Skip to content

mpl-1.1 detected incorrectly (false positive) #3516

@DennisClark

Description

@DennisClark

A recent scan of opentofu-main.zip (there are no tags or releases)
from https://github.com/opentofu/opentofu
returned mpl-2.0 correctly but also mpl-1.1 incorrectly. Here is what I found in the scan results:

rules/mpl-1.1_38.RULE",          "start_line": 31,          "matched_text": "License\n\n[Mozilla",          "match_coverage": 100.0,          "matched_length": 2,          "rule_relevance": 90,          "rule_identifier": "mpl-1.1_38.RULE",          "license_expression": "mpl-1.1"        },        {          "score": 100.0, 

It seems to me that the matched_text of "License\n\n[Mozilla" is not adequate to detect mpl-1.1.

I think that mpl-1.1_38.RULE should probably be removed altogether.

Scan results attached.
opentofu-main.zip_scan.json.zip

Metadata

Metadata

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions