aboutcode-org / aboutcode-org/scancode-toolkit

Missing License/Question : MIT-0 not detected and OR license expression misinterpreted as AND

Đang mở
#4,574 6 bình luận 0 reaction 0 người được giao Xem trên GitHub
bug
Ngôn ngữ chính
Python
Star
2.6k
Fork
791
Merge trung bình
1 ngày 12 giờ
Pull request đã merge (30 ngày)
5

Mô tả

### Description

When scanning [constant_time_eq v0.3.1](https://github.com/cesarb/constant_time_eq/tree/0.3.1), I observed the following issues:

1. **MIT-0 not detected**
- In `Cargo.toml`, the declared license expression is:
```
license = "CC0-1.0 OR MIT-0 OR Apache-2.0"
```
- However, only `CC0-1.0` and `Apache-2.0` are detected.
- `MIT-0` is missing from the scan result.

2. **OR misinterpreted as AND**
- The above license expression (`CC0-1.0 OR MIT-0 OR Apache-2.0`) is reported as `CC0-1.0 AND Apache-2.0`.
- This changes the intended meaning from a license choice (OR) to a license conjunction (AND).

### How To Reproduce

git clone --branch 0.3.1 https://github.com/cesarb/constant_time_eq.git
cd constant_time_eq
scancode -cli --json-pp - > result.json constant_time_eq

### System configuration

OS: macOS 15.6.1 (x86_64)
ScanCode Toolkit version: 32.4.1
Installation method: pip

### Questions

In addition to the bug report, I would like to confirm two points about how license expressions are represented in the scan output:

1. Multiple detections per file
- If files[].license_detections[].matches[].license_expression contains multiple entries for a single file, are they always combined into files[].license_detections[].matches[].detected_license_expression with an AND operator?
- Or can they sometimes be combined differently (e.g., OR)?
2. Difference between fields
What is the exact difference between:
- files[].license_detections[].matches[].detected_license_expression
- files[].license_detections[].matches[].detected_license_expression_spdx
- When should each be used?

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.