diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index a4b4679826..bdbc855aaa 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -10,6 +10,12 @@ v35.1.0 (unreleased)
Requires the ``find_vulnerabilities`` pipeline to be executed beforehand.
https://github.com/aboutcode-org/scancode.io/pull/1702
+- Enable ``--license-references`` scan option in the ``scan_single_package`` pipeline.
+ The ``license_references`` and ``license_rule_references`` attributes will now be
+ available in the scan results, including the details about detected licenses and
+ license rules used during the scan.
+ https://github.com/aboutcode-org/scancode.io/issues/1657
+
v35.0.0 (2025-06-23)
--------------------
diff --git a/scanpipe/pipelines/scan_single_package.py b/scanpipe/pipelines/scan_single_package.py
index c2e077a3f7..c8753b90de 100644
--- a/scanpipe/pipelines/scan_single_package.py
+++ b/scanpipe/pipelines/scan_single_package.py
@@ -61,6 +61,7 @@ def steps(cls):
"info": True,
"license": True,
"license_text": True,
+ "license_references": True,
"package": True,
"url": True,
"classify": True,
diff --git a/scanpipe/tests/data/manifests/openpdf-parent-1.3.11_scan_package.json b/scanpipe/tests/data/manifests/openpdf-parent-1.3.11_scan_package.json
index b8ff95d88a..c2677bbef4 100644
--- a/scanpipe/tests/data/manifests/openpdf-parent-1.3.11_scan_package.json
+++ b/scanpipe/tests/data/manifests/openpdf-parent-1.3.11_scan_package.json
@@ -8,6 +8,7 @@
"--info": true,
"--license": true,
"--license-text": true,
+ "--license-references": true,
"--package": true,
"--url": true,
"--classify": true,
@@ -332,6 +333,160 @@
]
}
],
+ "license_references": [
+ {
+ "key": "lgpl-3.0",
+ "language": "en",
+ "short_name": "LGPL 3.0",
+ "name": "GNU Lesser General Public License 3.0",
+ "category": "Copyleft Limited",
+ "owner": "Free Software Foundation (FSF)",
+ "homepage_url": "http://www.gnu.org/licenses/lgpl-3.0.html",
+ "is_builtin": true,
+ "is_exception": false,
+ "is_unknown": false,
+ "is_generic": false,
+ "spdx_license_key": "LGPL-3.0-only",
+ "other_spdx_license_keys": [
+ "LGPL-3.0"
+ ],
+ "osi_license_key": "LGPL-3.0",
+ "text_urls": [
+ "http://www.gnu.org/licenses/lgpl-3.0-standalone.html",
+ "http://www.gnu.org/licenses/lgpl-3.0.txt"
+ ],
+ "osi_url": "http://www.opensource.org/licenses/lgpl-3.0.html",
+ "faq_url": null,
+ "other_urls": [
+ "http://www.gnu.org/copyleft/lesser.html",
+ "http://www.gnu.org/licenses/why-not-lgpl.html",
+ "http://www.opensource.org/licenses/LGPL-3.0",
+ "https://opensource.org/licenses/LGPL-3.0",
+ "https://www.gnu.org/licenses/lgpl+gpl-3.0.txt",
+ "https://www.gnu.org/licenses/lgpl-3.0-standalone.html"
+ ],
+ "key_aliases": [],
+ "minimum_coverage": 0,
+ "standard_notice": null,
+ "ignorable_copyrights": [
+ "Copyright (c) 2007 Free Software Foundation, Inc. https://fsf.org"
+ ],
+ "ignorable_holders": [
+ "Free Software Foundation, Inc."
+ ],
+ "ignorable_authors": [],
+ "ignorable_urls": [
+ "https://fsf.org/"
+ ],
+ "ignorable_emails": [],
+ "text": " GNU LESSER GENERAL PUBLIC LICENSE\n Version 3, 29 June 2007\n \n Copyright (C) 2007 Free Software Foundation, Inc. \n Everyone is permitted to copy and distribute verbatim copies\n of this license document, but changing it is not allowed.\n \n\n This version of the GNU Lesser General Public License incorporates\nthe terms and conditions of version 3 of the GNU General Public\nLicense, supplemented by the additional permissions listed below.\n \n 0. Additional Definitions.\n \n As used herein, \"this License\" refers to version 3 of the GNU Lesser\nGeneral Public License, and the \"GNU GPL\" refers to version 3 of the GNU\nGeneral Public License.\n \n \"The Library\" refers to a covered work governed by this License,\nother than an Application or a Combined Work as defined below.\n \n An \"Application\" is any work that makes use of an interface provided\nby the Library, but which is not otherwise based on the Library.\nDefining a subclass of a class defined by the Library is deemed a mode\nof using an interface provided by the Library.\n \n A \"Combined Work\" is a work produced by combining or linking an\nApplication with the Library. The particular version of the Library\nwith which the Combined Work was made is also called the \"Linked\nVersion\".\n \n The \"Minimal Corresponding Source\" for a Combined Work means the\nCorresponding Source for the Combined Work, excluding any source code\nfor portions of the Combined Work that, considered in isolation, are\nbased on the Application, and not on the Linked Version.\n \n The \"Corresponding Application Code\" for a Combined Work means the\nobject code and/or source code for the Application, including any data\nand utility programs needed for reproducing the Combined Work from the\nApplication, but excluding the System Libraries of the Combined Work.\n \n 1. Exception to Section 3 of the GNU GPL.\n \n You may convey a covered work under sections 3 and 4 of this License\nwithout being bound by section 3 of the GNU GPL.\n \n 2. Conveying Modified Versions.\n \n If you modify a copy of the Library, and, in your modifications, a\nfacility refers to a function or data to be supplied by an Application\nthat uses the facility (other than as an argument passed when the\nfacility is invoked), then you may convey a copy of the modified\nversion:\n \n a) under this License, provided that you make a good faith effort to\n ensure that, in the event an Application does not supply the\n function or data, the facility still operates, and performs\n whatever part of its purpose remains meaningful, or\n \n b) under the GNU GPL, with none of the additional permissions of\n this License applicable to that copy.\n \n 3. Object Code Incorporating Material from Library Header Files.\n \n The object code form of an Application may incorporate material from\na header file that is part of the Library. You may convey such object\ncode under terms of your choice, provided that, if the incorporated\nmaterial is not limited to numerical parameters, data structure\nlayouts and accessors, or small macros, inline functions and templates\n(ten or fewer lines in length), you do both of the following:\n \n a) Give prominent notice with each copy of the object code that the\n Library is used in it and that the Library and its use are\n covered by this License.\n \n b) Accompany the object code with a copy of the GNU GPL and this license\n document.\n \n 4. Combined Works.\n \n You may convey a Combined Work under terms of your choice that,\ntaken together, effectively do not restrict modification of the\nportions of the Library contained in the Combined Work and reverse\nengineering for debugging such modifications, if you also do each of\nthe following:\n \n a) Give prominent notice with each copy of the Combined Work that\n the Library is used in it and that the Library and its use are\n covered by this License.\n \n b) Accompany the Combined Work with a copy of the GNU GPL and this license\n document.\n \n c) For a Combined Work that displays copyright notices during\n execution, include the copyright notice for the Library among\n these notices, as well as a reference directing the user to the\n copies of the GNU GPL and this license document.\n \n d) Do one of the following:\n \n 0) Convey the Minimal Corresponding Source under the terms of this\n License, and the Corresponding Application Code in a form\n suitable for, and under terms that permit, the user to\n recombine or relink the Application with a modified version of\n the Linked Version to produce a modified Combined Work, in the\n manner specified by section 6 of the GNU GPL for conveying\n Corresponding Source.\n \n 1) Use a suitable shared library mechanism for linking with the\n Library. A suitable mechanism is one that (a) uses at run time\n a copy of the Library already present on the user's computer\n system, and (b) will operate properly with a modified version\n of the Library that is interface-compatible with the Linked\n Version.\n \n e) Provide Installation Information, but only if you would otherwise\n be required to provide such information under section 6 of the\n GNU GPL, and only to the extent that such information is\n necessary to install and execute a modified version of the\n Combined Work produced by recombining or relinking the\n Application with a modified version of the Linked Version. (If\n you use option 4d0, the Installation Information must accompany\n the Minimal Corresponding Source and Corresponding Application\n Code. If you use option 4d1, you must provide the Installation\n Information in the manner specified by section 6 of the GNU GPL\n for conveying Corresponding Source.)\n \n 5. Combined Libraries.\n \n You may place library facilities that are a work based on the\nLibrary side by side in a single library together with other library\nfacilities that are not Applications and are not covered by this\nLicense, and convey such a combined library under terms of your\nchoice, if you do both of the following:\n \n a) Accompany the combined library with a copy of the same work based\n on the Library, uncombined with any other library facilities,\n conveyed under the terms of this License.\n \n b) Give prominent notice with the combined library that part of it\n is a work based on the Library, and explaining where to find the\n accompanying uncombined form of the same work.\n \n 6. Revised Versions of the GNU Lesser General Public License.\n \n The Free Software Foundation may publish revised and/or new versions\nof the GNU Lesser General Public License from time to time. Such new\nversions will be similar in spirit to the present version, but may\ndiffer in detail to address new problems or concerns.\n \n Each version is given a distinguishing version number. If the\nLibrary as you received it specifies that a certain numbered version\nof the GNU Lesser General Public License \"or any later version\"\napplies to it, you have the option of following the terms and\nconditions either of that published version or of any later version\npublished by the Free Software Foundation. If the Library as you\nreceived it does not specify a version number of the GNU Lesser\nGeneral Public License, you may choose any version of the GNU Lesser\nGeneral Public License ever published by the Free Software Foundation.\n \n If the Library as you received it specifies that a proxy can decide\nwhether future versions of the GNU Lesser General Public License shall\napply, that proxy's public statement of acceptance of any version is\npermanent authorization for you to choose that version for the\nLibrary.",
+ "scancode_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/licenses/lgpl-3.0.LICENSE",
+ "licensedb_url": "https://scancode-licensedb.aboutcode.org/lgpl-3.0",
+ "spdx_url": "https://spdx.org/licenses/LGPL-3.0-only"
+ },
+ {
+ "key": "mpl-2.0",
+ "language": "en",
+ "short_name": "MPL 2.0",
+ "name": "Mozilla Public License 2.0",
+ "category": "Copyleft Limited",
+ "owner": "Mozilla",
+ "homepage_url": "http://mpl.mozilla.org/2012/01/03/announcing-mpl-2-0/",
+ "is_builtin": true,
+ "is_exception": false,
+ "is_unknown": false,
+ "is_generic": false,
+ "spdx_license_key": "MPL-2.0",
+ "other_spdx_license_keys": [],
+ "osi_license_key": "MPL-2.0",
+ "text_urls": [
+ "http://www.mozilla.com/MPL/2.0/",
+ "http://www.mozilla.org/MPL/2.0/",
+ "http://www.mozilla.org/MPL/2.0/index.html",
+ "http://www.mozilla.org/MPL/2.0/index.txt"
+ ],
+ "osi_url": "http://opensource.org/licenses/MPL-2.0",
+ "faq_url": "http://www.mozilla.org/MPL/2.0/FAQ.html",
+ "other_urls": [
+ "https://opensource.org/licenses/MPL-2.0",
+ "https://www.mozilla.org/MPL/2.0/"
+ ],
+ "key_aliases": [],
+ "minimum_coverage": 0,
+ "standard_notice": null,
+ "ignorable_copyrights": [],
+ "ignorable_holders": [],
+ "ignorable_authors": [],
+ "ignorable_urls": [
+ "http://mozilla.org/MPL/2.0"
+ ],
+ "ignorable_emails": [],
+ "text": "Mozilla Public License Version 2.0\n==================================\n\n1. Definitions\n--------------\n\n1.1. \"Contributor\"\n means each individual or legal entity that creates, contributes to\n the creation of, or owns Covered Software.\n\n1.2. \"Contributor Version\"\n means the combination of the Contributions of others (if any) used\n by a Contributor and that particular Contributor's Contribution.\n\n1.3. \"Contribution\"\n means Covered Software of a particular Contributor.\n\n1.4. \"Covered Software\"\n means Source Code Form to which the initial Contributor has attached\n the notice in Exhibit A, the Executable Form of such Source Code\n Form, and Modifications of such Source Code Form, in each case\n including portions thereof.\n\n1.5. \"Incompatible With Secondary Licenses\"\n means\n\n (a) that the initial Contributor has attached the notice described\n in Exhibit B to the Covered Software; or\n\n (b) that the Covered Software was made available under the terms of\n version 1.1 or earlier of the License, but not also under the\n terms of a Secondary License.\n\n1.6. \"Executable Form\"\n means any form of the work other than Source Code Form.\n\n1.7. \"Larger Work\"\n means a work that combines Covered Software with other material, in \n a separate file or files, that is not Covered Software.\n\n1.8. \"License\"\n means this document.\n\n1.9. \"Licensable\"\n means having the right to grant, to the maximum extent possible,\n whether at the time of the initial grant or subsequently, any and\n all of the rights conveyed by this License.\n\n1.10. \"Modifications\"\n means any of the following:\n\n (a) any file in Source Code Form that results from an addition to,\n deletion from, or modification of the contents of Covered\n Software; or\n\n (b) any new file in Source Code Form that contains any Covered\n Software.\n\n1.11. \"Patent Claims\" of a Contributor\n means any patent claim(s), including without limitation, method,\n process, and apparatus claims, in any patent Licensable by such\n Contributor that would be infringed, but for the grant of the\n License, by the making, using, selling, offering for sale, having\n made, import, or transfer of either its Contributions or its\n Contributor Version.\n\n1.12. \"Secondary License\"\n means either the GNU General Public License, Version 2.0, the GNU\n Lesser General Public License, Version 2.1, the GNU Affero General\n Public License, Version 3.0, or any later versions of those\n licenses.\n\n1.13. \"Source Code Form\"\n means the form of the work preferred for making modifications.\n\n1.14. \"You\" (or \"Your\")\n means an individual or a legal entity exercising rights under this\n License. For legal entities, \"You\" includes any entity that\n controls, is controlled by, or is under common control with You. For\n purposes of this definition, \"control\" means (a) the power, direct\n or indirect, to cause the direction or management of such entity,\n whether by contract or otherwise, or (b) ownership of more than\n fifty percent (50%) of the outstanding shares or beneficial\n ownership of such entity.\n\n2. License Grants and Conditions\n--------------------------------\n\n2.1. Grants\n\nEach Contributor hereby grants You a world-wide, royalty-free,\nnon-exclusive license:\n\n(a) under intellectual property rights (other than patent or trademark)\n Licensable by such Contributor to use, reproduce, make available,\n modify, display, perform, distribute, and otherwise exploit its\n Contributions, either on an unmodified basis, with Modifications, or\n as part of a Larger Work; and\n\n(b) under Patent Claims of such Contributor to make, use, sell, offer\n for sale, have made, import, and otherwise transfer either its\n Contributions or its Contributor Version.\n\n2.2. Effective Date\n\nThe licenses granted in Section 2.1 with respect to any Contribution\nbecome effective for each Contribution on the date the Contributor first\ndistributes such Contribution.\n\n2.3. Limitations on Grant Scope\n\nThe licenses granted in this Section 2 are the only rights granted under\nthis License. No additional rights or licenses will be implied from the\ndistribution or licensing of Covered Software under this License.\nNotwithstanding Section 2.1(b) above, no patent license is granted by a\nContributor:\n\n(a) for any code that a Contributor has removed from Covered Software;\n or\n\n(b) for infringements caused by: (i) Your and any other third party's\n modifications of Covered Software, or (ii) the combination of its\n Contributions with other software (except as part of its Contributor\n Version); or\n\n(c) under Patent Claims infringed by Covered Software in the absence of\n its Contributions.\n\nThis License does not grant any rights in the trademarks, service marks,\nor logos of any Contributor (except as may be necessary to comply with\nthe notice requirements in Section 3.4).\n\n2.4. Subsequent Licenses\n\nNo Contributor makes additional grants as a result of Your choice to\ndistribute the Covered Software under a subsequent version of this\nLicense (see Section 10.2) or under the terms of a Secondary License (if\npermitted under the terms of Section 3.3).\n\n2.5. Representation\n\nEach Contributor represents that the Contributor believes its\nContributions are its original creation(s) or it has sufficient rights\nto grant the rights to its Contributions conveyed by this License.\n\n2.6. Fair Use\n\nThis License is not intended to limit any rights You have under\napplicable copyright doctrines of fair use, fair dealing, or other\nequivalents.\n\n2.7. Conditions\n\nSections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted\nin Section 2.1.\n\n3. Responsibilities\n-------------------\n\n3.1. Distribution of Source Form\n\nAll distribution of Covered Software in Source Code Form, including any\nModifications that You create or to which You contribute, must be under\nthe terms of this License. You must inform recipients that the Source\nCode Form of the Covered Software is governed by the terms of this\nLicense, and how they can obtain a copy of this License. You may not\nattempt to alter or restrict the recipients' rights in the Source Code\nForm.\n\n3.2. Distribution of Executable Form\n\nIf You distribute Covered Software in Executable Form then:\n\n(a) such Covered Software must also be made available in Source Code\n Form, as described in Section 3.1, and You must inform recipients of\n the Executable Form how they can obtain a copy of such Source Code\n Form by reasonable means in a timely manner, at a charge no more\n than the cost of distribution to the recipient; and\n\n(b) You may distribute such Executable Form under the terms of this\n License, or sublicense it under different terms, provided that the\n license for the Executable Form does not attempt to limit or alter\n the recipients' rights in the Source Code Form under this License.\n\n3.3. Distribution of a Larger Work\n\nYou may create and distribute a Larger Work under terms of Your choice,\nprovided that You also comply with the requirements of this License for\nthe Covered Software. If the Larger Work is a combination of Covered\nSoftware with a work governed by one or more Secondary Licenses, and the\nCovered Software is not Incompatible With Secondary Licenses, this\nLicense permits You to additionally distribute such Covered Software\nunder the terms of such Secondary License(s), so that the recipient of\nthe Larger Work may, at their option, further distribute the Covered\nSoftware under the terms of either this License or such Secondary\nLicense(s).\n\n3.4. Notices\n\nYou may not remove or alter the substance of any license notices\n(including copyright notices, patent notices, disclaimers of warranty,\nor limitations of liability) contained within the Source Code Form of\nthe Covered Software, except that You may alter any license notices to\nthe extent required to remedy known factual inaccuracies.\n\n3.5. Application of Additional Terms\n\nYou may choose to offer, and to charge a fee for, warranty, support,\nindemnity or liability obligations to one or more recipients of Covered\nSoftware. However, You may do so only on Your own behalf, and not on\nbehalf of any Contributor. You must make it absolutely clear that any\nsuch warranty, support, indemnity, or liability obligation is offered by\nYou alone, and You hereby agree to indemnify every Contributor for any\nliability incurred by such Contributor as a result of warranty, support,\nindemnity or liability terms You offer. You may include additional\ndisclaimers of warranty and limitations of liability specific to any\njurisdiction.\n\n4. Inability to Comply Due to Statute or Regulation\n---------------------------------------------------\n\nIf it is impossible for You to comply with any of the terms of this\nLicense with respect to some or all of the Covered Software due to\nstatute, judicial order, or regulation then You must: (a) comply with\nthe terms of this License to the maximum extent possible; and (b)\ndescribe the limitations and the code they affect. Such description must\nbe placed in a text file included with all distributions of the Covered\nSoftware under this License. Except to the extent prohibited by statute\nor regulation, such description must be sufficiently detailed for a\nrecipient of ordinary skill to be able to understand it.\n\n5. Termination\n--------------\n\n5.1. The rights granted under this License will terminate automatically\nif You fail to comply with any of its terms. However, if You become\ncompliant, then the rights granted under this License from a particular\nContributor are reinstated (a) provisionally, unless and until such\nContributor explicitly and finally terminates Your grants, and (b) on an\nongoing basis, if such Contributor fails to notify You of the\nnon-compliance by some reasonable means prior to 60 days after You have\ncome back into compliance. Moreover, Your grants from a particular\nContributor are reinstated on an ongoing basis if such Contributor\nnotifies You of the non-compliance by some reasonable means, this is the\nfirst time You have received notice of non-compliance with this License\nfrom such Contributor, and You become compliant prior to 30 days after\nYour receipt of the notice.\n\n5.2. If You initiate litigation against any entity by asserting a patent\ninfringement claim (excluding declaratory judgment actions,\ncounter-claims, and cross-claims) alleging that a Contributor Version\ndirectly or indirectly infringes any patent, then the rights granted to\nYou by any and all Contributors for the Covered Software under Section\n2.1 of this License shall terminate.\n\n5.3. In the event of termination under Sections 5.1 or 5.2 above, all\nend user license agreements (excluding distributors and resellers) which\nhave been validly granted by You or Your distributors under this License\nprior to termination shall survive termination.\n\n************************************************************************\n* *\n* 6. Disclaimer of Warranty *\n* ------------------------- *\n* *\n* Covered Software is provided under this License on an \"as is\" *\n* basis, without warranty of any kind, either expressed, implied, or *\n* statutory, including, without limitation, warranties that the *\n* Covered Software is free of defects, merchantable, fit for a *\n* particular purpose or non-infringing. The entire risk as to the *\n* quality and performance of the Covered Software is with You. *\n* Should any Covered Software prove defective in any respect, You *\n* (not any Contributor) assume the cost of any necessary servicing, *\n* repair, or correction. This disclaimer of warranty constitutes an *\n* essential part of this License. No use of any Covered Software is *\n* authorized under this License except under this disclaimer. *\n* *\n************************************************************************\n\n************************************************************************\n* *\n* 7. Limitation of Liability *\n* -------------------------- *\n* *\n* Under no circumstances and under no legal theory, whether tort *\n* (including negligence), contract, or otherwise, shall any *\n* Contributor, or anyone who distributes Covered Software as *\n* permitted above, be liable to You for any direct, indirect, *\n* special, incidental, or consequential damages of any character *\n* including, without limitation, damages for lost profits, loss of *\n* goodwill, work stoppage, computer failure or malfunction, or any *\n* and all other commercial damages or losses, even if such party *\n* shall have been informed of the possibility of such damages. This *\n* limitation of liability shall not apply to liability for death or *\n* personal injury resulting from such party's negligence to the *\n* extent applicable law prohibits such limitation. Some *\n* jurisdictions do not allow the exclusion or limitation of *\n* incidental or consequential damages, so this exclusion and *\n* limitation may not apply to You. *\n* *\n************************************************************************\n\n8. Litigation\n-------------\n\nAny litigation relating to this License may be brought only in the\ncourts of a jurisdiction where the defendant maintains its principal\nplace of business and such litigation shall be governed by laws of that\njurisdiction, without reference to its conflict-of-law provisions.\nNothing in this Section shall prevent a party's ability to bring\ncross-claims or counter-claims.\n\n9. Miscellaneous\n----------------\n\nThis License represents the complete agreement concerning the subject\nmatter hereof. If any provision of this License is held to be\nunenforceable, such provision shall be reformed only to the extent\nnecessary to make it enforceable. Any law or regulation which provides\nthat the language of a contract shall be construed against the drafter\nshall not be used to construe this License against a Contributor.\n\n10. Versions of the License\n---------------------------\n\n10.1. New Versions\n\nMozilla Foundation is the license steward. Except as provided in Section\n10.3, no one other than the license steward has the right to modify or\npublish new versions of this License. Each version will be given a\ndistinguishing version number.\n\n10.2. Effect of New Versions\n\nYou may distribute the Covered Software under the terms of the version\nof the License under which You originally received the Covered Software,\nor under the terms of any subsequent version published by the license\nsteward.\n\n10.3. Modified Versions\n\nIf you create software not governed by this License, and you want to\ncreate a new license for such software, you may create and use a\nmodified version of this License if you rename the license and remove\nany references to the name of the license steward (except to note that\nsuch modified license differs from this License).\n\n10.4. Distributing Source Code Form that is Incompatible With Secondary\nLicenses\n\nIf You choose to distribute Source Code Form that is Incompatible With\nSecondary Licenses under the terms of this version of the License, the\nnotice described in Exhibit B of this License must be attached.\n\nExhibit A - Source Code Form License Notice\n-------------------------------------------\n\n This Source Code Form is subject to the terms of the Mozilla Public\n License, v. 2.0. If a copy of the MPL was not distributed with this\n file, You can obtain one at http://mozilla.org/MPL/2.0/.\n\nIf it is not possible or desirable to put the notice in a particular\nfile, then You may include the notice in a location (such as a LICENSE\nfile in a relevant directory) where a recipient would be likely to look\nfor such a notice.\n\nYou may add additional accurate notices of copyright ownership.\n\nExhibit B - \"Incompatible With Secondary Licenses\" Notice\n---------------------------------------------------------\n\n This Source Code Form is \"Incompatible With Secondary Licenses\", as\n defined by the Mozilla Public License, v. 2.0.",
+ "scancode_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/licenses/mpl-2.0.LICENSE",
+ "licensedb_url": "https://scancode-licensedb.aboutcode.org/mpl-2.0",
+ "spdx_url": "https://spdx.org/licenses/MPL-2.0"
+ }
+ ],
+ "license_rule_references": [
+ {
+ "license_expression": "mpl-2.0 OR lgpl-3.0",
+ "identifier": "mpl-2.0_or_lgpl-3.0_1.RULE",
+ "language": "en",
+ "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/mpl-2.0_or_lgpl-3.0_1.RULE",
+ "is_license_text": false,
+ "is_license_notice": false,
+ "is_license_reference": false,
+ "is_license_tag": true,
+ "is_license_intro": false,
+ "is_license_clue": false,
+ "is_continuous": false,
+ "is_builtin": true,
+ "is_from_license": false,
+ "is_synthetic": false,
+ "length": 49,
+ "relevance": 95,
+ "minimum_coverage": 0,
+ "referenced_filenames": [],
+ "ignorable_copyrights": [],
+ "ignorable_holders": [],
+ "ignorable_authors": [],
+ "ignorable_urls": [
+ "http://www.gnu.org/licenses/lgpl.html",
+ "http://www.mozilla.org/MPL/2.0/"
+ ],
+ "ignorable_emails": [],
+ "text": "\n \n GNU General Lesser Public License (LGPL) version 3.0\n http://www.gnu.org/licenses/lgpl.html\n repo\n \n \n Mozilla Public License Version 2.0\n http://www.mozilla.org/MPL/2.0/\n repo\n \n"
+ },
+ {
+ "license_expression": "mpl-2.0 OR lgpl-3.0",
+ "identifier": "mpl-2.0_or_lgpl-3.0_5.RULE",
+ "language": "en",
+ "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/mpl-2.0_or_lgpl-3.0_5.RULE",
+ "is_license_text": false,
+ "is_license_notice": false,
+ "is_license_reference": false,
+ "is_license_tag": true,
+ "is_license_intro": false,
+ "is_license_clue": false,
+ "is_continuous": false,
+ "is_builtin": true,
+ "is_from_license": false,
+ "is_synthetic": false,
+ "length": 33,
+ "relevance": 100,
+ "minimum_coverage": 0,
+ "referenced_filenames": [],
+ "ignorable_copyrights": [],
+ "ignorable_holders": [],
+ "ignorable_authors": [],
+ "ignorable_urls": [
+ "http://www.gnu.org/licenses/lgpl.html",
+ "http://www.mozilla.org/MPL/2.0/"
+ ],
+ "ignorable_emails": [],
+ "text": "name: {{GNU General Lesser Public License (LGPL) version 3.0}}\nurl: http://www.gnu.org/licenses/lgpl.html\nname: {{Mozilla Public License Version 2.0}}\nurl: http://www.mozilla.org/MPL/2.0/"
+ }
+ ],
"files": [
{
"path": "codebase",
diff --git a/scanpipe/tests/data/scancode/is-npm-1.0.0_scan_package.json b/scanpipe/tests/data/scancode/is-npm-1.0.0_scan_package.json
index 24c18299cb..0ac4a49eb5 100644
--- a/scanpipe/tests/data/scancode/is-npm-1.0.0_scan_package.json
+++ b/scanpipe/tests/data/scancode/is-npm-1.0.0_scan_package.json
@@ -8,6 +8,7 @@
"--info": true,
"--license": true,
"--license-text": true,
+ "--license-references": true,
"--package": true,
"--url": true,
"--classify": true,
@@ -206,6 +207,105 @@
]
}
],
+ "license_references": [
+ {
+ "key": "mit",
+ "language": "en",
+ "short_name": "MIT License",
+ "name": "MIT License",
+ "category": "Permissive",
+ "owner": "MIT",
+ "homepage_url": "http://opensource.org/licenses/mit-license.php",
+ "is_builtin": true,
+ "is_exception": false,
+ "is_unknown": false,
+ "is_generic": false,
+ "spdx_license_key": "MIT",
+ "other_spdx_license_keys": [
+ "LicenseRef-MIT-Bootstrap",
+ "LicenseRef-MIT-Discord",
+ "LicenseRef-MIT-TC",
+ "LicenseRef-MIT-Diehl"
+ ],
+ "osi_license_key": null,
+ "text_urls": [
+ "http://opensource.org/licenses/mit-license.php"
+ ],
+ "osi_url": "http://www.opensource.org/licenses/MIT",
+ "faq_url": "https://ieeexplore.ieee.org/document/9263265",
+ "other_urls": [
+ "https://opensource.com/article/18/3/patent-grant-mit-license",
+ "https://opensource.com/article/19/4/history-mit-license",
+ "https://opensource.org/licenses/MIT"
+ ],
+ "key_aliases": [],
+ "minimum_coverage": 0,
+ "standard_notice": null,
+ "ignorable_copyrights": [],
+ "ignorable_holders": [],
+ "ignorable_authors": [],
+ "ignorable_urls": [],
+ "ignorable_emails": [],
+ "text": "Permission is hereby granted, free of charge, to any person obtaining\na copy of this software and associated documentation files (the\n\"Software\"), to deal in the Software without restriction, including\nwithout limitation the rights to use, copy, modify, merge, publish,\ndistribute, sublicense, and/or sell copies of the Software, and to\npermit persons to whom the Software is furnished to do so, subject to\nthe following conditions:\n\nThe above copyright notice and this permission notice shall be\nincluded in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND,\nEXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\nMERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.\nIN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY\nCLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,\nTORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\nSOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.",
+ "scancode_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/licenses/mit.LICENSE",
+ "licensedb_url": "https://scancode-licensedb.aboutcode.org/mit",
+ "spdx_url": "https://spdx.org/licenses/MIT"
+ }
+ ],
+ "license_rule_references": [
+ {
+ "license_expression": "mit",
+ "identifier": "mit_30.RULE",
+ "language": "en",
+ "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/mit_30.RULE",
+ "is_license_text": false,
+ "is_license_notice": false,
+ "is_license_reference": false,
+ "is_license_tag": true,
+ "is_license_intro": false,
+ "is_license_clue": false,
+ "is_continuous": false,
+ "is_builtin": true,
+ "is_from_license": false,
+ "is_synthetic": false,
+ "length": 2,
+ "relevance": 100,
+ "minimum_coverage": 100,
+ "referenced_filenames": [],
+ "ignorable_copyrights": [],
+ "ignorable_holders": [],
+ "ignorable_authors": [],
+ "ignorable_urls": [],
+ "ignorable_emails": [],
+ "text": "License: MIT"
+ },
+ {
+ "license_expression": "mit",
+ "identifier": "spdx-license-identifier-mit-5da48780aba670b0860c46d899ed42a0f243ff06",
+ "language": "en",
+ "rule_url": null,
+ "is_license_text": false,
+ "is_license_notice": false,
+ "is_license_reference": false,
+ "is_license_tag": true,
+ "is_license_intro": false,
+ "is_license_clue": false,
+ "is_continuous": false,
+ "is_builtin": true,
+ "is_from_license": false,
+ "is_synthetic": true,
+ "length": 1,
+ "relevance": 100,
+ "minimum_coverage": 0,
+ "referenced_filenames": [],
+ "ignorable_copyrights": [],
+ "ignorable_holders": [],
+ "ignorable_authors": [],
+ "ignorable_urls": [],
+ "ignorable_emails": [],
+ "text": "MIT"
+ }
+ ],
"files": [
{
"path": "codebase",
diff --git a/scanpipe/tests/data/scancode/multiple-is-npm-1.0.0_scan_package.json b/scanpipe/tests/data/scancode/multiple-is-npm-1.0.0_scan_package.json
index 6ed69bf238..b9524d0eda 100644
--- a/scanpipe/tests/data/scancode/multiple-is-npm-1.0.0_scan_package.json
+++ b/scanpipe/tests/data/scancode/multiple-is-npm-1.0.0_scan_package.json
@@ -8,6 +8,7 @@
"--info": true,
"--license": true,
"--license-text": true,
+ "--license-references": true,
"--package": true,
"--url": true,
"--classify": true,
@@ -309,6 +310,105 @@
]
}
],
+ "license_references": [
+ {
+ "key": "mit",
+ "language": "en",
+ "short_name": "MIT License",
+ "name": "MIT License",
+ "category": "Permissive",
+ "owner": "MIT",
+ "homepage_url": "http://opensource.org/licenses/mit-license.php",
+ "is_builtin": true,
+ "is_exception": false,
+ "is_unknown": false,
+ "is_generic": false,
+ "spdx_license_key": "MIT",
+ "other_spdx_license_keys": [
+ "LicenseRef-MIT-Bootstrap",
+ "LicenseRef-MIT-Discord",
+ "LicenseRef-MIT-TC",
+ "LicenseRef-MIT-Diehl"
+ ],
+ "osi_license_key": null,
+ "text_urls": [
+ "http://opensource.org/licenses/mit-license.php"
+ ],
+ "osi_url": "http://www.opensource.org/licenses/MIT",
+ "faq_url": "https://ieeexplore.ieee.org/document/9263265",
+ "other_urls": [
+ "https://opensource.com/article/18/3/patent-grant-mit-license",
+ "https://opensource.com/article/19/4/history-mit-license",
+ "https://opensource.org/licenses/MIT"
+ ],
+ "key_aliases": [],
+ "minimum_coverage": 0,
+ "standard_notice": null,
+ "ignorable_copyrights": [],
+ "ignorable_holders": [],
+ "ignorable_authors": [],
+ "ignorable_urls": [],
+ "ignorable_emails": [],
+ "text": "Permission is hereby granted, free of charge, to any person obtaining\na copy of this software and associated documentation files (the\n\"Software\"), to deal in the Software without restriction, including\nwithout limitation the rights to use, copy, modify, merge, publish,\ndistribute, sublicense, and/or sell copies of the Software, and to\npermit persons to whom the Software is furnished to do so, subject to\nthe following conditions:\n\nThe above copyright notice and this permission notice shall be\nincluded in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND,\nEXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF\nMERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.\nIN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY\nCLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,\nTORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE\nSOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.",
+ "scancode_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/licenses/mit.LICENSE",
+ "licensedb_url": "https://scancode-licensedb.aboutcode.org/mit",
+ "spdx_url": "https://spdx.org/licenses/MIT"
+ }
+ ],
+ "license_rule_references": [
+ {
+ "license_expression": "mit",
+ "identifier": "mit_30.RULE",
+ "language": "en",
+ "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/mit_30.RULE",
+ "is_license_text": false,
+ "is_license_notice": false,
+ "is_license_reference": false,
+ "is_license_tag": true,
+ "is_license_intro": false,
+ "is_license_clue": false,
+ "is_continuous": false,
+ "is_builtin": true,
+ "is_from_license": false,
+ "is_synthetic": false,
+ "length": 2,
+ "relevance": 100,
+ "minimum_coverage": 100,
+ "referenced_filenames": [],
+ "ignorable_copyrights": [],
+ "ignorable_holders": [],
+ "ignorable_authors": [],
+ "ignorable_urls": [],
+ "ignorable_emails": [],
+ "text": "License: MIT"
+ },
+ {
+ "license_expression": "mit",
+ "identifier": "spdx-license-identifier-mit-5da48780aba670b0860c46d899ed42a0f243ff06",
+ "language": "en",
+ "rule_url": null,
+ "is_license_text": false,
+ "is_license_notice": false,
+ "is_license_reference": false,
+ "is_license_tag": true,
+ "is_license_intro": false,
+ "is_license_clue": false,
+ "is_continuous": false,
+ "is_builtin": true,
+ "is_from_license": false,
+ "is_synthetic": true,
+ "length": 1,
+ "relevance": 100,
+ "minimum_coverage": 0,
+ "referenced_filenames": [],
+ "ignorable_copyrights": [],
+ "ignorable_holders": [],
+ "ignorable_authors": [],
+ "ignorable_urls": [],
+ "ignorable_emails": [],
+ "text": "MIT"
+ }
+ ],
"files": [
{
"path": "codebase",