Comment representing copied source could not be picked up by SCANCODE

[SheriffManzoorF]

Description

During the scancode scan of package NPM::source-map-support:, the scancode couldn't pick up the presence of copy paste code mentioned in the file https://github.com/evanw/node-source-map-support/blob/7b5b81eb14c9ee6c6537398262bf7dab8580621c/source-map-support.js.

How To Reproduce

Download the source code from github : https://github.com/evanw/node-source-map-support/archive/7b5b81eb14c9ee6c6537398262bf7dab8580621c.zip .

scancode -clpeui --json-pp

System configuration

For bug reports, it really helps us to know:

• What OS are you running on? Windows
• What version of scancode-toolkit was used to generate the scan file?
• What installation method was used to install/run scancode? source download

Attached sample report for your consideration:

sample.json

[stefan6419846]

The scans has correctly picked up the URL https://code.google.com/p/v8/source/browse/trunk/src/messages.js How is SCTK expected to know the corresponding license data associated with this URL? IMHO it should be the task of the reviewer of the generated output to look at all detected URLs and do something useful with it, for example researching the original license data for this specific copied code.

[SheriffManzoorF]

Dear @stefan6419846 , thanks I used ORT which do not bring out this information from Scancode. but just running scancode is able to bring out this url. Thanks again for pointing out. Of course reviewers will do the rest of clarifying the license.

[RajX-dev]

Hi, I would like to work on this. I'll verify the false negative and add a rule to fix it.

[stefan6419846]

There is no false negative - the URL is detected correctly. How would you plan to fix this in SCTK?

[RajX-dev]

While the URL is extracted, it isn't currently mapped to a license or package context. My plan is to treat this as a data issue, I will add a new .RULE file in licensedcode that targets this specific Closure Library URL this will force a proper detection of apache-2.0 whenever this reference appeaes in the future

[stefan6419846]

What happens if the remote license changes or changed? The URL is not live anymore, but the references I found rather suggest that this would be BSD-3-Clause and not Apache-2.0.

Apart from this, as far as I understand the comments of the issue author, this rather is an issue with ORT not displaying detected URLs, not within SCTK.

[RajX-dev]

You're right since the URL is detected, the scanner is doing its job. However, because it's only listed as a generic URL and not a license finding, it doesn't always show up in tools like ORT. I’ll add a rule to map this specific URL to Apache-2.0 so it’s formally recognized as a license reference. That should help it get picked up correctly.

[SheriffManzoorF]

Hey @RajX-dev , thanks for looking into this. yes getting any license indication would greatly help in such cases for review team to be triggered for investigation.

[dikshaa2909]

After reviewing the discussion, this seems more like an ORT consumption / visualization issue rather than a ScanCode detection gap. Introducing URL - license rules may be brittle if upstream licensing changes. Perhaps documenting this behavior or improving ORT’s handling of detected URLs would be safer.
I would like to work on this by exploring safer alternatives such as documentation improvements, guidance for reviewers, or potential enhancements on the ORT side to better surface detected URLs for license review.

[pombredanne]

@SheriffManzoorF
and stefan6419846 re:

How is SCTK expected to know the corresponding license data associated with this URL? IMHO it should be the task of the reviewer of the generated output to look at all detected URLs and do something useful with it, for example researching the original license data for this specific copied code.

Indeed, code matching is a job for ScanCode.io and MatchCode. Running the code matching pipeline in ScanCode.io with V8 indexed would find the code match alright. Something similar to a diff of these two files:

• https://web.archive.org/web/20150926130416/http://v8.googlecode.com/svn/trunk/src/messages.js
• https://raw.githubusercontent.com/evanw/node-source-map-support/7b5b81eb14c9ee6c6537398262bf7dab8580621c/source-map-support.js

After indexing V8, running the match_to_matchode pipeline should report the match (and its BSD license)

Of note:

• The function CallSiteToString is effectively copied with minimal changes
• The original V8 copyright and license notice has been removed:

// Copyright 2012 the V8 project authors. All rights reserved. 	
// Use of this source code is governed by a BSD-style license that can be 	
// found in the LICENSE file.

• The V8 license is a BSD-3-Clause at https://web.archive.org/web/20150911044719/http://v8.googlecode.com/svn/trunk/LICENSE.v8 and the MIT license at https://github.com/evanw/node-source-map-support?tab=readme-ov-file#license is ignoring this.

• This was introduced in evanw/node-source-map-support@3b154ff