Is this a false positive? a long list of license ids in code that is license-related

[pombredanne]

This Go command line library references many licenses texts templates, but the tool itself is Apache-licensed. We detect also the licenses in the templates...
A tough case. Kinda like running license detection on ScanCode test files....

See https://github.com/spf13/cobra/blob/f368244301305f414206f889b1735a54cfc8bde8/cobra/cmd/licenses.go

[yahalom5776]

Interesting case but I would say: Not a false positive in the true sense of the word. The goal of the tool is to detect licenses (or license references). Those licenses are there. IMO the evaluation and assessment of the context should be a user task. My decision would be: Apache Software License 2 applies to the file, even though there are other licenses listed for functional reasons.

[pombredanne]

@yahalom5776 agreed. The difficulty and interesting part is if we can have heuristics to disambiguate this

[pombredanne]

For instance here there is a top level notice in a comment as is customary, then the other license texts and mentions are in literals not comments, a hint that these are a tad different

[yahalom5776]

@pombredanne I see your point, good idea. Another indicator could be the presence of > 3 full license texts (not references). That would point to some kind of license collection/notice file (which I would still like to see flagged in some way).

[pombredanne]

FWIW this is incorrectly mixing GPL and LGPL in the same notice https://github.com/spf13/cobra/blame/master/cobra/cmd/licenses.go#L449
And IMHO this promotes also creating many variants of licenses which is not a great thing in general... I should ping @spf13 some times or enter a ticket over there.
In all cases there is a truck load of things detected mostly correctly.

[spf13]

@pombredanne I'm a bit confused about what the context is. Is cobra doing something wrong?

[pombredanne]

@spf13 as you can see in https://github.com/spf13/cobra/blame/856b96dcb49d6427babe192998a35190a12c2230/cobra/cmd/licenses.go#L449 the GPL template is not entirely sure you should use the GPL or LGPL. The text contains this

You should have received a copy of the GNU Lesser General Public License

which would be for some LGPL notice, not a GPL afaik.

[pombredanne]

@spf13 that same GPL template injects the appName in the notice, which is not a problem per se, (it will still be detected alright by scancode) but is creating variants of notices for no good reason IMHO.
https://github.com/spf13/cobra/blame/master/cobra/cmd/licenses.go#L450

It could be just This program instead of an appName variable

Note that the LGPL issue and the appName comment also apply to your GPL 3.0 template: https://github.com/spf13/cobra/blame/master/cobra/cmd/licenses.go#L739

[spf13]

Thanks for noticing this and speaking up about it.

If you want to send me a PR with the correct changes, I'd gladly merge it.
I'd be worried I'd miss something and not fully solve the issue.

On Mon, Oct 24, 2016 at 12:08 PM Philippe Ombredanne <
notifications@github.com> wrote:

@spf13 https://github.com/spf13 that same GPL template injects the
appName in the notice, which is not a problem per se, (it will still be
detected alright by scancode) but is creating variants of notices for no
good reason IMHO.
https://github.com/spf13/cobra/blame/master/cobra/cmd/licenses.go#L450

It could be just This program instead of an appName variable

Note that the LGPL issue and the appName comment also apply to your GPL
3.0 template:
https://github.com/spf13/cobra/blame/master/cobra/cmd/licenses.go#L739

—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
#270 (comment),
or mute the thread
https://github.com/notifications/unsubscribe-auth/AAKlZEUvlQJDLDU2AoBPaGKdP4E6I2x-ks5q3NfygaJpZM4IlvEd
.

[pombredanne]

@spf13 Sure, i'll send a PR your way tomorrow.

[pombredanne]

@spf13 PR submitted: See spf13/cobra#356