Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

ScanCode SPDX license key contains invalid characters #2813

Closed
fviernau opened this issue Jan 25, 2022 · 4 comments
Closed

ScanCode SPDX license key contains invalid characters #2813

fviernau opened this issue Jan 25, 2022 · 4 comments
Labels
bug

Comments

@fviernau
Copy link
Contributor

fviernau commented Jan 25, 2022 •
edited
Loading

The SPDX license key LicenseRef-scancode-x11-xconsortium_veillard contains an _ which is not allowed according to [1][2], which says e.g. [3][4].

[1] https://github.com/spdx/spdx-spec/blob/development/v2.2.2/chapters/SPDX-license-expressions.md#d1-overview-
[2] https://github.com/spdx/spdx-spec/blob/development/v2.2.2/chapters/SPDX-license-expressions.md#d3-simple-license-expressions-
[3] idstring = 1*(ALPHA / DIGIT / "-" / "." )
[4] An SPDX user defined license reference: ["DocumentRef-"1*(idstring)":"]"LicenseRef-"1*(idstring)]
@fviernau fviernau added the bug label Jan 25, 2022
fviernau added a commit to oss-review-toolkit/ort that referenced this issue Jan 25, 2022
@fviernau
ScanCode: Gracefully handle underscores in ScanCode license keys
99654f9 
ScanCode may return SPDX license containing underscores characters which
is not allwed, see [1]. This results in ORT's scanner crashing due to an
SpdxException when it tries to parse the SPDX license key.

This issue has been first occured in 2020 and fixed by [2]. It got
re-introduced recently by [3].

Fix the issue based on the idea of the orignal fix [2]. The touched
function becomes less efficient. Delierately don't refactor for
efficiency because this fix can be reverted as soon as [3] is fixed.

[1] aboutcode-org/scancode-toolkit#2813
[2] fb0370f
[3] #4523

Signed-off-by: Frank Viernau <[email protected]>
@fviernau fviernau mentioned this issue Jan 25, 2022
Merged
fviernau added a commit to oss-review-toolkit/ort that referenced this issue Jan 25, 2022
@fviernau
ScanCode: Gracefully handle underscores in ScanCode license keys
a438d8f 
ScanCode may return SPDX license keys containing underscores characters
which is not allwed, see [1]. This results in ORT's scanner crashing
due to an SpdxException when it tries to parse the SPDX license key.

This issue has been first occured in 2020 and fixed by [2]. It got
re-introduced recently by [3].

Fix the issue based on the idea of the orignal fix [2]. The touched
function becomes less efficient. Delierately don't refactor for
efficiency because this fix can be reverted as soon as [3] is fixed.

[1] aboutcode-org/scancode-toolkit#2813
[2] fb0370f
[3] #4523

Signed-off-by: Frank Viernau <[email protected]>
fviernau added a commit to oss-review-toolkit/ort that referenced this issue Jan 25, 2022
@fviernau
ScanCode: Gracefully handle underscores in license keys
c1b3d3d 
ScanCode may return SPDX license keys containing underscores characters
which is not allwed, see [1]. This results in ORT's scanner crashing
due to an SpdxException when it tries to parse the SPDX license key.

This issue has been first occured in 2020 and fixed by [2]. It got
re-introduced recently by [3].

Fix the issue based on the idea of the orignal fix [2]. The touched
function becomes less efficient. Delierately don't refactor for
efficiency because this fix can be reverted as soon as [3] is fixed.

[1] aboutcode-org/scancode-toolkit#2813
[2] fb0370f
[3] #4523

Signed-off-by: Frank Viernau <[email protected]>
fviernau added a commit to oss-review-toolkit/ort that referenced this issue Jan 25, 2022
@fviernau
ScanCode: Gracefully handle underscores in license keys
7960410 
ScanCode may return SPDX license keys containing underscores characters
which is not allwed, see [1]. This results in ORT's scanner crashing
due to an SpdxException when it tries to parse the SPDX license key.

This issue has first occured in 2020 and been fixed by [2]. It got
re-introduced recently by [3].

Fix the issue based on the idea of the orignal fix [2]. The touched
function becomes less efficient. Delierately don't refactor for
efficiency because this fix can be reverted as soon as [3] is fixed.

[1] aboutcode-org/scancode-toolkit#2813
[2] fb0370f
[3] #4523

Signed-off-by: Frank Viernau <[email protected]>
fviernau added a commit to oss-review-toolkit/ort that referenced this issue Jan 25, 2022
@fviernau
ScanCode: Gracefully handle underscores in license keys
a1f916e 
ScanCode may return SPDX license keys containing underscores characters
which is not allwed, see [1]. This results in ORT's scanner crashing
due to an SpdxException when it tries to parse the SPDX license key.

This issue has first occured in 2020 and been fixed by [2]. It got
re-introduced recently by [3].

Fix the issue based on the idea of the orignal fix [2]. The touched
function becomes a bit less efficient which is not an issue for the current
callers / use cases. However, a consequtive look-up of many license
texts would probably more efficient if the files in the directories were
listed only once.

[1] aboutcode-org/scancode-toolkit#2813
[2] fb0370f
[3] #4523

Signed-off-by: Frank Viernau <[email protected]>
fviernau added a commit to oss-review-toolkit/ort that referenced this issue Jan 25, 2022
@fviernau
ScanCode: Work around an underscore in a SPDX license key
7053b33 
ScanCode has one SPDX license key containing an underscore characters
which is not allwed, see [1]. This results in ORT's scanner crashing
due to an SpdxException when it tries to parse the SPDX license key.

This issue has first occured in 2020 and been fixed by [2]. It got
re-introduced recently by [3].

Deliberatly don't fix the general problem with underscores in
`getLicenseTextFile()` in favor of a license ID specific work around,
because this can be implemented efficiently without doing a refactoring
first.

[1] aboutcode-org/scancode-toolkit#2813
[2] fb0370f
[3] #4523

Signed-off-by: Frank Viernau <[email protected]>
fviernau added a commit to oss-review-toolkit/ort that referenced this issue Jan 25, 2022
@fviernau
ScanCode: Work around an underscore in a SPDX license key
45acfe1 
ScanCode has one SPDX license key containing an underscore characters
which is not allwed, see [1]. This results in ORT's scanner crashing
due to an SpdxException when it tries to parse the SPDX license key.

This issue has first occured in 2020 and been fixed by [2]. It got
re-introduced recently by [3].

Deliberatly don't fix the general problem with underscores in
`getLicenseTextFile()` in favor of a license ID specific work around,
because this can be implemented efficiently without doing a refactoring
first.

[1] aboutcode-org/scancode-toolkit#2813
[2] fb0370f
[3] #4523

Signed-off-by: Frank Viernau <[email protected]>
fviernau added a commit to oss-review-toolkit/ort that referenced this issue Jan 25, 2022
@fviernau
ScanCode: Work around an underscore in a SPDX license key
45d20a3 
ScanCode has one SPDX license key containing an underscore characters
which is not allwed, see [1]. This results in ORT's scanner crashing
due to an SpdxException when it tries to parse the SPDX license key.

This issue has first occured in 2020 and been fixed by [2]. It got
re-introduced recently by [3].

Deliberatly don't fix the general problem with underscores in
`getLicenseTextFile()` in favor of a license ID specific work around,
because this can be implemented efficiently without doing a refactoring
first.

[1] aboutcode-org/scancode-toolkit#2813
[2] fb0370f
[3] #4523

Signed-off-by: Frank Viernau <[email protected]>
@pombredanne
Copy link
Member

pombredanne commented Jan 26, 2022 •
edited
Loading

@fviernau Good catch! @DennisClark IMHO we should no longer use underscore in license keys and validate this.
the only license is "x11-xconsortium_veillard" that we can deprecate and rename with a dash?

@DennisClark
Copy link
Member

@pombredanne I can fix x11-xconsortium_veillard in my license list. will do it soon

pombredanne added a commit that referenced this issue Feb 8, 2022
@pombredanne
Rename license key
4ddc974 
x11-xconsortium_veillard was using an underscore which is not SPDX
friendly and is now deprecated. x11-xconsortium-veillard is the new
key

Reference: #2813
Reported-by: Frank Viernau <[email protected]>
Signed-off-by: Philippe Ombredanne <[email protected]>
@sschuberth
Copy link
Collaborator

Has this been actually fixed?

@pombredanne
Copy link
Member

@sschuberth yes, in 4ddc974 and in all versions since v31.0.0 ... and we have a check to ensure this does not happen again

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@sschuberth @pombredanne @DennisClark @fviernau