Skip to content

fix spdx identifier#221

Open
thompson-tomo wants to merge 1 commit into
halostatue:mainfrom
thompson-tomo:patch-1
Open

fix spdx identifier#221
thompson-tomo wants to merge 1 commit into
halostatue:mainfrom
thompson-tomo:patch-1

Conversation

@thompson-tomo
Copy link
Copy Markdown

@thompson-tomo thompson-tomo commented Mar 21, 2026

This tweaks the spdx license identifier as currently tools such as Fossa are having issues processing the declaration as it was not a valid expression. This moves the links to be in the paragraph.

For reference this how it currently appears in fossa: https://app.fossa.com/projects/custom%2B162%2Fgithub.com%2Fopen-telemetry%2Fopentelemetry-ruby-contrib/refs/branch/main/c1030d11596cbcd6c3a5641047abbb5ac77b54c6/browse/dependencies?title=diff-&sources%5B0%5D=managed&revisionScanId=100223864

@halostatue
Copy link
Copy Markdown
Owner

I'd be more interested in seeing the failing scan logs, because it seems to have the licence correct if for an older version of diff-lcs.

I'm disinclined to accept this PR for a number of reasons.

@thompson-tomo
Copy link
Copy Markdown
Author

thompson-tomo commented Mar 21, 2026

@halostatue it is not correct though, as it has treated it as 3 seperate licences whereas it should be 1 licence with 3 options seperated by the or operator. See https://app.fossa.com/projects/custom%2B162%2Fgithub.com%2Fopen-telemetry%2Fopentelemetry-ruby-contrib/refs/branch/main/c1030d11596cbcd6c3a5641047abbb5ac77b54c6/browse/dependencies?title=Net-pop&sources%5B0%5D=managed&revisionScanId=100223864 as an example of how it should be reporting.

Key thing is the identifier currently specified is not a valid expression as per https://spdx.github.io/spdx-spec/v2.3/SPDX-license-expressions/ as the linking breaks it, hence the only change is to move the links to the paragraph.

Further it is also detecting a gpl-2.0-only license which is wrong.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants