Skip to content
This repository has been archived by the owner on Sep 14, 2022. It is now read-only.

Latest commit

 

History

History
13 lines (11 loc) · 1.27 KB

compliance-traps.md

File metadata and controls

13 lines (11 loc) · 1.27 KB
Raw

Compliance Traps of TDOSCA-TC03A-SIMPLHW

The test case input (= open source software)

  • constantly claims to be licensed under the MIT license, but the class file envService.java and envServiceTest.java are divergently licensed under the BSD-2-Clause
  • is licensing the file envService.java under a 'wrong', but well known and often used SPDX identifier BSD-2CL
  • integrates the BSD-2-Clause license text into the file header
  • delivers its default license text in a file named COPYING although this is normally only be done by GNU software
  • the file COPYING contains the text of the MIT license, but does not declare to be the MIT license
  • uses the names "Karsten Reincke", "kreincke", "K.Reincke" but due to the fact, that only the MIT-Licence and the BSD-2CL-License may be integrated into the OSCF file, none of the respective copyright lines may appear.
  • tdosca-tc05 is distributed in form of two variants
    • branch 'master' is clear and should allow to create a distributable OSCF (generated an the base of an ORT check and and OSCake evalation)
    • branch 'var-noassertion' contains a file 'pom.xml' (automatically generated by maven) that contains the string 'SPDX-License-Identifier:MIT' which is evalauted by ScanOss as 'unknown license identifiert' = noassertion marker.