aboutcode-org / aboutcode-org/scancode-toolkit

Missing License/Question : MIT-0 not detected and OR license expression misinterpreted as AND

未关闭
#4,574 6 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
bug
主要语言
Python
星标
2.6k
派生
791
平均合并
1 天 12 小时
30 天内合并 PR
5

描述

### Description

When scanning [constant_time_eq v0.3.1](https://github.com/cesarb/constant_time_eq/tree/0.3.1), I observed the following issues:

1. **MIT-0 not detected**
- In `Cargo.toml`, the declared license expression is:
```
license = "CC0-1.0 OR MIT-0 OR Apache-2.0"
```
- However, only `CC0-1.0` and `Apache-2.0` are detected.
- `MIT-0` is missing from the scan result.

2. **OR misinterpreted as AND**
- The above license expression (`CC0-1.0 OR MIT-0 OR Apache-2.0`) is reported as `CC0-1.0 AND Apache-2.0`.
- This changes the intended meaning from a license choice (OR) to a license conjunction (AND).

### How To Reproduce

git clone --branch 0.3.1 https://github.com/cesarb/constant_time_eq.git
cd constant_time_eq
scancode -cli --json-pp - > result.json constant_time_eq

### System configuration

OS: macOS 15.6.1 (x86_64)
ScanCode Toolkit version: 32.4.1
Installation method: pip

### Questions

In addition to the bug report, I would like to confirm two points about how license expressions are represented in the scan output:

1. Multiple detections per file
- If files[].license_detections[].matches[].license_expression contains multiple entries for a single file, are they always combined into files[].license_detections[].matches[].detected_license_expression with an AND operator?
- Or can they sometimes be combined differently (e.g., OR)?
2. Difference between fields
What is the exact difference between:
- files[].license_detections[].matches[].detected_license_expression
- files[].license_detections[].matches[].detected_license_expression_spdx
- When should each be used?

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。