Invalid SPDX: PackageLicenseInfoFromFiles: x11vnc-openssl-exception

[vargenau]

Description

ScanCode generates a license name "x11vnc-openssl-exception".
It should be prefixed by "LicenseRef-"

How To Reproduce

Download haproxy-2.0.19.tar.gz from https://www.haproxy.org/download/2.0/src/haproxy-2.0.19.tar.gz

scancode -c -l -i --license-text --spdx-tv haproxy-2.0.19.spdx haproxy-2.0.19

Result:
haproxy-2.0.19.spdx.txt

System configuration

./scancode --version
ScanCode version: 32.0.0rc1
ScanCode Output Format version: 3.0.0
SPDX License list version: 3.19

Ubuntu 22.10

[vargenau]

In fact x11vnc-openssl-exception is a valid SPDX license exception.
But that is still invalid SPDX.

[pombredanne]

wrt. non-open source content in haproxy, you may fancy this discussion: haproxy/haproxy#1948

[AyanSinhaMahapatra]

In fact x11vnc-openssl-exception is a valid SPDX license exception.

Yes, I think the issue here is that we have full license expressions, i.e. for haproxy-2.0.19/LICENSE we have the detected_license_expression as:

(gpl-2.0 AND gpl-1.0-plus) AND gpl-1.0-plus AND (gpl-1.0-plus AND lgpl-2.0-plus AND openssl-ssleay AND gpl-2.0-plus WITH openssl-exception-gpl-2.0)

And here while generating SPDX licenses for a file at https://github.com/nexB/scancode-toolkit/blob/develop/src/formattedcode/output_spdx.py#L295, we are getting the license keys directly from an expression, and there openssl-exception-gpl-2.0 (for which the SPDX is x11vnc-openssl-exception) is a license key. This is a bug from the license detection update, here we should get the license expressions from the detection objects instead and get license keys only in the case of AND/OR?

@vargenau it would have been correct if it was GPL-2.0-or-later WITH x11vnc-openssl-exception instead of just the exception?

[vargenau]

Hi @AyanSinhaMahapatra
Yes, you should output PackageLicenseInfoFromFiles: GPL-2.0-or-later WITH x11vnc-openssl-exception.
An exception cannot be used alone.
This is true for all exceptions: https://spdx.org/licenses/exceptions-index.html

[pombredanne]

An exception cannot be used alone.
This is true for all exceptions: https://spdx.org/licenses/exceptions-index.html

Actually it can be seen alone in the wild alright even if this may not make sense. That's not the case here but there are examples.

[vargenau]

Some more examples:
libunistring.spdx.txt

LicenseInfoInFile: Libtool-exception should be LicenseInfoInFile: GPL-2.0-or-later WITH Libtool-exception

LicenseInfoInFile: Autoconf-exception-generic should be LicenseInfoInFile: GPL-2.0-or-later WITH Autoconf-exception-generic

[pombredanne]

An exception cannot be used alone.
This is true for all exceptions: https://spdx.org/licenses/exceptions-index.html

In hindsight that's one of the cases where SPDX is theoretically correct and is difficult to implement and not matching things seen in practice...

The easy way out would be to punt and always return a licenseref instead... for instance using: LicenseRef-GPL-2.0-or-later-WITH-Libtool-exception: this is what many tools and users do and this is correct but mostly useless and couter-productive.

The other way may be to tag each exception with the license expression they imply (with some possible weirdness when there is no GPL or LGPL version specified in the exception text itself). For example here, an exception such as https://scancode-licensedb.aboutcode.org/libtool-exception-2.0.html could have an extra attribute like implied_expression: gpl-2.0-plus WITH libtool-exception-2.0 and this would be reported whenever this exception is detected alone. See also the related #3484