aboutcode-org / aboutcode-org/scancode-toolkit

Incorrect detection and confusing licenses in https://raw.githubusercontent.com/Stuk/jszip/

未關閉
#4,112 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
Python
星號
2.6k
分支
791
平均合併
1 天 12 小時
30 天內合併 PR
5

描述

We are not detecting licenses exactly right in https://github.com/Stuk/jszip

- In LICENSE.markdown, we should detect as mit or gpl-3.0. Here the GPL mention does not state other later versions:
```
dual licensed. At your choice you may use it under the MIT license *or* the GPLv3
license.
```
The text further contains a full MIT and a truncated GPL 3 text, where the tail text after `END OF TERMS AND CONDITIONS` has been removed.

- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/bower.json#L14 has a tag `"license": "MIT or GPLv3",`. And here also the GPL mention does not state other later versions, just plain v3.
- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/component.json#L12 as a tag `"license": "MIT or GPLv3",`. And here also the GPL mention does not state other later versions, just plain v3.
- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/README.markdown#L29 has this notice. Again no later GPL versions.
```
License
-------

JSZip is dual-licensed. You may use it under the MIT license *or* the GPLv3
license. See [LICENSE.markdown](LICENSE.markdown).
```
- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/package.json#L66 has a SPDX license expression as ` "license": "(MIT OR GPL-3.0-or-later)"` with a choice of later GPL

- https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/dist/jszip.js#L7 and https://github.com/Stuk/jszip/blob/2ceb998e29d4171b4f3f2ecab1a2195c696543c0/dist/jszip.min.js have another notice:
```
Dual licenced under the MIT license or GPLv3. See https://raw.github.com/Stuk/jszip/main/LICENSE.markdown.

JSZip uses the library pako released under the MIT license :
https://github.com/nodeca/pako/blob/main/LICENSE
```
Here again no other GPL version. The upstream copyright notice has not been carried forward,

A ScanCode.io scan of the code from https://github.com/Stuk/jszip/archive/2ceb998e29d4171b4f3f2ecab1a2195c696543c0.zip attached shows that there is also code under the zlib license likely from https://github.com/nodeca/pako/ (and many other licenses but for the PKzip spec, as well as several test files, examples and documentation, but not core code, therefore I ignore these for now)

貢獻指南

開啟貢獻指南

評估

這個 Issue 還沒有評估資料。

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。