search

aboutcode-org / scancode-toolkit

:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase, the Google Summer of Code, Azure credits, nexB and others generous sponsors!
https://github.com/aboutcode-org/scancode-toolkit/releases/
2.11k stars 545 forks source link

A couple of incorrect detections found in ScanCode 31.2.4 #3613

Open fviernau opened 11 months ago

fviernau commented 11 months ago

Reproduce:

Scan the following text locations with ScanCode 31.2.4:

Incorrect detection Text location
GPL-2.0-only AND LicenseRef-scancode-proprietary-license https://github.com/PrismJS/prism/blob/703881e14bf7530b180fad6052e535d0085315cd/prism.js#L19
MIT OR CECILL-C https://github.com/kpdecker/jsdiff/blame/3b654c2ed7d5262ed9946de841ad8dae990286c7/README.md#L209-L211
LicenseRef-scancode-st-mcd-2.0 AND CC-BY-SA-3.0 https://github.com/vfile/vfile/blob/5d3c0de9529e4b0dd45cd7c2d9919b95e169eab9/lib/minpath.browser.js#L1-L5
LicenseRef-scancode-unknown https://github.com/huggingface/transformers/blob/d6392482bd8af0d28903b5531ed04bd7273931a3/src/transformers/modelcard.py#L636
Aladdin https://github.com/nltk/nltk/blob/00de04bdf94ede9969eca6434584dd9245ff0157/nltk/lazyimport.py#L2
pombredanne commented 10 months ago

Thanks for the report!

fviernau commented 9 months ago

@pombredanne are you fine if I keep on extending this list until this issue gets picked up?

AyanSinhaMahapatra commented 9 months ago

@fviernau thanks++ for the reports! I've added fixes for all the issues mentioned here (some were fixed previously, this is an old version) see commit above. We will see less of these kind of bugs in future as we're working on automatic required phrase detection and addition for all our license rules and using required phrases more in our detection algorithm.

See scan results below for the same:

nltk-lazyimport.scan-results.json prism-master-scan-results.json jsdiff-scan-results.json vfile-scan-results.json huggingface-modelcard-scan-results.json

are you fine if I keep on extending this list until this issue gets picked up?

Since these are fixed, starting new issues would be best, but if you choose to add here, we have to mark the ones solved clearly and also please add a comment when a new issue has been edited into this, so we are notified.

fviernau commented 9 months ago

@fviernau thanks++ for the reports! I've added fixes for all the issues mentioned here (some were fixed previously, this is an old version) see commit above.

Amazing, thanks for the fixes!

Since these are fixed, starting new issues would be best,

Sure, I'll create a new ticket once I have new issues.