{"action":"created","issue":{"url":"https://api.github.com/repos/fabric8-analytics/fabric8-analytics-worker/issues/465","repository_url":"https://api.github.com/repos/fabric8-analytics/fabric8-analytics-worker","labels_url":"https://api.github.com/repos/fabric8-analytics/fabric8-analytics-worker/issues/465/labels{/name}","comments_url":"https://api.github.com/repos/fabric8-analytics/fabric8-analytics-worker/issues/465/comments","events_url":"https://api.github.com/repos/fabric8-analytics/fabric8-analytics-worker/issues/465/events","html_url":"https://github.com/fabric8-analytics/fabric8-analytics-worker/pull/465","id":279628019,"number":465,"title":"use declared_licenses instead of licenses (detected)","user":{"login":"miteshvp","id":17736013,"avatar_url":"https://avatars2.githubusercontent.com/u/17736013?v=4","gravatar_id":"","url":"https://api.github.com/users/miteshvp","html_url":"https://github.com/miteshvp","followers_url":"https://api.github.com/users/miteshvp/followers","following_url":"https://api.github.com/users/miteshvp/following{/other_user}","gists_url":"https://api.github.com/users/miteshvp/gists{/gist_id}","starred_url":"https://api.github.com/users/miteshvp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/miteshvp/subscriptions","organizations_url":"https://api.github.com/users/miteshvp/orgs","repos_url":"https://api.github.com/users/miteshvp/repos","events_url":"https://api.github.com/users/miteshvp/events{/privacy}","received_events_url":"https://api.github.com/users/miteshvp/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2017-12-06T05:02:22Z","updated_at":"2017-12-12T15:07:30Z","closed_at":null,"author_association":"OWNER","pull_request":{"url":"https://api.github.com/repos/fabric8-analytics/fabric8-analytics-worker/pulls/465","html_url":"https://github.com/fabric8-analytics/fabric8-analytics-worker/pull/465","diff_url":"https://github.com/fabric8-analytics/fabric8-analytics-worker/pull/465.diff","patch_url":"https://github.com/fabric8-analytics/fabric8-analytics-worker/pull/465.patch"},"body":"Currently we show detected `licenses` on OSIO dashboard and license scoring also uses detected licenses to calculate stack license. It should be modified to use `declared_licenses`."},"comment":{"url":"https://api.github.com/repos/fabric8-analytics/fabric8-analytics-worker/issues/comments/351078668","html_url":"https://github.com/fabric8-analytics/fabric8-analytics-worker/pull/465#issuecomment-351078668","issue_url":"https://api.github.com/repos/fabric8-analytics/fabric8-analytics-worker/issues/465","id":351078668,"user":{"login":"pombredanne","id":675997,"avatar_url":"https://avatars2.githubusercontent.com/u/675997?v=4","gravatar_id":"","url":"https://api.github.com/users/pombredanne","html_url":"https://github.com/pombredanne","followers_url":"https://api.github.com/users/pombredanne/followers","following_url":"https://api.github.com/users/pombredanne/following{/other_user}","gists_url":"https://api.github.com/users/pombredanne/gists{/gist_id}","starred_url":"https://api.github.com/users/pombredanne/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pombredanne/subscriptions","organizations_url":"https://api.github.com/users/pombredanne/orgs","repos_url":"https://api.github.com/users/pombredanne/repos","events_url":"https://api.github.com/users/pombredanne/events{/privacy}","received_events_url":"https://api.github.com/users/pombredanne/received_events","type":"User","site_admin":false},"created_at":"2017-12-12T15:07:30Z","updated_at":"2017-12-12T15:07:30Z","author_association":"NONE","body":"FWIW, ScanCode progressively also detects (and will provide a normalized license expression) for the \"declared license\". I call these \"asserted\" but that the same. https://github.com/nexB/scancode-toolkit/blob/275-streamline-package-manifests-models/src/packagedcode/models.py#L509\r\n\r\nAlso on the topic of Windows DLLs, there are two things there:\r\n1. when in a nuget, there is a license URL in the nuspec or API data. These are progressively collected in ScanCode as detection rules to map these to a proper declared or asserted license.\r\n2. DLLs have metadata such as a copyrights and sometimes licenses. If you scan these (which is somewhat heavy) these metadata will be detected soon when this branch is merged: https://github.com/nexB/scancode-toolkit/blob/275-streamline-package-manifests-models/src/packagedcode/win_pe.py\r\n\r\n@msrb you also wrote:\r\n\r\n> Detected licenses are, in my opinion, much more valuable than declared licenses. If people really care about licensing, they need to care about what's really in the code, not what upstream declares.\r\n\r\nI could not agree more, but both are worth IMHO. But in some areas such as NPMs that I think defaults to have an ISC license when none is set, there is a huge amount of discrepancies in these cases between the \"declared\" license as found in a package.json or regsitry API call and the actual license detected in the code.\r\nMy 2 cents is to always take a package.json ISC as not something to put in the bank. "}}
{"actor":{"display_login":"pombredanne"}}