Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Incorrect declared license information (maven) #618

Open
ariel11 opened this issue Oct 29, 2024 · 0 comments
Open

Incorrect declared license information (maven) #618

ariel11 opened this issue Oct 29, 2024 · 0 comments

Comments

@ariel11
Copy link

ariel11 commented Oct 29, 2024

For the package https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-server/, ClearlyDefined has determined three different "declared" license results and they are all incorrect in part. I looked into these three examples and include my findings below.
image

  1. For version 10.0.23, there's a SPDX expression in the LICENSE file that says "SPDX-License-Identifier: EPL-2.0 OR Apache-2.0." I'm not sure why ClearlyDefined put "Apache-2.0 AND EPL-2.0" on one side of the "OR" (see screenshot above) - this is incorrect.

  2. For version 12.0.12, the module-info file has the same "SPDX-License-Identifier: EPL-2.0 OR Apache-2.0," which should be the declared field. However, ClearlyDefined is reporting this as just "Apache-2.0" - this is incorrect.
    image

  3. For version 9.4.55.v20240627, the about.html file has the dual license information (this older package has EPL-1.0 instead of EPL-2.0). There is also a LICENSE file with EPL 1.0 and Apache-2.0. It looks like ClearlyDefined is including all the discovered licenses in the declared field.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant