search

aio-libs / aiohappyeyeballs

Happy Eyeballs for pre-resolved hosts
Other
11 stars 9 forks source link

LICENSE file contents raises tons of false warning on license scanners #89

Closed androiddrew closed 2 months ago

androiddrew commented 2 months ago

While I appreciate the history lesson in the LICENSE file it is raising a ton of issues with license scanners than are identifying this project as for example a CNRI Python 1.6 license code base. Would you consider moving this to something like a HISTORY OF THE SOFTWARE text file instead, and keep the contents of the license file to the text of the license (Python-2.0.1) that this specific code base adheres to?

androiddrew commented 2 months ago

We are using Trivy scanning. The error shows up because aiohappyeyeballs is now a dependency of aiohttp. 

Python (license)
================
Total: 1 (UNKNOWN: 1, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

┌──────────────────┬──────────────────────────────────────┬────────────────┬──────────┐
│     Package      │               License                │ Classification │ Severity │
├──────────────────┼──────────────────────────────────────┼────────────────┼──────────┤
│ aiohappyeyeballs │ Python License (CNRI Python License) │ unknown        │ UNKNOWN  │
└──────────────────┴──────────────────────────────────────┴────────────────┴──────────┘
androiddrew commented 2 months ago

Ok nevermind...that is literally the license that python is under, and they put the whole history in there. I guess I'll just be putting a general trivy exception and moving on.

Dreamsorcerer commented 2 months ago

I'm not sure why it'd be labelled as unknown, but it does look like it's the wrong license ID to me. According to this page, CNRI stopped being used around the release of Python 2, so it should refer to a PSF license now: https://docs.python.org/3/license.html