aboutcode-org / scancode-toolkit

:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase, the Google Summer of Code, Azure credits, nexB and others generous sponsors!
https://github.com/aboutcode-org/scancode-toolkit/releases/
2.1k stars 545 forks source link

Add more Android Bazel structured metadata #2844

Open pombredanne opened 2 years ago

pombredanne commented 2 years ago

We have support for Buck and Bazel but there are likely new things in Android we do not support yet:

https://android.googlesource.com/platform/external/dng_sdk/+/refs/heads/master/Android.bp

// *** THIS PACKAGE HAS SPECIAL LICENSING CONDITIONS.  PLEASE
//     CONSULT THE OWNERS AND opensource-licensing@google.com BEFORE
//     DEPENDING ON IT IN YOUR PROJECT. ***
package {
    default_applicable_licenses: ["external_dng_sdk_license"],
}
// Added automatically by a large-scale-change that took the approach of
// 'apply every license found to every target'. While this makes sure we respect
// every license restriction, it may not be entirely correct.
//
// e.g. GPL in an MIT project might only apply to the contrib/ directory.
//
// Please consider splitting the single license below into multiple licenses,
// taking care not to lose any license_kind information, and overriding the
// default license using the 'licenses: [...]' property on targets as needed.
//
// For unused files, consider creating a 'fileGroup' with "//visibility:private"
// to attach the license to, and including a comment whether the files may be
// used in the current project.
//
// large-scale-change included anything that looked like it might be a license
// text as a license_text. e.g. LICENSE, NOTICE, COPYING etc.
//
// Please consider removing redundant or irrelevant files from 'license_text:'.
// See: http://go/android-license-faq
license {
    name: "external_dng_sdk_license",
    visibility: [":__subpackages__"],
    license_kinds: [
        "SPDX-license-identifier-Apache-2.0",
        "SPDX-license-identifier-MIT",
        "legacy_by_exception_only", // by exception only
    ],
    license_text: [
        "LICENSE",
        "LICENSE.source_code",
        "LICENSE.technology",
        "NOTICE",
        "PATENTS",
    ],
}

https://android.googlesource.com/platform/external/exfatprogs/+/c7d72b803f7af322611675f15016039f2331e568/METADATA

name: exfatprogs
description:
    As new exfat filesystem is merged into linux-5.7 kernel, exfatprogs is 
    created as an official userspace utilities that contain all of the 
    standard 
    utilities for creating and fixing and debugging exfat filesystem in linux 
    system. The goal of exfatprogs is to provide high performance and quality 
    at the level of exfat utilities in windows. And this software is licensed 
    under the GNU General Public License Version 2.
third_party {
  url {
    type: GIT
    value: https://github.com/exfatprogs/exfatprogs/
  }
  version: 1.1.0
  last_upgrade_date { year: 2021 month: 4 day: 9 }
  license_type: RESTRICTED
}

https://android.googlesource.com/platform/external/dng_sdk/+/refs/heads/master/README.version

URL: http://download.adobe.com/pub/adobe/dng/dng_sdk_1_4.zip
Version: 1.4.0
License: BSD like License
License File: LICENSE
BugComponent: 174430
Owners: adaubert, floriank, yujieqin

These are key files:

karan-vaishnav commented 2 years ago

@pombredanne may I work on this issue??

pombredanne commented 2 years ago

Sure ! no need for permission

pombredanne commented 2 years ago

The first thing is to research and document here how licenses are documented, which data structures, conventions, specs and filenames.