json#L66 has a SPDX license expression as ` "license": "(MIT OR GPL-3.0-or-later)"` with a choice of later GPL
- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/dist/jszip.js#L7 and https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/dist/jszip.min.js have another notice:
```
Dual licenced under the MIT license or GPLv3. See https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.
JSZip uses the library pako released under the MIT license :
https://github.com/nodeca/pako/blob/main/LICENSE
```
Here again no other GPL version. The upstream copyright notice has not been carried forward,
A ScanCode.io scan of the code from https://github.com/Stuk/jszip/archive/2ceb998e29d4171b4f3f2ecab1a2195c696543c0.zip attached shows that there is also code under the zlib license likely from https://github.com/nodeca/pako/ (and many other licenses but for the PKzip spec, as well as several test files, examples and documentation, but not core code, therefore I ignore these for now)
Guide de contribution
Ouvrir le guide de contribution
Évaluation
Cette issue n'a pas encore été évaluée.