Often debian copyright files are not updated and has inconsistencies where the license declared in the copyright file is different from the license present in the files itself.
This creates wrong licensing information when reporting the license based on parsing the debian copyright file only, and scanning the files would be the only way where correct license is detected.
An example (also #2555 ):
For the debian copyright file for util-linux package:
https://metadata.ftp-master.debian.org/changelogs//main/u/util-linux/util-linux_2.36.1-7_copyright
-
The copyright file has a License paragraph with License: BSD-2-clause at line 402,
with a license paragraph which is not the license text for BSD-2-clause
(https://spdx.org/licenses/BSD-2-Clause.html), but only the 2 clauses
(mentioning the disclaimer) without the disclaimer.
-
The files refer to the license License: BSD-2-clause in the Files Paragraph, are:
text-utils/pg.clogin-utils/last-deprecated.clogin-utils/login.c
But, they have different licenses in them, which is not consistent to what is reported
in the copyright file.
The license text in the file text-utils/pg.c is BSD-3-clause.
The license text in the file login-utils/login.c is https://scancode-licensedb.aboutcode.org/bsla.html.
The file login-utils/last-deprecated.c is not present anywhere, and the login-utils/last.c
has a gpl-2.0-plus license text.
There are also other bugs reported for this package with inconsistencies: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987944.
Often debian copyright files are not updated and has inconsistencies where the license declared in the copyright file is different from the license present in the files itself.
This creates wrong licensing information when reporting the license based on parsing the debian copyright file only, and scanning the files would be the only way where correct license is detected.
An example (also #2555 ):
For the debian copyright file for
util-linuxpackage:https://metadata.ftp-master.debian.org/changelogs//main/u/util-linux/util-linux_2.36.1-7_copyright
The copyright file has a License paragraph with
License: BSD-2-clauseat line 402,with a license paragraph which is not the license text for
BSD-2-clause(https://spdx.org/licenses/BSD-2-Clause.html), but only the 2 clauses
(mentioning the disclaimer) without the disclaimer.
The files refer to the license
License: BSD-2-clausein the Files Paragraph, are:text-utils/pg.clogin-utils/last-deprecated.clogin-utils/login.cBut, they have different licenses in them, which is not consistent to what is reported
in the copyright file.
The license text in the file
text-utils/pg.cis BSD-3-clause.The license text in the file
login-utils/login.cis https://scancode-licensedb.aboutcode.org/bsla.html.The file
login-utils/last-deprecated.cis not present anywhere, and thelogin-utils/last.chas a
gpl-2.0-pluslicense text.There are also other bugs reported for this package with inconsistencies: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987944.