cashapp / licensee

Gradle plugin which validates the licenses of your dependency graph match what you expect
https://cashapp.github.io/licensee/docs/1.x/
Apache License 2.0
626 stars 29 forks source link

MIT-0 license not recognized anymore #97

Closed gabrielittner closed 2 years ago

gabrielittner commented 2 years ago

I've got a library with this license in their pom (in particular reactive-streams):

  <licenses>
    <license>
      <name>MIT-0</name>
      <url>https://spdx.org/licenses/MIT-0.html</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

Since 1.4.0 this will fail with the following error even if we have allow("MIT-0") set

ERROR: Unknown license URL 'https://spdx.org/licenses/MIT-0.html' is NOT allowed

The allowed identifier is also reported as unused.

The url does appear in licenses.json:

    {
      "reference": "https://spdx.org/licenses/MIT-0.html",
      "isDeprecatedLicenseId": false,
      "detailsUrl": "https://spdx.org/licenses/MIT-0.json",
      "referenceNumber": 439,
      "name": "MIT No Attribution",
      "licenseId": "MIT-0",
      "seeAlso": [
        "https://github.com/aws/mit-0",
        "https://romanrm.net/mit-zero",
        "https://github.com/awsdocs/aws-cloud9-user-guide/blob/master/LICENSE-SAMPLECODE"
      ],
      "isOsiApproved": true
    },

I think the issue might be that detailsUrl which is used in code (as spdxUrl) now contains the .json url and not the .html url. Before the file was re-generated in #90 it was the other way around. If this is the case I'm not sure why other licenses like Apache-2.0 are not affected.

JakeWharton commented 2 years ago

Thanks. Released fix as 1.4.1. I suspect Apache isn't affected because it has so many fallback URLs that we add in code.

gabrielittner commented 2 years ago

Thanks for fixing it so quickly