Skip to content

Too much data included in author detected in ansible-core/PKG-INFO #5303

Description

@mrombout

Description

For ansible-core 2.19.13 ScanCode detects an author from an Author tag in the PKG-INFO file, but then also includes a lot of text in the same author detection that shouldn't be there.

How To Reproduce

  1. Download PKG-INFO (renamed to .txt due to GitHub file upload constraints, but name doesn't matter for scan anyway).
  2. scancode -c --json-pp copyrights.json ./PKG-INFO.txt
  3. cat copyrights.json
{
  "headers": [
    {
      "tool_name": "scancode-toolkit",
      "tool_version": "32.5.0",
      "options": {
        "input": [
          "./PKG-INFO.txt"
        ],
        "--copyright": true,
        "--json-pp": "copyrights.json",
        "--only-findings": false
      },
      "notice": "Generated with ScanCode and provided on an \"AS IS\" BASIS, WITHOUT WARRANTIES\nOR CONDITIONS OF ANY KIND, either express or implied. No content created from\nScanCode should be considered or used as legal advice. Consult an Attorney\nfor any legal advice.\nScanCode is a free software code scanning tool from nexB Inc. and others.\nVisit https://github.com/nexB/scancode-toolkit/ for support and download.",
      "start_timestamp": "2026-09-09T054205.088312",
      "end_timestamp": "2026-09-09T054205.706679",
      "output_format_version": "4.1.0",
      "duration": 0.6183807849884033,
      "message": null,
      "errors": [],
      "warnings": [],
      "extra_data": {
        "system_environment": {
          "operating_system": "linux",
          "cpu_architecture": "64",
          "python_version": "3.14.4 (main, Jun 18 2026, 14:25:02) [GCC 15.2.0]"
        },
        "spdx_license_list_version": "3.27",
        "files_count": 1
      }
    }
  ],
  "files": [
    {
      "path": "PKG-INFO.txt",
      "type": "file",
      "copyrights": [],
      "holders": [],
      "authors": [
        {
          "author": "Ansible Project Project-URL Homepage, https://ansible.com/ Project-URL Source Code, https://github.com/ansible/ansible/ Project-URL Bug Tracker, https://github.com/ansible/ansible/issues/ Project-URL CI Azure Pipelines, https://dev.azure.com/ansible/ansible/ Project-URL Documentation, https://docs.ansible.com/ansible-core",
          "start_line": 5,
          "end_line": 10
        },
        {
          "author": "Michael DeHaan (https://github.com/mpdehaan)",
          "start_line": 134,
          "end_line": 134
        }
      ],
      "scan_errors": []
    }
  ]
}

It then finds the following as an author:

Ansible Project Project-URL Homepage, https://ansible.com/ Project-URL Source Code, https://github.com/ansible/ansible/ Project-URL Bug Tracker, https://github.com/ansible/ansible/issues/ Project-URL CI Azure Pipelines, https://dev.azure.com/ansible/ansible/ Project-URL Documentation, https://docs.ansible.com/ansible-core

I would expect only Ansible Project to be included in the author field, based on the declaration Author: Ansible Project. All the other text should be omitted.

System configuration

For bug reports, it really helps us to know:

  • What OS are you running on? (Windows/MacOS/Linux)
    • Linux
  • What version of scancode-toolkit was used to generate the scan file?
    • 32.5.0
  • What installation method was used to install/run scancode? (pip/source download/other)
    • pip

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugnew-licenseA new scancode license can be added for this

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions