Skip to content

Commit ee32157

Browse files
alexzurbonsenalexzurbonsen
committed
Fix bug in any and all conditions
Due to wrong handling of any and all functions license matches are categorized as having full relevance or copyrights, even if they do not. This leads to a regression in false positive detection. Correct the any and all conditions to correctly detect copyrights and relevance. Signed-off-by: alexzurbonsen <[email protected]>
1 parent c40476a commit ee32157

File tree

2 files changed

+92
-141
lines changed

2 files changed

+92
-141
lines changed

‎src/licensedcode/detection.py

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1166,26 +1166,22 @@ def is_false_positive(license_matches, package_license=False):
11661166
# FIXME: actually run copyright detection here?
11671167
copyright_words = ["copyright", "(c)"]
11681168
has_copyrights = all(
1169-
True
1170-
for license_match in license_matches
1171-
if any(
1172-
True
1169+
any(
1170+
word in license_match.matched_text().lower()
11731171
for word in copyright_words
1174-
if word in license_match.matched_text().lower()
1175-
)
1172+
)
1173+
for license_match in license_matches
11761174
)
11771175
has_full_relevance = all(
1178-
True
1176+
license_match.rule.relevance == 100
11791177
for license_match in license_matches
1180-
if license_match.rule.relevance == 100
11811178
)
11821179
if has_copyrights or has_full_relevance:
11831180
return False
11841181

11851182
has_low_relevance = all(
1186-
True
1183+
license_match.rule.relevance < 60
11871184
for license_match in license_matches
1188-
if license_match.rule.relevance < 60
11891185
)
11901186

11911187
start_line_region = min(

‎tests/licensedcode/data/plugin_license/scan/ffmpeg-license.expected.json

Lines changed: 86 additions & 131 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,41 @@
11
{
2+
"headers": [
3+
{
4+
"tool_name": "scancode-toolkit",
5+
"tool_version": "v32.3.0-17-g35029f3b77",
6+
"options": {
7+
"input": [
8+
"tests/licensedcode/data/plugin_license/scan/ffmpeg-LICENSE.md"
9+
],
10+
"--json": "scancode_test.json",
11+
"--license": true,
12+
"--license-diagnostics": true,
13+
"--license-text": true,
14+
"--license-text-diagnostics": true,
15+
"--strip-root": true,
16+
"--verbose": true
17+
},
18+
"notice": "Generated with ScanCode and provided on an \"AS IS\" BASIS, WITHOUT WARRANTIES\nOR CONDITIONS OF ANY KIND, either express or implied. No content created from\nScanCode should be considered or used as legal advice. Consult an Attorney\nfor any legal advice.\nScanCode is a free software code scanning tool from nexB Inc. and others.\nVisit https://github.com/nexB/scancode-toolkit/ for support and download.",
19+
"start_timestamp": "2024-12-10T164908.294977",
20+
"end_timestamp": "2024-12-10T164912.937268",
21+
"output_format_version": "4.0.0",
22+
"duration": 4.642332077026367,
23+
"message": null,
24+
"errors": [],
25+
"warnings": [],
26+
"extra_data": {
27+
"system_environment": {
28+
"operating_system": "mac",
29+
"cpu_architecture": "64",
30+
"platform": "macOS-15.1.1-x86_64-i386-64bit",
31+
"platform_version": "Darwin Kernel Version 24.1.0: Thu Oct 10 21:05:23 PDT 2024; root:xnu-11215.41.3~2/RELEASE_ARM64_T6031",
32+
"python_version": "3.12.5 (main, Nov 18 2024, 22:55:02) [Clang 15.0.0 (clang-1500.0.40.1)]"
33+
},
34+
"spdx_license_list_version": "3.25",
35+
"files_count": 1
36+
}
37+
}
38+
],
239
"license_detections": [
340
{
441
"identifier": "gpl_1_0_plus-0211bbc4-784e-97fe-2ac1-f150ccba866e",
@@ -82,47 +119,6 @@
82119
}
83120
]
84121
},
85-
{
86-
"identifier": "gpl_2_0_and_lgpl_2_0_plus-e597690d-3d55-0948-8697-914f460389e8",
87-
"license_expression": "gpl-2.0 AND lgpl-2.0-plus",
88-
"license_expression_spdx": "GPL-2.0-only AND LGPL-2.0-or-later",
89-
"detection_count": 1,
90-
"detection_log": [],
91-
"reference_matches": [
92-
{
93-
"license_expression": "gpl-2.0",
94-
"license_expression_spdx": "GPL-2.0-only",
95-
"from_file": "ffmpeg-LICENSE.md",
96-
"start_line": 100,
97-
"end_line": 100,
98-
"matcher": "2-aho",
99-
"score": 100.0,
100-
"matched_length": 1,
101-
"match_coverage": 100.0,
102-
"rule_relevance": 100,
103-
"rule_identifier": "gpl-2.0_bare_single_word.RULE",
104-
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/gpl-2.0_bare_single_word.RULE",
105-
"matched_text": "are incompatible with the GPLv2 and v3. We do not know for certain if their",
106-
"matched_text_diagnostics": "GPLv2"
107-
},
108-
{
109-
"license_expression": "lgpl-2.0-plus",
110-
"license_expression_spdx": "LGPL-2.0-or-later",
111-
"from_file": "ffmpeg-LICENSE.md",
112-
"start_line": 101,
113-
"end_line": 101,
114-
"matcher": "2-aho",
115-
"score": 60.0,
116-
"matched_length": 1,
117-
"match_coverage": 100.0,
118-
"rule_relevance": 60,
119-
"rule_identifier": "lgpl_bare_single_word.RULE",
120-
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl_bare_single_word.RULE",
121-
"matched_text": "licenses are compatible with the LGPL.",
122-
"matched_text_diagnostics": "LGPL."
123-
}
124-
]
125-
},
126122
{
127123
"identifier": "ijg_and_mit-e50613dc-8a09-65cc-c498-5d9527795382",
128124
"license_expression": "ijg AND mit",
@@ -182,31 +178,6 @@
182178
}
183179
]
184180
},
185-
{
186-
"identifier": "lgpl_2_0_plus-e66c5b24-33ce-ea1b-0e3b-28952361ec32",
187-
"license_expression": "lgpl-2.0-plus",
188-
"license_expression_spdx": "LGPL-2.0-or-later",
189-
"detection_count": 1,
190-
"detection_log": [],
191-
"reference_matches": [
192-
{
193-
"license_expression": "lgpl-2.0-plus",
194-
"license_expression_spdx": "LGPL-2.0-or-later",
195-
"from_file": "ffmpeg-LICENSE.md",
196-
"start_line": 104,
197-
"end_line": 104,
198-
"matcher": "2-aho",
199-
"score": 60.0,
200-
"matched_length": 1,
201-
"match_coverage": 100.0,
202-
"rule_relevance": 60,
203-
"rule_identifier": "lgpl_bare_single_word.RULE",
204-
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl_bare_single_word.RULE",
205-
"matched_text": "be under a complex license mix that is more restrictive than the LGPL and that",
206-
"matched_text_diagnostics": "LGPL"
207-
}
208-
]
209-
},
210181
{
211182
"identifier": "lgpl_2_1_plus_and_other_permissive_and_gpl_2_0_plus-666058ef-8c38-3b17-d8e7-448b304de833",
212183
"license_expression": "lgpl-2.1-plus AND other-permissive AND gpl-2.0-plus",
@@ -294,8 +265,8 @@
294265
{
295266
"path": "ffmpeg-LICENSE.md",
296267
"type": "file",
297-
"detected_license_expression": "(lgpl-2.1-plus AND other-permissive AND gpl-2.0-plus) AND (lgpl-3.0 AND lgpl-3.0-plus AND (lgpl-3.0 AND gpl-3.0)) AND (ijg AND mit) AND gpl-1.0-plus AND (gpl-2.0 AND apache-2.0 AND lgpl-3.0-plus) AND (gpl-2.0 AND lgpl-2.0-plus) AND lgpl-2.0-plus",
298-
"detected_license_expression_spdx": "(LGPL-2.1-or-later AND LicenseRef-scancode-other-permissive AND GPL-2.0-or-later) AND (LGPL-3.0-only AND LGPL-3.0-or-later AND (LGPL-3.0-only AND GPL-3.0-only)) AND (IJG AND MIT) AND GPL-1.0-or-later AND (GPL-2.0-only AND Apache-2.0 AND LGPL-3.0-or-later) AND (GPL-2.0-only AND LGPL-2.0-or-later) AND LGPL-2.0-or-later",
268+
"detected_license_expression": "(lgpl-2.1-plus AND other-permissive AND gpl-2.0-plus) AND (lgpl-3.0 AND lgpl-3.0-plus AND (lgpl-3.0 AND gpl-3.0)) AND (ijg AND mit) AND gpl-1.0-plus AND (gpl-2.0 AND apache-2.0 AND lgpl-3.0-plus)",
269+
"detected_license_expression_spdx": "(LGPL-2.1-or-later AND LicenseRef-scancode-other-permissive AND GPL-2.0-or-later) AND (LGPL-3.0-only AND LGPL-3.0-or-later AND (LGPL-3.0-only AND GPL-3.0-only)) AND (IJG AND MIT) AND GPL-1.0-or-later AND (GPL-2.0-only AND Apache-2.0 AND LGPL-3.0-or-later)",
299270
"license_detections": [
300271
{
301272
"license_expression": "lgpl-2.1-plus AND other-permissive AND gpl-2.0-plus",
@@ -514,73 +485,41 @@
514485
],
515486
"detection_log": [],
516487
"identifier": "gpl_2_0_and_apache_2_0_and_lgpl_3_0_plus-c2393e5a-e531-304f-58a9-a6431d46d214"
517-
},
488+
}
489+
],
490+
"license_clues": [
518491
{
519-
"license_expression": "gpl-2.0 AND lgpl-2.0-plus",
520-
"license_expression_spdx": "GPL-2.0-only AND LGPL-2.0-or-later",
521-
"matches": [
522-
{
523-
"license_expression": "gpl-2.0",
524-
"license_expression_spdx": "GPL-2.0-only",
525-
"from_file": "ffmpeg-LICENSE.md",
526-
"start_line": 100,
527-
"end_line": 100,
528-
"matcher": "2-aho",
529-
"score": 100.0,
530-
"matched_length": 1,
531-
"match_coverage": 100.0,
532-
"rule_relevance": 100,
533-
"rule_identifier": "gpl-2.0_bare_single_word.RULE",
534-
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/gpl-2.0_bare_single_word.RULE",
535-
"matched_text": "are incompatible with the GPLv2 and v3. We do not know for certain if their",
536-
"matched_text_diagnostics": "GPLv2"
537-
},
538-
{
539-
"license_expression": "lgpl-2.0-plus",
540-
"license_expression_spdx": "LGPL-2.0-or-later",
541-
"from_file": "ffmpeg-LICENSE.md",
542-
"start_line": 101,
543-
"end_line": 101,
544-
"matcher": "2-aho",
545-
"score": 60.0,
546-
"matched_length": 1,
547-
"match_coverage": 100.0,
548-
"rule_relevance": 60,
549-
"rule_identifier": "lgpl_bare_single_word.RULE",
550-
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl_bare_single_word.RULE",
551-
"matched_text": "licenses are compatible with the LGPL.",
552-
"matched_text_diagnostics": "LGPL."
553-
}
554-
],
555-
"detection_log": [],
556-
"identifier": "gpl_2_0_and_lgpl_2_0_plus-e597690d-3d55-0948-8697-914f460389e8"
492+
"license_expression": "gpl-2.0",
493+
"license_expression_spdx": "GPL-2.0-only",
494+
"from_file": "ffmpeg-LICENSE.md",
495+
"start_line": 100,
496+
"end_line": 100,
497+
"matcher": "2-aho",
498+
"score": 100.0,
499+
"matched_length": 1,
500+
"match_coverage": 100.0,
501+
"rule_relevance": 100,
502+
"rule_identifier": "gpl-2.0_bare_single_word.RULE",
503+
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/gpl-2.0_bare_single_word.RULE",
504+
"matched_text": "are incompatible with the GPLv2 and v3. We do not know for certain if their",
505+
"matched_text_diagnostics": "GPLv2"
557506
},
558507
{
559508
"license_expression": "lgpl-2.0-plus",
560509
"license_expression_spdx": "LGPL-2.0-or-later",
561-
"matches": [
562-
{
563-
"license_expression": "lgpl-2.0-plus",
564-
"license_expression_spdx": "LGPL-2.0-or-later",
565-
"from_file": "ffmpeg-LICENSE.md",
566-
"start_line": 104,
567-
"end_line": 104,
568-
"matcher": "2-aho",
569-
"score": 60.0,
570-
"matched_length": 1,
571-
"match_coverage": 100.0,
572-
"rule_relevance": 60,
573-
"rule_identifier": "lgpl_bare_single_word.RULE",
574-
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl_bare_single_word.RULE",
575-
"matched_text": "be under a complex license mix that is more restrictive than the LGPL and that",
576-
"matched_text_diagnostics": "LGPL"
577-
}
578-
],
579-
"detection_log": [],
580-
"identifier": "lgpl_2_0_plus-e66c5b24-33ce-ea1b-0e3b-28952361ec32"
581-
}
582-
],
583-
"license_clues": [
510+
"from_file": "ffmpeg-LICENSE.md",
511+
"start_line": 101,
512+
"end_line": 101,
513+
"matcher": "2-aho",
514+
"score": 60.0,
515+
"matched_length": 1,
516+
"match_coverage": 100.0,
517+
"rule_relevance": 60,
518+
"rule_identifier": "lgpl_bare_single_word.RULE",
519+
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl_bare_single_word.RULE",
520+
"matched_text": "licenses are compatible with the LGPL.",
521+
"matched_text_diagnostics": "LGPL."
522+
},
584523
{
585524
"license_expression": "proprietary-license",
586525
"license_expression_spdx": "LicenseRef-scancode-proprietary-license",
@@ -596,10 +535,26 @@
596535
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/proprietary-license_490.RULE",
597536
"matched_text": "If you wish to enable these libraries, pass --enable-nonfree to configure.",
598537
"matched_text_diagnostics": "enable-nonfree"
538+
},
539+
{
540+
"license_expression": "lgpl-2.0-plus",
541+
"license_expression_spdx": "LGPL-2.0-or-later",
542+
"from_file": "ffmpeg-LICENSE.md",
543+
"start_line": 104,
544+
"end_line": 104,
545+
"matcher": "2-aho",
546+
"score": 60.0,
547+
"matched_length": 1,
548+
"match_coverage": 100.0,
549+
"rule_relevance": 60,
550+
"rule_identifier": "lgpl_bare_single_word.RULE",
551+
"rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl_bare_single_word.RULE",
552+
"matched_text": "be under a complex license mix that is more restrictive than the LGPL and that",
553+
"matched_text_diagnostics": "LGPL"
599554
}
600555
],
601556
"percentage_of_license_text": 34.78,
602557
"scan_errors": []
603558
}
604559
]
605-
}
560+
}

0 commit comments

Comments
 (0)