Incorrect identification of lgpl-2.1

[hesa]

Description

Scancode incorrectly identifies lgpl-2.1

How To Reproduce

Get the data and scan it:

$ mkdir possible-bug
$ cd possible-bug
$ curl -LJO "https://raw.githubusercontent.com/aws/aws-cdk/refs/heads/main/packages/%40aws-cdk/cli-lib-alpha/NOTICE"
$ scancode -clipe --classify --license-clarity-score --license-text  . --json-pp NOTICE-scan.json

NOTICE file content

$ cat NOTICE
AWS Cloud Development Kit (AWS CDK)
Copyright 2018-2024 Amazon.com, Inc. or its affiliates. All Rights Reserved.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.

Third party attributions of this package can be found in the THIRD_PARTY_LICENSES file

Extract the license info:

$ cat NOTICE-scan.json | jq .files[].license_detections
[]
[
  {
    "license_expression": "apache-2.0 AND lgpl-2.1",
    "license_expression_spdx": "Apache-2.0 AND LGPL-2.1-only",
    "matches": [
      {
        "license_expression": "apache-2.0 AND lgpl-2.1",
        "spdx_license_expression": "Apache-2.0 AND LGPL-2.1-only",
        "from_file": "possible-bug/NOTICE",
        "start_line": 4,
        "end_line": 16,
        "matcher": "3-seq",
        "score": 73.02,
        "matched_length": 86,
        "match_coverage": 81.13,
        "rule_relevance": 90,
        "rule_identifier": "apache-2.0_and_lgpl-2.1_2.RULE",
        "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/apache-2.0_and_lgpl-2.1_2.RULE",
        "matched_text": "Licensed under the Apache License, Version 2.0 (the \"License\");\nyou may not use this file except in compliance with the License.\nYou may obtain a copy of the License at\n\n    http://www.apache.org/licenses/LICENSE-2.0\n\nUnless required by applicable law or agreed to in writing, software\ndistributed under the License is distributed on an \"AS IS\" BASIS,\nWITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\nSee the License for the specific language governing permissions and\nlimitations under the License.\n\nThird party attributions of this package can be found in the THIRD_PARTY_LICENSES file"
      }
    ],
    "identifier": "apache_2_0_and_lgpl_2_1-3985cd0c-fc7a-fd67-4380-a7b00818acf1"
  }
]

Looking at the RULE file (https://github.com/aboutcode-org/scancode-toolkit/blob/develop/src/licensedcode/data/rules/apache-2.0_and_lgpl-2.1_2.RULE), then the two files are very much looking the same, but with the interesting diff (missing in the NOTICE file):

 On Debian systems a full copy of the LGPL 2.1 can be found at

I would suspect this is the problem.

BTW: match coverage is: 81.13

System configuration

Ubuntu 24.04
Python 3.12.3
Scancode 32.2.1

[pombredanne]

Thanks!

[LeChasseur]

We see several results which are based on this incorrect rule. Would be great to fix this soon. Probably best to remove this rule entirely. Please note that Apache-2.0 and LGPL-2.1 are incompatible and I would be suprised to find that combination in many projects.

[pombredanne]

@LeChasseur It was a typo upstream and it has since been corrected as you can see at https://salsa.debian.org/owncloud-team/nextcloud-desktop/-/merge_requests/9#note_256687 (and weirdly enough I was there :D )

I am going to deprecate this rule and introduce the same rule to return Apache only with key phrases to avoid any false positive.