Scancode mistakes Apache 2.0 for Nokia Open Source License 1.0a

[MartinPetkov]

Description

ScanCode version 3.0.2 mistakes an Apache 2.0 license header for Nokia Open Source License 1.0a.

To reproduce:

$ pip install scancode-toolkit==3.0.2
$ wget https://raw.githubusercontent.com/vmware/photon-controller-go-sdk/4fac3e765be249eaa45bd67222b1561d2f3286a1/photon/apitypes.go
$ scancode --license --license-text --json-pp - apitypes.go
Setup plugins...
Collect file inventory...
Scan files for: licenses with 1 process(es)...
[####################] 1                     
{
  "headers": [
    {
      "tool_name": "scancode-toolkit",
      "tool_version": "3.0.2",
      "options": {
        "input": "apitypes.go",
        "--json-pp": "-",
        "--license": true,
        "--license-text": true
      },
      "notice": "Generated with ScanCode and provided on an \"AS IS\" BASIS, WITHOUT WARRANTIES\nOR CONDITIONS OF ANY KIND, either express or implied. No content created from\nScanCode should be considered or used as legal advice. Consult an Attorney\nfor any legal advice.\nScanCode is a free software code scanning tool from nexB Inc. and others.\nVisit https://github.com/nexB/scancode-toolkit/ for support and download.",
      "start_timestamp": "2019-03-26T013719.141840",
      "end_timestamp": "2019-03-26T013722.362145",
      "message": null,
      "errors": [],
      "extra_data": {
        "files_count": 1
      }
    }
  ],
  "files": [
    {
      "path": "apitypes.go",
      "type": "file",
      "licenses": [
        {
          "key": "nokos-1.0a",
          "score": 57.14,
          "name": "Nokia Open Source License 1.0a",
          "short_name": "NOKOS License 1.0a",
          "category": "Copyleft Limited",
          "is_exception": false,
          "owner": "Nokia",
          "homepage_url": "http://www.opensource.org/licenses/nokia.html",
          "text_url": "http://www.opensource.org/licenses/nokia.html",
          "reference_url": "https://enterprise.dejacode.com/urn/urn:dje:license:nokos-1.0a",
          "spdx_license_key": "Nokia",
          "spdx_url": "https://spdx.org/licenses/Nokia",
          "start_line": 3,
          "end_line": 4,
          "matched_rule": {
            "identifier": "nokos-1.0a_5.RULE",
            "license_expression": "nokos-1.0a",
            "licenses": [
              "nokos-1.0a"
            ],
            "is_license_text": false,
            "is_license_notice": true,
            "is_license_reference": false,
            "is_license_tag": false
          },
          "matched_text": "License, Version [2].0 (the \"License\").\n// You may not use this [product] except in compliance with the License."
        }
      ],
      "license_expressions": [
        "nokos-1.0a"
      ],
      "scan_errors": []
    }
  ]
}

Looking at the header of the file:

// Copyright (c) 2016 VMware, Inc. All Rights Reserved.
//
// This product is licensed to you under the Apache License, Version 2.0 (the "License").
// You may not use this product except in compliance with the License.
//
// This product may include a number of subcomponents with separate copyright notices and
// license terms. Your use of these subcomponents is subject to the terms and conditions
// of the subcomponent's license, as noted in the LICENSE file.

This should clearly be identified as Apache 2.0. The line // You may not use... seems to be confusing the parser, since removing it correctly gives Apache 2.0 as the only finding.

System configuration

For bug reports, it really helps us to know:

• What OS are you running on? (Windows/MacOS/Linux)
  Linux, Debian.

• What version of scancode-toolkit was used to generate the scan file?
  scancode-toolkit==3.0.2

• What installation method was used to install/run scancode? (pip/source download/other)
  pip install scancode-toolkit==3.0.2 in a Python 2 virtualenv.

[pombredanne]

Thanks for this detailed report! The Nokos license is a rare bird that's seldom seen in use alright. And this header is rather peculiar. I am fixing this simply by adding a new rule.

[pombredanne]

This has been merged in develop. Thank you++