Merge branch 'develop' into update-licenses

pombredanne · web-flow · commit 438ab2de3e8f · 2025-05-11T10:43:21.000+02:00
diff --git a/AUTHORS.rst b/AUTHORS.rst
@@ -3,6 +3,7 @@ The following organizations or individuals have contributed to ScanCode:
 - Abhigyan Kumar Singh @Abhigyankrsingh
 - Abhishek Kumar @Abhishek-Dev09
 - Aditya Viki @adityaviki
+- Adrian Braemer @abraemer
 - Agni Bhattacharyya @PyAgni
 - Akanksha Garg @akugarg
 - Alex Blekhman @a-tinsmith
diff --git a/src/licensedcode/data/licenses/dumb.LICENSE b/src/licensedcode/data/licenses/dumb.LICENSE
@@ -0,0 +1,108 @@
+---
+key: dumb
+short_name: DUMB License
+name: DUMB License
+category: Permissive
+owner: kode54
+homepage_url: https://github.com/kode54/dumb
+spdx_license_key: DUMB
+text_urls:
+    - https://github.com/kode54/dumb/blob/master/LICENSE
+other_urls:
+    - https://github.com/ZDoom/ZMusic/blob/master/licenses/legal.txt
+ignorable_copyrights:
+    - Copyright (c) 2001-2005 Ben Davis, Robert J Ohannessian and Julien Cugniere
+ignorable_holders:
+    - Ben Davis, Robert J Ohannessian and Julien Cugniere
+ignorable_urls:
+    - http://dumb.sf.net/
+    - http://www.gnu.org/philosophy/bsd.html 
+---
+
+/*  _______         ____    __         ___    ___
+ * \    _  \       \    /  \  /       \   \  /   /       '   '  '
+ *  |  | \  \       |  |    ||         |   \/   |         .      .
+ *  |  |  |  |      |  |    ||         ||\  /|  |
+ *  |  |  |  |      |  |    ||         || \/ |  |         '  '  '
+ *  |  |  |  |      |  |    ||         ||    |  |         .      .
+ *  |  |_/  /        \  \__//          ||    |  |
+ * /_______/ynamic    \____/niversal  /__\  /____\usic   /|  .  . ibliotheque
+ *                                                      /  \
+ *                                                     / .  \
+ * licence.txt - Conditions for use of DUMB.          / / \  \
+ *                                                   | <  /   \_
+ * If you do not agree to these terms, please        |  \/ /\   /
+ * do not use DUMB.                                   \_  /  > /
+ *                                                      | \ / /
+ * Information in [brackets] is provided to aid         |  ' /
+ * interpretation of the licence.                        \__/
+ */
+
+
+Dynamic Universal Music Bibliotheque, Version 0.9.3
+
+Copyright (C) 2001-2005 Ben Davis, Robert J Ohannessian and Julien Cugniere
+
+This software is provided 'as-is', without any express or implied warranty.
+In no event shall the authors be held liable for any damages arising from the
+use of this software.
+
+Permission is granted to anyone to use this software for any purpose,
+including commercial applications, and to alter it and redistribute it
+freely, subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not claim
+   that you wrote the original software. If you use this software in a
+   product, you are requested to acknowledge its use in the product
+   documentation, along with details on where to get an unmodified version of
+   this software, but this is not a strict requirement.
+
+   [Note that the above point asks for a link to DUMB, not just a mention.
+   Googling for DUMB doesn't help much! The URL is "http://dumb.sf.net/".]
+
+   [The link was originally strictly required. This was changed for two
+   reasons. Firstly, if many projects request an acknowledgement, the list of
+   acknowledgements can become quite unmanageable. Secondly, DUMB was placing
+   a restriction on the code using it, preventing people from using the GNU
+   General Public Licence which disallows any such restrictions. See
+   http://www.gnu.org/philosophy/bsd.html for more information on this
+   subject. However, if DUMB plays a significant part in your project, we do
+   urge you to acknowledge its use.]
+
+2. Altered source versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+
+3. This notice may not be removed from or altered in any source distribution.
+
+4. If you are using the Program in someone else's bedroom on any Monday at
+   3:05 pm, you are not allowed to modify the Program for ten minutes. [This
+   clause provided by Inphernic; every licence should contain at least one
+   clause, the reasoning behind which is far from obvious.]
+
+5. Users who wish to use DUMB for the specific purpose of playing music are
+   required to feed their dog on every full moon (if deemed appropriate).
+   [This clause provided by Allefant, who couldn't remember what Inphernic's
+   clause was.]
+
+6. No clause in this licence shall prevent this software from being depended
+   upon by a product licensed under the GNU General Public Licence. If such a
+   clause is deemed to exist, Debian, then it shall be respected in spirit as
+   far as possible and all other clauses shall continue to apply in full
+   force.
+
+8. Take the number stated as introducing this clause. Multiply it by two,
+   then subtract four. Now insert a '+' between the two digits and evaluate
+   the resulting sum. Call the result 'x'. If you have not yet concluded that
+   every numbered clause in this licence whose ordinal number is strictly
+   greater than 'x' (with the exception of the present clause) is null and
+   void, Debian, then you are hereby informed that laughter is good for one's
+   health and you are warmly suggested to do it. By the way, Clauses 4, 5 and
+   6 are null and void. Incidentally, I like Kubuntu. The work you guys do is
+   awesome. (Lawyers, on the other hand ...)
+
+We regret that we cannot provide any warranty, not even the implied warranty
+of merchantability or fitness for a particular purpose.
+
+Some files generated or copied by automake, autoconf and friends are
+available in an extra download. These fall under separate licences but are
+all free to distribute. Please check their licences as necessary.
diff --git a/src/packagedcode/build.py b/src/packagedcode/build.py
@@ -13,6 +13,7 @@
 from collections import defaultdict
 
 from commoncode import fileutils
+from packageurl import PackageURL
 
 from licensedcode.cache import build_spdx_license_expression
 from licensedcode.cache import get_cache
@@ -374,54 +375,51 @@ def parse(cls, location, package_only=True):
                 )
             )
 
-        if (
-            'upstream_type'
-            and 'name'
-            and 'version'
-            and 'licenses'
-            and 'upstream_address'
-            in metadata_fields
-        ):
-            # TODO: Create function that determines package type from download URL,
-            # then create a package of that package type from the metadata info
-            package_data = dict(
-                datasource_id=cls.datasource_id,
-                type=metadata_fields.get('upstream_type', cls.default_package_type),
-                name=metadata_fields.get('name'),
-                version=metadata_fields.get('version'),
-                extracted_license_statement=metadata_fields.get('licenses', []),
-                parties=parties,
-                homepage_url=metadata_fields.get('upstream_address', ''),
-                # TODO: Store 'upstream_hash` somewhere
-            )
-            yield models.PackageData.from_data(package_data, package_only=True)
-
-        if (
-            'package_type'
-            and 'name'
-            and 'version'
-            and 'license_expression'
-            and 'homepage_url'
-            and 'download_url'
-            and 'vcs_url'
-            and 'download_archive_sha1'
-            and 'vcs_commit_hash'
-            in metadata_fields
-        ):
-            package_data = dict(
-                datasource_id=cls.datasource_id,
-                type=metadata_fields.get('package_type', cls.default_package_type),
-                name=metadata_fields.get('name'),
-                version=metadata_fields.get('version'),
-                extracted_license_statement=metadata_fields.get('license_expression', ''),
-                parties=parties,
-                homepage_url=metadata_fields.get('homepage_url', ''),
-                download_url=metadata_fields.get('download_url', ''),
-                vcs_url=metadata_fields.get('vcs_url', ''),
-                sha1=metadata_fields.get('download_archive_sha1', ''),
-                extra_data=dict(vcs_commit_hash=metadata_fields.get('vcs_commit_hash', ''))
-            )
-            yield models.PackageData.from_data(package_data, package_only=True)
+        # TODO: Create function that determines package type from download URL,
+        # then create a package of that package type from the metadata info
+        
+        if 'upstream_type' in metadata_fields:
+            package_type = metadata_fields['upstream_type']
+        elif 'package_type' in metadata_fields:
+            package_type = metadata_fields['package_type']
+        else:
+            package_type = cls.default_package_type
+
+        if 'licenses' in metadata_fields:
+            extracted_license_statement = metadata_fields['licenses']
+        else:
+            extracted_license_statement = metadata_fields.get('license_expression')
+
+        if 'upstream_address' in metadata_fields:
+            homepage_url = metadata_fields['upstream_address']
+        else:
+            homepage_url = metadata_fields.get('homepage_url')
+        
+
+        extra_data = {}
+        if 'vcs_commit_hash' in metadata_fields:
+            extra_data['vcs_commit_hash'] = metadata_fields['vcs_commit_hash']
+        if 'upstream_hash' in metadata_fields:
+            extra_data['upstream_hash'] = metadata_fields['upstream_hash']
+
+        package_data = dict(
+            datasource_id=cls.datasource_id,
+            type=package_type,
+            name=metadata_fields.get('name'),
+            version=metadata_fields.get('version'),
+            extracted_license_statement=extracted_license_statement,
+            parties=parties,
+            homepage_url=homepage_url,
+            download_url=metadata_fields.get('download_url'),
+            vcs_url=metadata_fields.get('vcs_url'),
+            sha1=metadata_fields.get('download_archive_sha1'),
+            extra_data=extra_data
+        )
+        if 'package_url' in metadata_fields:
+            package_data.update(PackageURL.from_string(metadata_fields['package_url']).to_dict())
+        
+        yield models.PackageData.from_data(package_data, package_only=True)
+
 
     @classmethod
     def assign_package_to_resources(cls, package, resource, codebase, package_adder):
diff --git a/tests/licensedcode/data/false_positive/false-positive-gpl3.txt b/tests/licensedcode/data/false_positive/false-positive-gpl3.txt
@@ -0,0 +1,17 @@
+    .chip	= {
+        .base	= S5PC100_GPL1(0),
+        .ngpio	= S5PC100_GPIO_L1_NR,
+        .label	= "GPL1",
+    },
+}, {
+    .chip	= {
+        .base	= S5PC100_GPL2(0),
+        .ngpio	= S5PC100_GPIO_L2_NR,
+        .label	= "GPL2",
+    },
+}, {
+    .chip	= {
+        .base	= S5PC100_GPL3(0),
+        .ngpio	= S5PC100_GPIO_L3_NR,
+        .label	= "GPL3",
+    },
diff --git a/tests/licensedcode/test_detect.py b/tests/licensedcode/test_detect.py
@@ -1325,3 +1325,10 @@ def test_detection_return_correct_mit_not_apache_using_full_index(self):
         matches = idx.match(location=query_location)
         results = [m.rule.license_expression for m in matches]
         assert results == expected
+
+    def test_detection_returns_correct_no_gpl3_false_positive(self):
+        idx = cache.get_index()
+        query_location = self.get_test_loc('false_positive/false-positive-gpl3.txt')
+        matches = idx.match(location=query_location)
+        assert not matches
+    
diff --git a/tests/packagedcode/data/build/metadatabzl/with-package-url/METADATA.bzl b/tests/packagedcode/data/build/metadatabzl/with-package-url/METADATA.bzl
@@ -0,0 +1,12 @@
+METADATA = {
+    "licenses": [
+        "BSD-3-Clause",
+    ],
+    "maintainers": [
+        "oss_foundation",
+    ],
+    "name": "androidx.compose.animation:animation",
+    "upstream_address": "https://developer.android.com/jetpack/androidx/releases/compose-animation#0.0.1",
+    "version": "0.0.1",
+    "package_url" : "pkg:maven/androidx.compose.animation/animation@0.0.1"
+}
diff --git a/tests/packagedcode/test_build.py b/tests/packagedcode/test_build.py
@@ -99,10 +99,33 @@ def test_MetadataBzl_parse(self):
                     role='maintainer'
                 )
             ],
+            extra_data=dict(upstream_hash='deadbeef'),
             homepage_url='https://github.com/example/example',
         )
         expected_packages = [models.PackageData.from_data(package_data=package_data, package_only=True)]
         compare_package_results(expected_packages, result_packages)
+    
+    def test_MetadataBzl_parse_with_package_url(self):
+        test_file = self.get_test_loc('metadatabzl/with-package-url/METADATA.bzl')
+        result_packages = build.BuckMetadataBzlHandler.parse(test_file, package_only=True)
+        package_data = dict(
+            datasource_id=build.BuckMetadataBzlHandler.datasource_id,
+            name='animation',
+            namespace='androidx.compose.animation',
+            type='maven',
+            version='0.0.1',
+            extracted_license_statement=['BSD-3-Clause'],
+            parties=[
+                models.Party(
+                    type=models.party_org,
+                    name='oss_foundation',
+                    role='maintainer'
+                )
+            ],
+            homepage_url='https://developer.android.com/jetpack/androidx/releases/compose-animation#0.0.1',
+        )
+        expected_packages = [models.PackageData.from_data(package_data=package_data, package_only=True)]
+        compare_package_results(expected_packages, result_packages)
 
     def test_MetadataBzl_recognize_new_format(self):
         test_file = self.get_test_loc('metadatabzl/new-format/METADATA.bzl')
