aboutcode-org / aboutcode-org/scancode-toolkit

False positive: Extra licenses detected for CKEditor 5 (augmentation.d.ts)

未关闭
#4,583 2 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
bug
主要语言
Python
星标
2.6k
派生
791
平均合并
1 天 12 小时
30 天内合并 PR
5

描述

### Description

When scanning the package @ckeditor/ckeditor5-special-characters@43.0.0 using ScanCode Toolkit, the file package/dist/augmentation.d.ts is detected with the following license expression:

> (gpl-2.0-plus AND (gpl-2.0-plus OR lgpl-2.1-plus OR mpl-1.1)) OR commercial-license

This detection is triggered by [https://github.com/aboutcode-org/scancode-toolkit/blob/develop/src/licensedcode/data/rules/gpl-2.0-plus_and_gpl-2.0-plus_or_lgpl-2.1-plus_or_mpl-1.1_or_commercial-license_1.RULE](https://github.com/aboutcode-org/scancode-toolkit/blob/develop/src/licensedcode/data/rules/gpl-2.0-plus_and_gpl-2.0-plus_or_lgpl-2.1-plus_or_mpl-1.1_or_commercial-license_1.RULE), which matches the text:

> 'For licensing, see LICENSE.md or https://ckeditor.com/legal/ckeditor-oss-license'

However, the linked URL currently describes licensing terms for CKEditor 4 and CKEditor 5
CKEditor 4 includes MPL-1.1 and other licenses.
For CKEditor 5 (including version 43.0.0), the license is GPL-2.0-plus, so the detection result is incorrect and includes unnecessary licenses (e.g., MPL-1.1, LGPL-2.1-plus).

### How To Reproduce

> npm pack @ckeditor/ckeditor5-special-characters@43.0.0
tar -xvf ckeditor-ckeditor5-special-characters-43.0.0.tgz
scancode --license --json-pp scancode.json package

Check the scancode.json output for package/dist/augmentation.d.ts and note the license expression.

### System configuration

OS: macOS 15.6.1 (x86_64)
ScanCode Toolkit version: 32.4.1
Installation method: pip

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。