Design how to report a summary of ambiguous license and package detections

[pombredanne]

We have some dangling amd biguous clues that are not parts of top level "Packages" or upcoming license "Detection" and similar.
We should have a way to report these at the top level with a new CLI option such that this becomes items that need review

[AyanSinhaMahapatra]

The following design is proposed:

review:

    packages:

        - detection_id: package#1
          detection:
            purl:
            detection_log:
            package_data:
        
        - detection_id: package#2
          detection:
            purl:
            detection_log:
            declared_license_expression:
    
    licenses:

        - detection_id: license#1
          detection:
            license_expression:
            detection_log:
            matches:
        
        - detection_id: package#2
          detection:
            license_expression:
            detection_log:
            matches:

This will be a codebase level attribute review which will be added on using the --review CLI option with scancode-toolkit.

The following cases are examples of reviewable detections:

licenses:

• extra words
• false positive
• license clues
• undetected license (in packages)
• unknown license

packages:

• purl could not be created (and also not a lockfile, i.e. didn't yield deps)
• top level packages couldn't be created (top level package creation failed/didn't work as expected)

[AyanSinhaMahapatra]

We need to decide what to call the command line option and the attribute in the result and we need some more discussion on this:

  "review":

       -  "id": UUID field
          "type": "license"
          "detection": a LicenseDetection/PackageDetection object (details to review, in this case license)
                 "license_expression":
                  "detection_log":
                  "matches":
          "review_comments": explanatory text on the review item

        - "id": UUID field
          "type": "package"
          "detection": a LicenseDetection/PackageDetection object (details to review, in this case package)
                 "purl":
                  "detection_log":
                  "package_data":
          "review_comments": explanatory text on the review item


there is also:

"for_review": which has the UUID field

FYI @DennisClark @pombredanne

[DennisClark]

Alerts !

[AyanSinhaMahapatra]

This is implemented at https://github.com/nexB/scancode-toolkit/blob/develop/src/summarycode/todo.py and the CLI option is --todo.

Currently this supports issues in both package and license detection.
This is a codebase-level (or top-level) list of todo items with the following format:

todo:
    - detection_id:
      review_comments:
      detection:
    
    - detection_id:
      review_comments:
      detection:

• detection_id: This is the license detection identifier in case of license issues and for package issues this is a purl+uuid as a qualifier
• review_comments: This is a mapping where the key is the type of the issue, and the value has the issue description for context on the issue.
• detection: This is a mapping with the issue details and this is essentially a LicenseDetection mapping or a Package mapping.

We should also have all the possible issue types listed in the docs.

[AyanSinhaMahapatra]

Closing this as this is now in develop