License inconsistancy

Question

License inconsistancy

HSH73 opened this issue 5 months ago · 6 comments

The applicable license is identified as Apache 2.0, but https://github.com/cowtowncoder/java-uuid-generator/blob/java-uuid-generator-5.1.0/index.html#L56 seems to indicate a dual licensing between Apache and LGPL 2.0 "only".
Please clarify if this project is dual licensed or not, if it is not the reference to the LGPL should be deleted.

Answer 1 · 2024-08-16T16:04:37.000Z

It's just Apache; LGPL used to be an option long time ago (via differently named jar, I think). Will change.

Answer 2 · 2024-08-16T17:24:53.000Z

WTH? Reference is to some old tag; README.md does not have this any more.
Why report something for old obsolete version?!

Closing.

Answer 3 · 2024-08-17T05:28:23.000Z

Agree & Thanks for clarifying! Von: Tatu Saloranta ***@***.***> Gesendet: Freitag, 16. August 2024 19:25 An: cowtowncoder/java-uuid-generator ***@***.***> Cc: HSH73 ***@***.***>; Author ***@***.***> Betreff: Re: [cowtowncoder/java-uuid-generator] License inconsistancy (Issue #117) WTH? Reference is to some old tag; README.md does not have this any more. Closing. — Reply to this email directly, view it on GitHub <#117 (comment)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3CVKHG7MTB2LG4HP5LSMELZRYYXVAVCNFSM6AAAAABMTXQTQ2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDEOJTHA4DGNJQG4> . You are receiving this because you authored the thread.Message ID: ***@***.***>

Answer 4 · 2024-08-17T05:48:49.000Z

For clarity: We are using the latest version (5.1.0), but in the scanning process for license compliance the reference to LGPL in index.html is still found and automatically reported in the tool (ORT) as copyleft reference. I took from your comment that the only relevant license reference to all current versions must only be taken from the LICENSE and the README.MD, and the reference in index.html is outdated and can be simply ignored. Von: Tatu Saloranta ***@***.***> Gesendet: Freitag, 16. August 2024 19:25 An: cowtowncoder/java-uuid-generator ***@***.***> Cc: HSH73 ***@***.***>; Author ***@***.***> Betreff: Re: [cowtowncoder/java-uuid-generator] License inconsistancy (Issue #117) WTH? Reference is to some old tag; README.md does not have this any more. Closing. — Reply to this email directly, <#117 (comment)> view it on GitHub, or <https://github.com/notifications/unsubscribe-auth/A3CVKHG7MTB2LG4HP5LSMELZRYYXVAVCNFSM6AAAAABMTXQTQ2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDEOJTHA4DGNJQG4> unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>

Answer 5 · 2024-08-19T02:38:42.000Z

@HSH73 Correct. Definite license information should come from either LICENSE included in jar, or, if that was not there, pom.xml (Maven project def) that is included.

index.html should not be included with binary (jar), but perhaps it is included in the source bundle or something, that scanner locates. I am assuming these are all heuristic tools that try to index information from multiple sources, to the best of their abilities :)

Thank you for explaining background: I was surprised at first but your explanation makes sense.

Answer 6 · 2024-08-19T04:25:17.000Z

Exactly. Given (i) a larger number of different code from various sources is used in many projects and (ii) license and copyright information could be “hidden” everywhere (from experience, although such info SHOULD only be included in certain places as mentioned by you, many developers/projects do not follow such best practices, and it gets often rather complicated if they base their work on previous work without mentioning it clearly where snippets of other licenses are then detected at various places), the scanning process tends to collect any info it can get its hand on. Probably a question of settings, but to be on the safe side not an unusual approach for running such scans. Von: Tatu Saloranta ***@***.***> Gesendet: Montag, 19. August 2024 04:39 An: cowtowncoder/java-uuid-generator ***@***.***> Cc: HSH73 ***@***.***>; Mention ***@***.***> Betreff: Re: [cowtowncoder/java-uuid-generator] License inconsistancy (Issue #117) @HSH73 <https://github.com/HSH73> Correct. Definite license information should come from either LICENSE included in jar, or, if that was not there, pom.xml (Maven project def) that is included. index.html should not be included with binary (jar), but perhaps it is included in the source bundle or something, that scanner locates. I am assuming these are all heuristic tools that try to index information from multiple sources, to the best of their abilities :) Thank you for explaining background: I was surprised at first but your explanation makes sense. — Reply to this email directly, view it on GitHub <#117 (comment)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/A3CVKHAT4ILWZC7HAZSVWLLZSFLETAVCNFSM6AAAAABMTXQTQ2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDEOJVGU2TQOJVHA> . You are receiving this because you were mentioned.Message ID: ***@***.***>