Skip to content

MISDETECTION: AGPL detected when it isn't there #3498

Closed
@eclipseo

Description

@eclipseo

So the test file is: https://github.com/musescore/MuseScore/blob/v4.1.1/src/engraving/tests/earlymusic_tests.cpp

We have this header:


/*
 * SPDX-License-Identifier: GPL-3.0-only
 * MuseScore-CLA-applies
 *
 * MuseScore
 * Music Composition & Notation
 *
 * Copyright (C) 2021 MuseScore BVBA and others
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 3 as
 * published by the Free Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

So clearly GPL-3.0-only, no Affero mention.

Yet scancode detects AGPL:

$ scancode -l --license-text --license-text-diagnostics --yaml error.yml earlymusic_tests.cpp

headers:
    -   tool_name: scancode-toolkit
        tool_version: 32.0.6
        options:
            input:
                - earlymusic_tests.cpp
            --license: yes
            --license-text: yes
            --license-text-diagnostics: yes
            --yaml: error.yml
        notice: |
            Generated with ScanCode and provided on an "AS IS" BASIS, WITHOUT WARRANTIES
            OR CONDITIONS OF ANY KIND, either express or implied. No content created from
            ScanCode should be considered or used as legal advice. Consult an Attorney
            for any legal advice.
            ScanCode is a free software code scanning tool from nexB Inc. and others.
            Visit https://github.com/nexB/scancode-toolkit/ for support and download.
        start_timestamp: '2023-08-27T093727.073219'
        end_timestamp: '2023-08-27T093729.532009'
        output_format_version: 3.0.0
        duration: '2.4588000774383545'
        message:
        errors: []
        warnings: []
        extra_data:
            system_environment:
                operating_system: linux
                cpu_architecture: 64
                platform: Linux-6.4.12-200.fc38.x86_64-x86_64-with-glibc2.37
                platform_version: '#1 SMP PREEMPT_DYNAMIC Wed Aug 23 17:46:49 UTC 2023'
                python_version: 3.11.4 (main, Jun  7 2023, 00:00:00) [GCC 13.1.1 20230511 (Red
                    Hat 13.1.1-2)]
            spdx_license_list_version: '3.21'
            files_count: 1
license_detections:
    -   identifier: agpl_3_0-967ffab1-f048-3b39-0818-43164ae0ef14
        license_expression: agpl-3.0
        detection_count: 1
    -   identifier: gpl_3_0-719c88c2-9a23-63ec-d04b-bad43848259a
        license_expression: gpl-3.0
        detection_count: 1
files:
    -   path: earlymusic_tests.cpp
        type: file
        detected_license_expression: gpl-3.0 AND agpl-3.0
        detected_license_expression_spdx: GPL-3.0-only AND AGPL-3.0-only
        license_detections:
            -   license_expression: gpl-3.0
                matches:
                    -   score: '100.0'
                        start_line: 2
                        end_line: 2
                        matched_length: 7
                        match_coverage: '100.0'
                        matcher: 1-spdx-id
                        license_expression: gpl-3.0
                        rule_identifier: spdx-license-identifier-gpl-3.0-58119ea41dd798a10319f81b69729c8b2845ad64
                        rule_relevance: 100
                        rule_url:
                        matched_text: 'SPDX-License-Identifier: GPL-3.0-only'
                identifier: gpl_3_0-719c88c2-9a23-63ec-d04b-bad43848259a
            -   license_expression: agpl-3.0
                matches:
                    -   score: '96.81'
                        start_line: 10
                        end_line: 20
                        matched_length: 91
                        match_coverage: '96.81'
                        matcher: 3-seq
                        license_expression: agpl-3.0
                        rule_identifier: agpl-3.0_348.RULE
                        rule_relevance: 100
                        rule_url: https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/agpl-3.0_348.RULE
                        matched_text: |
                            This program is free software: you can redistribute it and/or modify
                             * it under the terms of the GNU General Public License version 3 as
                             * published by the Free Software Foundation.
                             *
                             * This program is distributed in the hope that it will be useful,
                             * but WITHOUT ANY WARRANTY; without even the implied warranty of
                             * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
                             * GNU General Public License for more details.
                             *
                             * You should have received a copy of the GNU General Public License
                             * along with this program.  If not, see <https://www.gnu.org/licenses/>.
                identifier: agpl_3_0-967ffab1-f048-3b39-0818-43164ae0ef14
        license_clues: []
        percentage_of_license_text: '22.53'
        scan_errors: []

If we check the rule: https://github.com/nexB/scancode-toolkit/raw/develop/src/licensedcode/data/rules/agpl-3.0_348.RULE

---
license_expression: agpl-3.0
is_license_notice: yes
relevance: 100
ignorable_urls:
    - https://www.gnu.org/licenses/
---

This program is free software: you can redistribute it and/or  modify
it under the terms of the GNU Affero General Public License, version 3,
as published by the Free Software Foundation.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program.  If not, see <https://www.gnu.org/licenses/>.

Yes this is close, but the keyword here is "Affero". If there is not this keyword, it shouldn't be detected as such.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions