Wrong license for ansi

[pivotal]

Wrong license for ansi

[mainej]

The current github code for the ansi gem doesn't include GPLv2. However, as of release 1.4.3 (the latest release on rubygems) GPLv2 is in COPYING.rdoc. LicenseFinder examines the files in your local install of the gem, so assuming you have 1.4.3 installed, it's finding that older license. So, I think LicenseFinder is doing the right thing.

You could argue that when a gem is released under multiple licenses, LicenseFinder chooses one a bit arbitrarily. Even back in version 1.4.3 the ansi gem was released under FreeBSD too. Defining how to show multiple licenses, or prefer certain licenses may deserve a separate issue.

In any case, one way to fix this is to ask the ansi gem maintainers to release a version that mentions the FreeBSD license in the gemspec. LicenseFinder prefers using the gemspec over detecting licenses in files. I'll open a separate issue requesting that LicenseFinder also respect the gemspec when it mentions multiple licenses.

For reference, it looks like commit rubyworks/ansi@53bf2b7 removed GPLv2 from ansi, in the process of moving files around.

[cschramm]

Thanks for looking into it. The COPYING.rdoc of 1.4.3 looks quite like the NOTICE.md that I mentioned for the current master. Both files mention a lot of licenses and I cannot see any valid way for license_finder to find the correct one for the gem. I think in such cases it's best to not detect a license and report as "other". The user will then have to look into it and set the correct one. That's far better than always reckoning that LF detect WRONG licenses and thus not being able to rely on it.

In the given case it's of course not so problematic, since the actual license is far more permissive than the reported one, but it could easily be the other way around.

[BrentWheeldon]

Yeah, I agree. If there are multiple licenses found we should not report any of them. I've added a story to pivotal tracker story here.

[mainej]

If I remember, in the early days of LF, it thought many gems had multiple licenses. For some, that's legitimate: they are intentionally released under multiple licenses.

Others were just false positives. The license matching heuristics have changed since then, so it might not be a problem anymore.

Originally LF tried to show all the possible licenses, and encouraged people to do their own research. However, early users quickly got tired of that, which is now reflected by the fact that LF shows only one license. In any case, showing none might cause some strife.