Adding false positive rules for Go and pycryptodomex GPL hits - #4589
Adding false positive rules for Go and pycryptodomex GPL hits#4589CsatariGergely wants to merge 2 commits into
Conversation
One for Go, where the GPLv2 licenses is mentioned in the context of GCC and one for pycryptodomex where the GPL license is mentioned in the context of a website. Signed-off-by: Gergely Csatari <[email protected]> Co-authored-by: Philippe Ombredanne <[email protected]>
There was a problem hiding this comment.
@CsatariGergely Thanks a lot for the PR! These reports and license rules to fix detection issues are always much appreciated ❤️
What about having these rules as license clues instead of false-positives?
IMHO these license texts although they are not directly related to the license-expression for the file it is found in, they could still be important license related clues which could be interesting.
A false positive rule deletes a license text match from the results without any indication, a license clue if detected, is not reflected in the final license-expression for the file, but is present in a seperate file-level section license_clues and thus can be reviewed if someone wants to review license related clues.
The license-clue vs false-positive distinction should happen thus in a case by case basis, and IMHO proper false-positives are always texts which are not license related at all, but vaguely resembles license names/texts in some way, and license clues are always somewhat license related, even if they are not directly related to the license of a file.
We should probably better document this somewhere (probably in the documentation section how to add a license rule) 😅
What do you think? @CsatariGergely @pombredanne
|
In my opinion these are clearly false positives and not license clues. Both of these are talking of the licenses of other things than the code under scan. Adding them to license clues would be confusing. |
…ve-rules Signed-off-by: Gergely Csatari <[email protected]>
One for Go, where the GPLv2 licenses is mentioned in the context of GCC and one for pycryptodomex where the GPL license is mentioned in the context of a website.
Tasks
Run tests locally to check for errors.