A recent scan of pkg:github/jekyll/jekyll@4.3.1?version_prefix=v from https://github.com/jekyll/jekyll/archive/refs/tags/v4.3.1.tar.gz detected the declared license of the project correctly to be mit. It also correctly interpreted the license expression of a lower level javascript file jekyll-4.3.1/docs/js/html5shiv.min.js to be mit or gpl-2.0 based on the text MIT/GPL2 Licensed in that file. So far, so excellent.
But the License Clarity score is not 100 for this project (and it should be) because the "Conflicting license categories" was set to true, resulting in a -20 impact on the score. This is likely due to the fact that the overall license mit is permissive and the lower-level license gpl-2.0 is copyleft; however, the practical resolution is obvious that the choice of mit or gpl-2.0 for the javascript file will normally be mit, since the declared license for the entire project is mit.
Without getting into the very interesting questions about license choice policies and standards, I think that in this and similar cases, we of course should continue to report the choice (the disjunctive license expression) in the lower-level file, but that it should not have a negative impact on the license clarity score.
Scan results attached.
jekyll-4.3.1.tar.gz_scan.json.zip
A recent scan of pkg:github/jekyll/jekyll@4.3.1?version_prefix=v from https://github.com/jekyll/jekyll/archive/refs/tags/v4.3.1.tar.gz detected the declared license of the project correctly to be mit. It also correctly interpreted the license expression of a lower level javascript file jekyll-4.3.1/docs/js/html5shiv.min.js to be
mit or gpl-2.0based on the textMIT/GPL2 Licensedin that file. So far, so excellent.But the License Clarity score is not 100 for this project (and it should be) because the "Conflicting license categories" was set to true, resulting in a -20 impact on the score. This is likely due to the fact that the overall license mit is permissive and the lower-level license gpl-2.0 is copyleft; however, the practical resolution is obvious that the choice of mit or gpl-2.0 for the javascript file will normally be mit, since the declared license for the entire project is mit.
Without getting into the very interesting questions about license choice policies and standards, I think that in this and similar cases, we of course should continue to report the choice (the disjunctive license expression) in the lower-level file, but that it should not have a negative impact on the license clarity score.
Scan results attached.
jekyll-4.3.1.tar.gz_scan.json.zip