Make simple license mappings more strict #10334

sschuberth · 2025-05-15T11:04:03Z

Please have a look at the individual commit messages for the details.

sschuberth · 2025-05-15T11:09:44Z

utils/spdx/src/main/resources/simple-license-mapping.yml

@@ -22,34 +22,8 @@
 # Sort the entries below via IntelliJ's "Edit" -> "Sort Lines".
 ---

-# Ambiguous mappings (mapping reason not obvious without additional information)


As you can see, the new check accurately removes all entries that were already deemed to be ambiguous. Additionally, it removes some entries that probably should have been regarded to be ambiguous in the first place as well.

utils/spdx/src/main/kotlin/SpdxSimpleLicenseMapping.kt

utils/spdx/src/main/resources/simple-license-mapping.yml

@@ -23,41 +23,22 @@
 ---

 AFLv2.1: AFL-2.1
-ALv2: Apache-2.0


sschuberth · 2025-05-15T11:17:01Z

@oss-review-toolkit/core-devs I would really like to finally get rid of the ambiguous simple license mappings that we already identified quite some time ago. I have implemented two variants via a check: A lenient and a stricter one. Let's discuss whether we can at least get the lenient check in. To me it's important that the criteria for checking ambiguity are objective and reproducible by tests.

fviernau · 2025-05-15T11:16:11Z

utils/spdx/src/test/kotlin/SpdxSimpleLicenseMappingTest.kt

@@ -57,6 +57,23 @@ class SpdxSimpleLicenseMappingTest : WordSpec({
                if (license.id.endsWith("-only")) key should containADigit()
            }
        }
+
+        "contain equal digits omitting trailing zeros" {
+            val exceptions = mapOf(


There are license IDs which have dates in their identifier, e.g. some LicenseRef-scancode-* licenses.
There may be further cases, where this heuristic fails.

I'd be fine with adding anything that start with LicenseRef- to the list of exceptions. But we don't have such mappings currently anyway.

utils/spdx/src/main/resources/simple-license-mapping.yml

fviernau · 2025-05-15T11:20:09Z

utils/spdx/src/main/resources/simple-license-mapping.yml

 BSD-3: BSD-3-Clause
 BSD2: BSD-2-Clause
 BSD3: BSD-3-Clause
 Bouncy: MIT
 EDL-1.0: BSD-3-Clause
 FreeBSD: BSD-2-Clause-Views
-GPL-2: GPL-2.0-only
-GPL2: GPL-2.0-only


I prefer not to remove these entries, but instead separate them.
So, their use can be configured.

Making simple license mappings configurable is certainly a good idea, but out of scope of this PR. I first like to get the baseline clean.

Agree with @fviernau we can't remove these declared license mappings - this will cause major service disruption for many ORT users.

I'm fine with simply dropping this last, stricter commit from the PR. Would that resolve any of your concerns?

I would propose a splitting out the (not so risky) ambiguous ones and introduce a ambiguousMappingsEnabled configuration option.

Please, not yet more configuration options 🙄

I'm dropped top-most commit which removed those entries.

codecov · 2025-05-15T11:31:20Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 56.75%. Comparing base (23a177b) to head (89ebd75).
Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #10334   +/-   ##
=========================================
  Coverage     56.75%   56.75%           
+ Complexity     1644     1642    -2     
=========================================
  Files           337      337           
  Lines         12480    12480           
  Branches       1177     1177           
=========================================
  Hits           7083     7083           
  Misses         4945     4945           
  Partials        452      452

Flag	Coverage Δ
funTest-docker	`71.03% <ø> (ø)`
funTest-non-docker	`32.97% <ø> (-0.14%)`	⬇️
test-ubuntu-24.04	`41.04% <ø> (ø)`
test-windows-2022	`41.02% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

tsteenbe · 2025-05-15T12:00:04Z

utils/spdx/src/main/resources/simple-license-mapping.yml

 BSD-3: BSD-3-Clause
 BSD2: BSD-2-Clause
 BSD3: BSD-3-Clause
 Bouncy: MIT
 EDL-1.0: BSD-3-Clause
 FreeBSD: BSD-2-Clause-Views
-GPL-2: GPL-2.0-only
-GPL2: GPL-2.0-only


Agree with @fviernau we can't remove these declared license mappings - this will cause major service disruption for many ORT users.

MarcelBochtler · 2025-06-12T11:19:52Z

Consider adding information about the breaking change to the commit message and how users can deal with it.

sschuberth · 2025-06-18T11:08:28Z

Consider adding information about the breaking change to the commit message and how users can deal with it.

I've reworded the commit message.

Can we now please move forward with this @oss-review-toolkit/tsc?

…gits In order to remove the already identified ambiguous mappings, stricten the check to require matching digits (disregarding trailing zeros) in keys and values for each mapping. This logic works for all ambiguous mappings except for `ALv2: Apache-2.0`, which is now accepted as being non-ambiguous because "2.0" is reduced to "2" which matches the digit in the key. Additionally, this logic identified 12 previously "Non-ambiguous mappings" to be in fact ambiguous because they have no or too little indication of a version. BREAKING CHANGE: Users who rely on the previous mappings need to create package curations with respective `declaredLicenseMapping`s. Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.org>

sschuberth commented May 15, 2025

View reviewed changes

fviernau reviewed May 15, 2025

View reviewed changes

utils/spdx/src/main/kotlin/SpdxSimpleLicenseMapping.kt Outdated Show resolved Hide resolved

sschuberth commented May 15, 2025

View reviewed changes

utils/spdx/src/main/resources/simple-license-mapping.yml

@@ -23,41 +23,22 @@

---

AFLv2.1: AFL-2.1

ALv2: Apache-2.0

This comment was marked as outdated.

Sign in to view

sschuberth force-pushed the simple-license-mappings branch from f43a1fa to b922c7d Compare May 15, 2025 11:14

fviernau requested changes May 15, 2025

View reviewed changes

fviernau requested a review from tsteenbe May 15, 2025 11:20

tsteenbe requested changes May 15, 2025

View reviewed changes

This comment was marked as resolved.

Sign in to view

sschuberth force-pushed the simple-license-mappings branch 2 times, most recently from 17fdde3 to 2958258 Compare June 12, 2025 07:20

sschuberth marked this pull request as ready for review June 12, 2025 07:22

sschuberth requested a review from a team as a code owner June 12, 2025 07:22

sschuberth enabled auto-merge (rebase) June 12, 2025 07:22

sschuberth requested review from fviernau and tsteenbe June 12, 2025 07:22

sschuberth force-pushed the simple-license-mappings branch 4 times, most recently from 13b24d6 to ddbbfbc Compare June 12, 2025 07:54

sschuberth force-pushed the simple-license-mappings branch from ddbbfbc to ba1a9bf Compare June 18, 2025 11:07

sschuberth force-pushed the simple-license-mappings branch from ba1a9bf to ba41a24 Compare June 18, 2025 11:34

sschuberth force-pushed the simple-license-mappings branch from ba41a24 to 89ebd75 Compare June 18, 2025 13:03

mnonnenmacher approved these changes Jun 19, 2025

View reviewed changes

Make simple license mappings more strict #10334

Are you sure you want to change the base?

Make simple license mappings more strict #10334

Uh oh!

Conversation

sschuberth commented May 15, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

sschuberth commented May 15, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented May 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

MarcelBochtler commented Jun 12, 2025

Uh oh!

sschuberth commented Jun 18, 2025

Uh oh!

Uh oh!

codecov bot commented May 15, 2025 •

edited

Loading