Extracting the most accurate license
Opened this issue · 1 comments
I've just stumbled over the singleModuleLicenseInfo
in LicenseDataCollector.groovy
:
Shouldn't be firstOrNull(...)
used for the extraction of the most accurate license?
For example:
- com.sun.xml.messaging.saaj:saaj-impl:1.5.3 doesn't declare a license
- the parent pom com.sun.xml.messaging.saaj:metro-saaj:1.5.3 declares an EDLv1 license
- the grandparent pom org.eclipse.ee4j:project:1.0.6 declares an EPLv2 and a GPLv2 license
From this license chain, I'd assume EDL being the most appropriate license when asking for a single license information about saaj-impl
, and that's what displayed by mvnrepository.com, too. But singleModuleLicenseInfo(...)
is returning GPLv2.
Well... now I've read the next method, where you build the MultiLicenseInfo
-object: My suggestion to use firstOrNull
is wrong without further work ;-).
The issue in my example is that LICENSE.md
included in com.sun.xml.messaging.saaj:saaj-impl:1.5.3
(which declares an EDLv1 license) isn't appended to info.license
, as the license is already in the list: