Sean Palmer created RAT-583:
-------------------------------
Summary: The SPDX matcher reads only the first identifier
Key: RAT-583
URL: https://issues.apache.org/jira/browse/RAT-583
Project: Apache RAT
Issue Type: Bug
Components: license-meta-data
Affects Versions: 0.18
Reporter: Sean Palmer
{{SPDXMatcherFactory}} uses {{.*SPDX-License-Identifier:\s([A-Za-z0-9\.\-]+)}},
which captures only the first token after the tag, and requires exactly one
whitespace character before it. Operators, later identifiers, and parentheses
are ignored, so the verdict can be wrong in both directions:
||SPDX-License-Identifier||Reported by RAT 0.18||Expected||
|Apache-2.0 OR GPL-3.0-only|AL2.0 (approved)|approved|
|GPL-3.0-only OR Apache-2.0|GPL3 (unapproved)|approved|
|Apache-2.0 AND GPL-3.0-only|AL2.0 (approved)|unapproved|
|(Apache-2.0 OR MIT)|Unknown license|approved|
|Apache-2.0 (two spaces after the colon)|Unknown license|AL2.0|
Found while investigating
https://github.com/apache/tooling-trusted-releases/issues/1725.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
