free-unknown detected incorrectly (false positive)

[DennisClark]

A recent scan of opentofu-main.zip (there are no tags or releases)
from https://github.com/opentofu/opentofu
returned free-unknown incorrectly, apparently from opentofu-main/website/docs/language/modules/develop/structure.mdx Here is what I found in the scan results:

"detected_license_expression": "free-unknown", "detected_license_expression_spdx": "LicenseRef-scancode-free-unknown", "license_detections": [ { "matches": [ { "score": 50.0, "matcher": "2-aho", "end_line": 44, "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/free-unknown_88.RULE", "start_line": 44, "matched_text": " file, even if it is not an open source license.", "match_coverage": 100.0, "matched_length": 3, "rule_relevance": 50, "rule_identifier": "free-unknown_88.RULE", "license_expression": "free-unknown" } ],

It seems to me that " file, even if it is not an open source license." is not adequate to detect free-unknown , since it is simply part of explanatory text regarding license compliance.

free-unknown_88.RULE should be investigated and possibly removed.

opentofu-main.zip_scan.json.zip

[AyanSinhaMahapatra]

There was a bug in license clues handling fixed by #3513
This is now showing up as a license clue like this:

      "detected_license_expression": null,
      "detected_license_expression_spdx": null,
      "license_detections": [],
      "license_clues": [
        {
          "score": 50.0,
          "start_line": 44,
          "end_line": 44,
          "matched_length": 3,
          "match_coverage": 100.0,
          "matcher": "2-aho",
          "license_expression": "free-unknown",
          "rule_identifier": "free-unknown_88.RULE",
          "rule_relevance": 50,
          "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/free-unknown_88.RULE",
          "matched_text": "open source license."
        }
      ],

Note that we can still investigate this easily by using the --todo option, or using workbench, instead of going thorugh the whole scan for clues. And these also don't show up in the proper detections, or the license expression, so it's not misleading anymore.
This was already marked as a license clue rule at https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/rules/free-unknown_88.RULE#L3 so we should be good here.

[AyanSinhaMahapatra]

This is fixed, closing!