Attrib command doesn't detect common licenses not in lower case

[grv87]

Given that license_expression contains license keys not in lower case, for example:

...
license_expression: Apache-2.0
licenses:
  - key: Apache-2.0
    name: Apache License 2.0
    file: LICENSE

the license is not detected as common by attrib command.

The problem is here:
https://github.com/nexB/aboutcode-toolkit/blob/3264859560ea843041483bdc4807eac9b1e2607c/templates/default_html.template#L47
common_licenses contains only lower-cased ids, so capitalized id is not detected.

[grv87]

Maybe I don't understand the goal of common_licenses.
But if it is expected to match SPDX-encoded license_expression, then it is a bug.
License ids in SPDX are case-sensitive. apache-2.0 is not registered SPDX licence.

[mjherzog]

AboutCode TK normally uses AboutCode/ScanCode license keys which are always lower case, not SPDX keys. ScanCode recognizes hundreds more license than are on the SPDX License List. There are many historical reasons for this which I will not rehash here.
You can see how we cross-reference our license key to an SPDX key for Apache 2.0 here:
https://github.com/nexB/scancode-toolkit/blob/develop/src/licensedcode/data/licenses/apache-2.0.yml.

[grv87]

@mjherzog, so, license_expression should use AboutCode/ScanCode keys instead of SPDX?
Or it could use both, just common_licenses list is made specifically for AboutCode/ScanCode keys?
What I'm doing wrong?

[chinyeungli]

@grv87 all the license keys used in AboutCode TK are decided to be used for AboutCode/ScanCode license key.. the SPDX's license key is not supported at this moment.. but this is a good subject as a Todo topic

[chinyeungli]

@grv87 Would you mind explainning what are you trying to do here?
Are you trying to use the attrib feature from the ABOUT files which were not generated from the gen process (meaning the ABOUT files were created manually)

[grv87]

@chinyeungli, yes.
I created ABOUT files by hands and wanted to use attrib to generate nice document for website.
I expected that license_expression was SPDX since this field was named license_spdx in version 1.0 of specification.

In general, I'm implementing gradle-about-plugin so that Gradle could parse ABOUT file placed in repo along with source code and use information from ABOUT during build. It's currently WIP, but you can get some information from README. Running about attrib from Gradle was one of the features.
I'm tied to SPDX licenses since they are standard, and there is spdx-tools library to parse and handle them.

If it's not a valid use case and my assumptions were incorrect, feel free to close this issue. (UPDATE: But explicit notice in the specification that custom ids are used instead of SPDX would be good)
Then I'll just create extension field which will use SPDX instead of AboutCode/ScanCode ids.

[chinyeungli]

Thanks for the clarification. The doc is definitely out-dated and need to be updated.. we'll think of a better way to handle this case.

[chinyeungli]

FYI, this is the recent SPEC version 3.1.2: https://github.com/nexB/aboutcode-toolkit/blob/develop/SPECIFICATION.rst

but it needs to be reviewed to clarify the license_expression (key, name) as mentioned above

[chinyeungli]

I'm closing this as our current code do not support SPDX license, and opening #413 for follow-up.