aboutcode-org / aboutcode-org/scancode-toolkit

Incorrect detection and confusing licenses in https://raw.githubusercontent.com/Stuk/jszip/

Aperta
#4,112 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
Lingua principale
Python
Stelle
2.6k
Fork
791
Merge medio
1g 12h
PR unite (30g)
5

Descrizione

We are not detecting licenses exactly right in https://github.com/Stuk/jszip

- In LICENSE.markdown, we should detect as mit or gpl-3.0. Here the GPL mention does not state other later versions:
```
dual licensed. At your choice you may use it under the MIT license *or* the GPLv3
license.
```
The text further contains a full MIT and a truncated GPL 3 text, where the tail text after `END OF TERMS AND CONDITIONS` has been removed.

- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/bower.json#L14 has a tag `"license": "MIT or GPLv3",`. And here also the GPL mention does not state other later versions, just plain v3.
- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/component.json#L12 as a tag `"license": "MIT or GPLv3",`. And here also the GPL mention does not state other later versions, just plain v3.
- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/README.markdown#L29 has this notice. Again no later GPL versions.
```
License
-------

JSZip is dual-licensed. You may use it under the MIT license *or* the GPLv3
license. See [LICENSE.markdown](LICENSE.markdown).
```
- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/package.json#L66 has a SPDX license expression as ` "license": "(MIT OR GPL-3.0-or-later)"` with a choice of later GPL

- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/dist/jszip.js#L7 and https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/dist/jszip.min.js have another notice:
```
Dual licenced under the MIT license or GPLv3. See https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.

JSZip uses the library pako released under the MIT license :
https://github.com/nodeca/pako/blob/main/LICENSE
```
Here again no other GPL version. The upstream copyright notice has not been carried forward,

A ScanCode.io scan of the code from https://github.com/Stuk/jszip/archive/2ceb998e29d4171b4f3f2ecab1a2195c696543c0.zip attached shows that there is also code under the zlib license likely from https://github.com/nodeca/pako/ (and many other licenses but for the PKzip spec, as well as several test files, examples and documentation, but not core code, therefore I ignore these for now)

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.