← Back to issue list

Improve inspector license extraction

View original Github issue

Metadata

Project
fetch-service
Number
#373
Type
issue
State
open
Author
cmatsuoka
Labels
—
Created
Updated
Closed
—

Current evaluation

Maintainer task to improve license extraction: preserve valid SPDX IDs, avoid licensecheck false positives, and normalize license names. Still open, tracked as CRAFT-4413; may also address #323.

Suggested action: keep open

Reason: Valid maintainer-scoped enhancement (author is cmatsuoka) with an acknowledged goal list and an internal ticket CRAFT-4413; a git-log pickaxe search for 'license' shows no commit implementing normalization, and utils/file_utils.go still relies on raw `licensecheck --machine --shortname-scheme=spdx` output with only a narrow `Expat`→`MIT` regex hack, with a test even asserting the degraded 'GFDL-1.3-or-later and/or GPL-3.0-or-later' value. It should remain open as the umbrella task, though actionability is limited because no concrete reproducer, mapping table, or acceptance criteria are given and the only proposed direction lives in the comments of #323.

Evaluated by: mr-cal-bot

Impact: 45 Quick Win: 11 Complexity: 58 Confidence: 82 Actionability: 58

Issue body

### What needs to get done The license identifier provided by the Fetch Service can be improved in different ways to prevent problems to metadata consumers: - Mitigate [degradation of valid SPDX licenses](https://bugs.launchpad.net/ubuntu/+source/licensecheck/+bug/2104867) - Prevent false positives - Normalize license names ### Why it needs to get done Degraded license names make it impossible for consumers to recover the original artifact license because information is lost. False positives can result in inaccurate SBOM information. Normalized names cause minimal disruption to consumers if the license extracting implementation is modified or replaced in the Fetch Service.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha
Impact: 45
Quick Win: 11
Complexity: 58
Confidence: 82
Actionability: 58
keep open Maintainer task to improve license extraction: preserve valid SPDX IDs, avoid licensecheck false positives, and normalize license names. Still open, tracked as CRAFT-4413; may also address #323.
stealth/space-bunny-alpha
Impact: 55
Quick Win: 10
Complexity: 64
Confidence: 93
Actionability: 51
needs triage Open maintainer request to improve Fetch Service license extraction by preserving SPDX identifiers, preventing false positives, and normalizing names; it may also resolve #323's non-SPDX metadata problems.
qwen/qwen3.6-35b-a3b
Impact: 60
Quick Win: 27
Staleness: 75
Complexity: 55
Confidence: 65
Support Request: 5
needs triage Feature request to improve license identifier extraction in Fetch Service to prevent SPDX degradation, false positives, and normalize names. Untriaged, 390 days since last activity.

Update history

Date Change
created

Related work

  • Related To: fetch-service#323 (confidence 92%)

    Explicit cross-reference in cmatsuoka's 2025-03-31 comment ('This may also solve #323'); #323 'Non SPDX compliant license expressions (and license identifiers)' is open with a proposed approach (normalization, GNU + handling, conservative AND grouping).

Related issues

No related issues found above the similarity threshold.