jk1/Gradle-License-Report

Extracting the most accurate license

Opened this issue · 1 comments

I've just stumbled over the singleModuleLicenseInfo in LicenseDataCollector.groovy:

static List<String> singleModuleLicenseInfo(ModuleData data) {
def info = multiModuleLicenseInfo(data)
def moduleUrl = lastOrNull(info.moduleUrls)
def license = lastOrNull(info.licenses)
def moduleLicense = license?.name
def moduleLicenseUrl = license?.url
[moduleUrl, moduleLicense, moduleLicenseUrl]
}

Shouldn't be firstOrNull(...) used for the extraction of the most accurate license?

For example:

From this license chain, I'd assume EDL being the most appropriate license when asking for a single license information about saaj-impl, and that's what displayed by mvnrepository.com, too. But singleModuleLicenseInfo(...) is returning GPLv2.

Well... now I've read the next method, where you build the MultiLicenseInfo-object: My suggestion to use firstOrNull is wrong without further work ;-).

The issue in my example is that LICENSE.md included in com.sun.xml.messaging.saaj:saaj-impl:1.5.3 (which declares an EDLv1 license) isn't appended to info.license, as the license is already in the list:

data.licenseFiles*.fileDetails.flatten().each { LicenseFileDetails details ->
if (!info.licenses.find { it.name == details.license }) {
if (details.license || details.licenseUrl) {
info.licenses << new License(name: details.license, url: details.licenseUrl)
}
}
}