aboutcode-org / aboutcode-org/scancode-toolkit

False positive: LGPL-2.1 file detected as "LGPL-3.0-only AND GPL-1.0-or-later"

Ouverte
#4,992 8 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
bug
Langage dominant
Python
Étoiles
2.6k
Forks
791
Merge moyen
1 j 12 h
PR mergées (30 j)
5

Description

### Description

Scanning `src/yp_order.c` from `libnsl` v2.0.1 reports `LGPL-3.0-only AND GPL-1.0-or-later`.
and "identifier": "lgpl_3_0_and_gpl_1_0_plus-d1207106-f72f-146f-6eb1-6008c11de4ee",

The file header states that the file is under GNU Lesser General Public License in version 2.1

Source file:
https://github.com/thkukuk/libnsl/blob/v2.0.1/src/yp_order.c

Expected license detection: `LGPL-2.1-only`

Actual license detection: `LGPL-3.0-only AND GPL-1.0-or-later`

This appears to be a false positive caused by the license text mentioning "GNU Lesser General Public License" and later "GNU General Public License" in the warranty/copy notice text, even though the version stated in the header is LGPL version 2.1.

### How To Reproduce

```bash
wget https://github.com/thkukuk/libnsl/archive/refs/tags/v2.0.1.zip
unzip v2.0.1.zip
scancode --license --json-pp result.json libnsl-2.0.1/src/yp_order.c
```

### System configuration

OS: macOS 26.3.1 (x86_64)
ScanCode Toolkit version: 32.5.0
Installation method: pip

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.