LGPL 3 false positive (should be LGPL 2 or 2.1)

[armijnhemel]

Description

https://github.com/KDE/libqzeitgeist/blob/master/src/logbrowser.cpp

is recognized as LGPL 3:

      "license_detections": [
        {
          "license_expression": "lgpl-3.0",
          "license_expression_spdx": "LGPL-3.0-only",
          "matches": [
            {
              "license_expression": "lgpl-3.0",
              "license_expression_spdx": "LGPL-3.0-only",
              "from_file": "logbrowser.cpp",
              "start_line": 4,
              "end_line": 16,
              "matcher": "3-seq",
              "score": 88.68,
              "matched_length": 94,
              "match_coverage": 88.68,
              "rule_relevance": 100,
              "rule_identifier": "lgpl-3.0_16.RULE",
              "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl-3.0_16.RULE"
            }
          ],
          "identifier": "lgpl_3_0-129dffd6-23d4-eb21-f89e-b5145e4553c9"
        }
      ],

What absolutely baffles me is that the exact same license header is used in #4994 where it is not recognized as LGPL 3.

[pombredanne]

The rule at https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl-3.0_16.RULE should get some required phrases. Then this is "frankenstein" notice crossing over GPL and LGPL:

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU Lesser General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

[pombredanne]

What absolutely baffles me is that the exact same license header is used in #4994 where it is not recognized as LGPL 3.

Same here, but since these are partial matches, the ranking may be influenced by some other low scoring matches that may be different, or we have two set of similarly ranked matches. In all cases:

• https://github.com/aboutcode-org/scancode-toolkit/blob/develop/src/licensedcode/data/rules/lgpl-2.0-plus_451.RULE should be lgpl-2.1-plus not lgpl-2.0-plus (this is lesser and not library)

And the conflicts comes not only a mix of GPL and LGPL wording but also LGPL-2.0 (library) and LGPL-2.1 (lesser.

[armijnhemel]

The rule at https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl-3.0_16.RULE should get some required phrases. Then this is "frankenstein" notice crossing over GPL and LGPL:

This program is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public License
as published by the Free Software Foundation; either version 2
of the License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU Lesser General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

huh. I thought that all gpl/lgpl rules got required phrases in be94a84 . I guess many were missed in that commit.

[armijnhemel]

Related #4951