clearlydefined / clearlydefined/crawler

Incorrect declared license information (maven)

Open
#618 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
60
Forks
38
Avg merge
1h 49m
Merged PRs (30d)
1

Description

For the package https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-server/, ClearlyDefined has determined three different "declared" license results and they are all incorrect in part. I looked into these three examples and include my findings below.
![image](https://github.com/user-attachments/assets/e4810bea-d7f2-4e41-a240-2a37932798c8)

1. For version 10.0.23, there's a SPDX expression in the LICENSE file that says "SPDX-License-Identifier: EPL-2.0 OR Apache-2.0." I'm not sure why ClearlyDefined put "Apache-2.0 AND EPL-2.0" on one side of the "OR" (see screenshot above) - this is incorrect.

2. For version 12.0.12, the module-info file has the same "SPDX-License-Identifier: EPL-2.0 OR Apache-2.0," which should be the declared field. However, ClearlyDefined is reporting this as just "Apache-2.0" - this is incorrect.
![image](https://github.com/user-attachments/assets/c3e5c0ec-f7ba-40b6-a37e-878ee88b0ddf)

3. For version 9.4.55.v20240627, the about.html file has the dual license information (this older package has EPL-1.0 instead of EPL-2.0). There is also a LICENSE file with EPL 1.0 and Apache-2.0. It looks like ClearlyDefined is including all the discovered licenses in the declared field.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.