Hi,
On 07/02/2022 22:59, Scott Murray wrote:
Jan-Simon can talk to it better, as he's done some dev work on the layer
and done tests with it against AGL (and the subsequent Fossology instance
experimentation), but AFAIK for the actual scanning scancode-toolkit
does pattern matching based license detection, so in theory it'll catch
excerpts of or slightly modified versions of the licenses in its
database, as opposed to just searching for SPDX-License-Identifier
declarations.
If I understand it correctly scancode-toolkit[1] claims to do this:
"ScanCode provides the most accurate license detection engine and does a
full comparison (also known as diff or red line comparison) between a
database of license texts and your code instead of relying only on
approximate regex patterns or probabilistic search, edit distance or
machine learning."
[1] https://github.com/nexB/scancode-toolkit
meta-spdxscanner can also create tarballs for each recipe and uploads
them to a Fossology instance. Then Fossology takes care about license
scanning and so on - and manual intervention is required.
A major issue here is, that the combined work (linking) is not taken
into account at all, but it's all only per recipe.
Regards,
Robert
--
Robert Berger
Embedded Software Evangelist
Reliable Embedded Systems
Consulting Training Engineering
URL: https://www.reliableembeddedsystems.com
Schedule a web meeting:
https://calendly.com/reliableembeddedsystems/
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
--
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#161505):
https://lists.openembedded.org/g/openembedded-core/message/161505
Mute This Topic: https://lists.openembedded.org/mt/88980079/21656
Group Owner: [email protected]
Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub
[[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
