Skip to content

Incorrect declared license information (maven) #618

@ariel11

Description

@ariel11

For the package https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-server/, ClearlyDefined has determined three different "declared" license results and they are all incorrect in part. I looked into these three examples and include my findings below.
image

  1. For version 10.0.23, there's a SPDX expression in the LICENSE file that says "SPDX-License-Identifier: EPL-2.0 OR Apache-2.0." I'm not sure why ClearlyDefined put "Apache-2.0 AND EPL-2.0" on one side of the "OR" (see screenshot above) - this is incorrect.

  2. For version 12.0.12, the module-info file has the same "SPDX-License-Identifier: EPL-2.0 OR Apache-2.0," which should be the declared field. However, ClearlyDefined is reporting this as just "Apache-2.0" - this is incorrect.
    image

  3. For version 9.4.55.v20240627, the about.html file has the dual license information (this older package has EPL-1.0 instead of EPL-2.0). There is also a LICENSE file with EPL 1.0 and Apache-2.0. It looks like ClearlyDefined is including all the discovered licenses in the declared field.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions