Wrong license detected (GPL-2.0 instead of GPL-3.0-or-later) for component Linux::binutils-common:2.40

[carolinamarc]

Description

When scanning the component binutils-common_2.40-2_amd64.deb, ScanCode Toolkit detects the license as GPL-2.0.
However, according to upstream documentation and source materials, it should be GPL-3.0-or-later.

How To Reproduce

Scan the binutils-common_2.40-2_amd64.deb component using ScanCode Toolkit.
Observe that the reported license is GPL-2.0.
Compare against upstream license files (e.g., COPYING, README).

System configuration

For bug reports, it really helps us to know:

• Which version of ScanCode.io are you running? 32.2.
• Are you running the app using Docker? Yes

[pombredanne]

Do you have a PURL or download URL?

[armijnhemel]

Assuming it is this one: https://packages.debian.org/bookworm/binutils

There are plenty of files in there that are GPL2-or-later and there is also a GPL-2.0 license text in the source code archive.

[AyanSinhaMahapatra]

Maybe this works: http://ftp.cn.debian.org/debian/pool/main/b/binutils/binutils-common_2.40-2_amd64.deb ?

There are plenty of files in there that are GPL2-or-later and there is also a GPL-2.0 license text in the source code archive.

Yes, and there are many gpl-3.0-plus detections too. Note also that we recently merged the required phrases PR at #4237 and elsewhere, so this might be fixed in develop.

@carolinamarc could you point us to a specific text/file where the bug occurs? Just so we are sure this is still present/fixed

[carolinamarc]

Do you have a PURL or download URL?

just edited the discription. Here you have binutils-common_2.40-2_amd64.deb
Thank you!

[carolinamarc]

Maybe this works: http://ftp.cn.debian.org/debian/pool/main/b/binutils/binutils-common_2.40-2_amd64.deb ?

There are plenty of files in there that are GPL2-or-later and there is also a GPL-2.0 license text in the source code archive.

Yes, and there are many gpl-3.0-plus detections too. Note also that we recently merged the required phrases PR at #4237 and elsewhere, so this might be fixed in develop.

@carolinamarc could you point us to a specific text/file where the bug occurs? Just so we are sure this is still present/fixed

it happens in data/copyright file.

[pombredanne]

@carolinamarc: are you running:

• ScanCode.io? if yes, with which pipeline?
• ScanCode toolkit? if yes, with which command line options?

it happens in data/copyright file.

OK, this would be binutils-common_2.40-2_amd64.deb-extract/data.tar.xz-extract/usr/share/doc/binutils-common/copyright using extractcode.

[carolinamarc]

@carolinamarc: are you running:

• ScanCode.io? if yes, with which pipeline?
• ScanCode toolkit? if yes, with which command line options?

it happens in data/copyright file.

OK, this would be binutils-common_2.40-2_amd64.deb-extract/data.tar.xz-extract/usr/share/doc/binutils-common/copyright using extractcode.

Im using Scancode toolkit with these command line options: ScanCode:
--copyright,--license,--info,--strip-root,--timeout,600

[pombredanne]

The bug is clearly there BTW, we should detect a GPL 3 on this.

We are with the latest code in the develop branch, but this can be improved.

Note that:

1. this copyright file is misleading with references to the LGPL text (emphasis is mine)

On Debian GNU/Linux systems, the complete text of the GNU General
Public License can be found in /usr/share/common-licenses/GPL
and /usr/share/common-licenses/LGPL.

2. this is likely incomplete and incorrect wrt. to the actual code that is included in the package proper, as a quick scan of binutils from which binutils-commons is derived has a large number of other licenses. This is consistent with @armijnhemel comment above.