clearlydefined / clearlydefined/crawler
Incorrect declared license information (maven)
- Dominant language
- JavaScript
- Stars
- 60
- Forks
- 38
- Avg merge
- 1h 49m
- Merged PRs (30d)
- 1
Description
For the package https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-server/, ClearlyDefined has determined three different "declared" license results and they are all incorrect in part. I looked into these three examples and include my findings below.

1. For version 10.0.23, there's a SPDX expression in the LICENSE file that says "SPDX-License-Identifier: EPL-2.0 OR Apache-2.0." I'm not sure why ClearlyDefined put "Apache-2.0 AND EPL-2.0" on one side of the "OR" (see screenshot above) - this is incorrect.
2. For version 12.0.12, the module-info file has the same "SPDX-License-Identifier: EPL-2.0 OR Apache-2.0," which should be the declared field. However, ClearlyDefined is reporting this as just "Apache-2.0" - this is incorrect.

3. For version 9.4.55.v20240627, the about.html file has the dual license information (this older package has EPL-1.0 instead of EPL-2.0). There is also a LICENSE file with EPL 1.0 and Apache-2.0. It looks like ClearlyDefined is including all the discovered licenses in the declared field.
Contributor guide
Assessment
This issue has not been assessed yet.