Too many licenses identified and different result single file vs project

[hesa]

Description

Two problems:

1. Different result when scanning single file compared to an entire project. This issue seems to be partly related to: OR identified as AND #3523
2. GPLv3 and other licenses seem to be incorrectly identified but ignored? Partly relates to the 3523 as well.

How To Reproduce

Tell us how to reproduce the issue.

Execute attached file (freetype.sh) to download project and single file, scan and present data from them separately.

Problem (1)
See output from script. The licenses detected are as follows:

• Scanning single file, t1afm.c, gives: freetype
• Scanning entire gives (for the same file, t1afm.c): mit AND public-domain AND gpl-2.0 AND freetype

Problem (2)
See output from script.

A GPLv3 rule is matched.

Expression:freetype OR gpl-3.0
RULE:https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/freetype_or_gpl-3.0_1.RULE

I guess this is incorrectly identified by the following text in freetype-2.13.2/LICENSE.TXT:

    Note that  this license  is compatible to  the GNU  General Public                                   
    License version 3, but not version 2.                                                                

The below, I think, relates to #3523

Expression:mit
RULE:https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/mit_14.RULE

I think this is caused by the top level license as found in freetype-2.13.2/LICENSE.TXT. Not valid for the file t1afm.c

Expression:public-domain
RULE:https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/public-domain_285.RULE

I think this is caused by the top level license as found in freetype-2.13.2/LICENSE.TXT. Not valid for the file t1afm.c

Expression:gpl-2.0
RULE:https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/gpl-2.0_1022.RULE

Expression:freetype
RULE:https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/licenses/freetype.LICENSE

Both are oK.

System configuration

For bug reports, it really helps us to know:

• What OS are you running on? (Windows/MacOS/Linux)

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 22.04.3 LTS
Release:        22.04
Codename:       jammy

• What version of scancode-toolkit was used to generate the scan file?

$ scancode --version
ScanCode version: 32.0.8
ScanCode Output Format version: 3.0.0
SPDX License list version: 3.21

• What installation method was used to install/run scancode? (pip/source download/other)
  pip

... thanks for all your work on Scancode :)

[hesa]

Bash script mentioned above, with suffix txtto allow being uploaded: freetype.txt

[pombredanne]

Here are my 2 cents:

• the issue is indeed that following file references does not help, same as OR identified as AND #3523
• the resolution may consist in:

1. remove the file references of this rule (and possibly similar rules for freetype notice) https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/rules/freetype_or_gpl-3.0_1.RULE
2. In that same rule update the license expression which is wrong. And add a few licenses... there are clear references to gpl-2.0-plus and NOT GPL3.

• https://gitlab.freedesktop.org/freetype/freetype/-/blob/master/src/base/fthash.c and https://gitlab.freedesktop.org/freetype/freetype/-/tree/master/src/bdf and https://gitlab.freedesktop.org/freetype/freetype/-/blob/master/src/pcf are under mit

• Some files in https://gitlab.freedesktop.org/freetype/freetype/-/blob/master/src/gzip are under the zlib license.

• https://gitlab.freedesktop.org/freetype/freetype/-/blob/master/src/base/md5.c is public-domain or other-permissive and see Convert permissive rules to license #3552

These are for this slightly older notice at https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/rules/freetype_or_gpl-3.0_1.RULE

We also need new rules for the notice at https://gitlab.freedesktop.org/freetype/freetype/-/blob/749b8f9d344105357b82766f8c555586a4b84e7c/LICENSE.TXT referenced in this issue

• https://gitlab.freedesktop.org/freetype/freetype/-/blob/master/src/autofit/ft-hb.c and https://gitlab.freedesktop.org/freetype/freetype/-/blob/master/src/autofit/ft-hb.h are mit-modern

So I expect in the end to have something like that for the older LICENSE.txt and all its related rules:

(freetype OR gpl-2.0-plus) AND (mit AND zlib AND public-domain)

And for the newer one:

(freetype OR gpl-2.0-plus) AND (mit AND zlib AND public-domain AND mit-modern)

Or we could also expand public-domain to public-domain OR other-permissive or public-domain OR license-key-TBD once #3552 is done