-
Notifications
You must be signed in to change notification settings - Fork 510
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
BUG: License LGPL-2.1-only not discovered #3869
Comments
We currently rely on GitHub for license detection, and they don't seem to recognize it. https://api.github.com/repos/intel/ad-rss-lib
Although it should be within our ability to parse SPDX IDs, if present. Assuming that gets fixed (either on GitHub or our end), we'd need to update our list of FSF or OSI licenses. As scorecard/checks/raw/license.go Lines 418 to 419 in 6fc7d4c
Or, on the Scorecard Action side, we really shouldn't be complaining about that last 1 point: |
Hi, |
@berndgassmann unrelated to licensee/licensee#631. The reason https://github.com/intel/ad-rss-lib/blob/98991d6e5e51823c90b3d37a2fbb08cab360b37b/LICENSE can't be identified as LGPL-2.1 is due to differences in the text there (at a glance, prepended text and removal of the preamble) and the expected license text. |
@mlinksva Thank you very much for the support. The SPDX I had added recently in the hope that this will work out. Now I've copied the license code including preamble and now it's detected as valid license. |
You should consider using a proper license detection tool, like scancode. But here the text was seriously damaged. |
Describe the bug
The license of our project LGPL-2.1-only seems not be recognized correctly; neither as FSF nor OSI.
Reproduction steps
see:
https://github.com/intel/ad-rss-lib/security/code-scanning/76
also a renaming of LICENSE file into LICENSE-LGPL-2.1-only didn't work
intel/ad-rss-lib@1ffcf5a
nor adding the SPDX-License-Identifier: LGPL-2.1-only into the file:
intel/ad-rss-lib@7258946
Expected behavior
License score of 10 is expected instead of 9.
Additional context
Maybe your current setup only recognizes the LGPL-2.1, but LGPL-2.1-only as well as LGPL-2.1-or-later should both be detected as well.
The text was updated successfully, but these errors were encountered: