Improve declared license collection from nuspec files (#2669)

AUTHORS.rst

@@ -108,3 +108,5 @@ The following organizations or individuals have contributed to ScanCode:
 - Yash Sharma @yasharmaster
 - Yunus Rahbar @yns88
 - Stefano Zacchiroli @zacchiro
+- Temi Eyesan @teyesan
+- Tram Trinh @tram-tr

CHANGELOG.rst

@@ -8,6 +8,11 @@ Next release
   ``licensedcode-data``.
   https://github.com/aboutcode-org/scancode-toolkit/pull/5056
 
+- Fixed nuget/nuspec parser to correctly extract file-referenced and
+  expression-based <license> elements instead of the deprecated 
+  licenseUrl fallback
+  https://github.com/aboutcode-org/scancode-toolkit/pull/5271
+
 v33.0.0rc1 - 2026-05-14
 ------------------------
 

src/packagedcode/nuget.py

@@ -18,6 +18,8 @@
 Handle NuGet packages and their manifests.
 """
 
+DEPRECATED_NUGET_LICENSE_URL = 'https://aka.ms/deprecateLicenseUrl'
+
 
 def get_dependencies(nuspec):
     """
@@ -79,6 +81,32 @@ def _get_dep_packs(deps, extra_data):
             extra_data=extra,
         )
 
+def get_declared_license(nuspec):
+    extracted_license_statement = None
+    license_file = None
+
+    license_data = nuspec.get('license')
+    if license_data:
+        if isinstance(license_data, dict):
+            license_type = license_data.get('@type')
+            license_text = license_data.get('#text')
+            if license_type == 'file':
+                license_file = license_text
+            else:
+                # "expression" (an SPDX license expression) or any other unspecified type: keep the text as is
+                extracted_license_statement = license_text
+        else:
+            # defensive: in case a plain string ever shows up here.
+            extracted_license_statement = license_data
+
+    license_url = nuspec.get('licenseUrl')
+    if license_url and license_url != DEPRECATED_NUGET_LICENSE_URL:
+        if extracted_license_statement:
+            extracted_license_statement = f'{extracted_license_statement}\n{license_url}'
+        else:
+            extracted_license_statement = license_url
+
+    return extracted_license_statement, license_file
 
 def get_urls(name, version, **kwargs):
     return dict(
@@ -155,14 +183,20 @@ def parse(cls, location, package_only=False):
 
         urls = get_urls(name, version)
 
-        extracted_license_statement = None
-        # See https://docs.microsoft.com/en-us/nuget/reference/nuspec#license
-        # This is a SPDX license expression
-        if 'license' in nuspec:
-            extracted_license_statement = nuspec.get('license')
-        # Deprecated and not a license expression, just a URL
-        elif 'licenseUrl' in nuspec:
-            extracted_license_statement = nuspec.get('licenseUrl')
+        # extracted_license_statement = None
+        # # See https://docs.microsoft.com/en-us/nuget/reference/nuspec#license
+        # # This is a SPDX license expression
+        # if 'license' in nuspec:
+        #     extracted_license_statement = nuspec.get('license')
+        # # Deprecated and not a license expression, just a URL
+        # elif 'licenseUrl' in nuspec:
+        #     extracted_license_statement = nuspec.get('licenseUrl')
+
+        extracted_license_statement, license_file = get_declared_license(nuspec)
+        extra_data = {}
+        if license_file:
+            extra_data['license_file'] = license_file
+
 
         package_data = dict(
             datasource_id=cls.datasource_id,
@@ -176,6 +210,7 @@ def parse(cls, location, package_only=False):
             extracted_license_statement=extracted_license_statement,
             copyright=nuspec.get('copyright') or None,
             vcs_url=vcs_url,
+            extra_data=extra_data,
             **urls,
         )
         yield models.PackageData.from_data(package_data, package_only)

tests/packagedcode/data/license_detection/reference-at-manifest/fizzler.expected.json

@@ -43,16 +43,17 @@
               "license_expression": "unknown-license-reference",
               "license_expression_spdx": "LicenseRef-scancode-unknown-license-reference",
               "from_file": "fizzler/Fizzler.nuspec",
-              "start_line": 1,
-              "end_line": 1,
-              "matcher": "1-hash",
-              "score": 16.0,
-              "matched_length": 3,
+              "start_line": 9,
+              "end_line": 9,
+              "matcher": "2-aho",
+              "score": 33.0,
+              "matched_length": 6,
               "match_coverage": 100.0,
-              "rule_relevance": 16,
-              "rule_identifier": "unknown-license-reference_383.RULE",
-              "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/unknown-license-reference_383.RULE",
-              "matched_text": "license COPYING.txt"
+              "rule_relevance": 33,
+              "rule_identifier": "unknown-license-reference_382.RULE",
+              "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/unknown-license-reference_382.RULE",
+              "matched_text": "    <license type=\"file\">COPYING.txt</license>",
+              "matched_text_diagnostics": "license type=\"file\">COPYING.txt</license>"
             },
             {
               "license_expression": "lgpl-2.1-plus",
@@ -87,21 +88,23 @@
               "matched_text_diagnostics": "LICENSE\n                      \nGNU GENERAL PUBLIC LICENSE"
             }
           ],
-          "identifier": "lgpl_2_1_plus_and_gpl_1_0_plus-15b4d27c-9fa6-eb84-010f-152d45207f46",
           "detection_log": [
             "package-unknown-reference-to-local-file"
-          ]
+          ],
+          "identifier": "lgpl_2_1_plus_and_gpl_1_0_plus-62bd07da-4dc9-fb2e-ad66-9eafe419c120"
         }
       ],
       "other_license_expression": null,
       "other_license_expression_spdx": null,
       "other_license_detections": [],
-      "extracted_license_statement": "'@type': file\n'#text': COPYING.txt\n",
+      "extracted_license_statement": null,
       "notice_text": null,
       "source_packages": [],
       "is_private": false,
       "is_virtual": false,
-      "extra_data": {},
+      "extra_data": {
+        "license_file": "COPYING.txt"
+      },
       "repository_homepage_url": "https://www.nuget.org/packages/Fizzler/1.3.0",
       "repository_download_url": "https://www.nuget.org/api/v2/package/Fizzler/1.3.0",
       "api_data_url": "https://api.nuget.org/v3/registration3/fizzler/1.3.0.json",
@@ -154,71 +157,13 @@
     }
   ],
   "license_detections": [
-    {
-      "identifier": "lgpl_2_1_plus_and_gpl_1_0_plus-15b4d27c-9fa6-eb84-010f-152d45207f46",
-      "license_expression": "lgpl-2.1-plus AND gpl-1.0-plus",
-      "license_expression_spdx": "LGPL-2.1-or-later AND GPL-1.0-or-later",
-      "detection_count": 1,
-      "detection_log": [
-        "package-unknown-reference-to-local-file"
-      ],
-      "reference_matches": [
-        {
-          "license_expression": "unknown-license-reference",
-          "license_expression_spdx": "LicenseRef-scancode-unknown-license-reference",
-          "from_file": "fizzler/Fizzler.nuspec",
-          "start_line": 1,
-          "end_line": 1,
-          "matcher": "1-hash",
-          "score": 16.0,
-          "matched_length": 3,
-          "match_coverage": 100.0,
-          "rule_relevance": 16,
-          "rule_identifier": "unknown-license-reference_383.RULE",
-          "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/unknown-license-reference_383.RULE",
-          "matched_text": "license COPYING.txt"
-        },
-        {
-          "license_expression": "lgpl-2.1-plus",
-          "license_expression_spdx": "LGPL-2.1-or-later",
-          "from_file": "fizzler/COPYING.txt",
-          "start_line": 1,
-          "end_line": 1,
-          "matcher": "2-aho",
-          "score": 100.0,
-          "matched_length": 5,
-          "match_coverage": 100.0,
-          "rule_relevance": 100,
-          "rule_identifier": "lgpl-2.1-plus_485.RULE",
-          "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/lgpl-2.1-plus_485.RULE",
-          "matched_text": "GNU LESSER GENERAL PUBLIC LICENSE",
-          "matched_text_diagnostics": "GNU LESSER GENERAL PUBLIC LICENSE"
-        },
-        {
-          "license_expression": "gpl-1.0-plus",
-          "license_expression_spdx": "GPL-1.0-or-later",
-          "from_file": "fizzler/COPYING.txt",
-          "start_line": 1,
-          "end_line": 3,
-          "matcher": "2-aho",
-          "score": 100.0,
-          "matched_length": 5,
-          "match_coverage": 100.0,
-          "rule_relevance": 100,
-          "rule_identifier": "gpl_160.RULE",
-          "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/gpl_160.RULE",
-          "matched_text": "GNU LESSER GENERAL PUBLIC LICENSE\n                      \nGNU GENERAL PUBLIC LICENSE",
-          "matched_text_diagnostics": "LICENSE\n                      \nGNU GENERAL PUBLIC LICENSE"
-        }
-      ]
-    },
     {
       "identifier": "lgpl_2_1_plus_and_gpl_1_0_plus-62bd07da-4dc9-fb2e-ad66-9eafe419c120",
       "license_expression": "lgpl-2.1-plus AND gpl-1.0-plus",
       "license_expression_spdx": "LGPL-2.1-or-later AND GPL-1.0-or-later",
-      "detection_count": 1,
+      "detection_count": 2,
       "detection_log": [
-        "unknown-reference-to-local-file"
+        "package-unknown-reference-to-local-file"
       ],
       "reference_matches": [
         {
@@ -414,16 +359,17 @@
                   "license_expression": "unknown-license-reference",
                   "license_expression_spdx": "LicenseRef-scancode-unknown-license-reference",
                   "from_file": "fizzler/Fizzler.nuspec",
-                  "start_line": 1,
-                  "end_line": 1,
-                  "matcher": "1-hash",
-                  "score": 16.0,
-                  "matched_length": 3,
+                  "start_line": 9,
+                  "end_line": 9,
+                  "matcher": "2-aho",
+                  "score": 33.0,
+                  "matched_length": 6,
                   "match_coverage": 100.0,
-                  "rule_relevance": 16,
-                  "rule_identifier": "unknown-license-reference_383.RULE",
-                  "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/unknown-license-reference_383.RULE",
-                  "matched_text": "license COPYING.txt"
+                  "rule_relevance": 33,
+                  "rule_identifier": "unknown-license-reference_382.RULE",
+                  "rule_url": "https://github.com/nexB/scancode-toolkit/tree/develop/src/licensedcode/data/rules/unknown-license-reference_382.RULE",
+                  "matched_text": "    <license type=\"file\">COPYING.txt</license>",
+                  "matched_text_diagnostics": "license type=\"file\">COPYING.txt</license>"
                 },
                 {
                   "license_expression": "lgpl-2.1-plus",
@@ -458,22 +404,24 @@
                   "matched_text_diagnostics": "LICENSE\n                      \nGNU GENERAL PUBLIC LICENSE"
                 }
               ],
-              "identifier": "lgpl_2_1_plus_and_gpl_1_0_plus-15b4d27c-9fa6-eb84-010f-152d45207f46",
               "detection_log": [
                 "package-unknown-reference-to-local-file"
-              ]
+              ],
+              "identifier": "lgpl_2_1_plus_and_gpl_1_0_plus-62bd07da-4dc9-fb2e-ad66-9eafe419c120"
             }
           ],
           "other_license_expression": null,
           "other_license_expression_spdx": null,
           "other_license_detections": [],
-          "extracted_license_statement": "'@type': file\n'#text': COPYING.txt\n",
+          "extracted_license_statement": null,
           "notice_text": null,
           "source_packages": [],
           "file_references": [],
           "is_private": false,
           "is_virtual": false,
-          "extra_data": {},
+          "extra_data": {
+            "license_file": "COPYING.txt"
+          },
           "dependencies": [
             {
               "purl": "pkg:nuget/NETStandard.Library",
@@ -514,8 +462,8 @@
       "for_packages": [
         "pkg:nuget/Fizzler@1.3.0?uuid=fixed-uid-done-for-testing-5642512d1758"
       ],
-      "detected_license_expression": "lgpl-2.1-plus AND gpl-1.0-plus",
-      "detected_license_expression_spdx": "LGPL-2.1-or-later AND GPL-1.0-or-later",
+      "detected_license_expression": "unknown-license-reference",
+      "detected_license_expression_spdx": "LicenseRef-scancode-unknown-license-reference",
       "license_detections": [
         {
           "license_expression": "lgpl-2.1-plus AND gpl-1.0-plus",
@@ -571,7 +519,7 @@
             }
           ],
           "detection_log": [
-            "unknown-reference-to-local-file"
+            "package-unknown-reference-to-local-file"
           ],
           "identifier": "lgpl_2_1_plus_and_gpl_1_0_plus-62bd07da-4dc9-fb2e-ad66-9eafe419c120"
         }

tests/packagedcode/data/nuget/ExpressionLicense.nuspec

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2013/05/nuspec.xsd">
+  <metadata>
+    <id>ExpressionLicenseExample</id>
+    <version>1.0.0</version>
+    <requireLicenseAcceptance>false</requireLicenseAcceptance>
+    <license type="expression">MIT</license>
+  </metadata>
+</package>

tests/packagedcode/data/nuget/ExpressionLicense.nuspec.json.expected

@@ -0,0 +1,69 @@
+[
+  {
+    "type": "nuget",
+    "namespace": null,
+    "name": "ExpressionLicenseExample",
+    "version": "1.0.0",
+    "qualifiers": {},
+    "subpath": null,
+    "primary_language": null,
+    "description": null,
+    "release_date": null,
+    "parties": [],
+    "keywords": [],
+    "homepage_url": null,
+    "download_url": null,
+    "size": null,
+    "sha1": null,
+    "md5": null,
+    "sha256": null,
+    "sha512": null,
+    "bug_tracking_url": null,
+    "code_view_url": null,
+    "vcs_url": null,
+    "copyright": null,
+    "holder": null,
+    "declared_license_expression": "mit",
+    "declared_license_expression_spdx": "MIT",
+    "license_detections": [
+      {
+        "license_expression": "mit",
+        "license_expression_spdx": "MIT",
+        "matches": [
+          {
+            "license_expression": "mit",
+            "license_expression_spdx": "MIT",
+            "from_file": null,
+            "start_line": 1,
+            "end_line": 1,
+            "matcher": "1-spdx-id",
+            "score": 100.0,
+            "matched_length": 1,
+            "match_coverage": 100.0,
+            "rule_relevance": 100,
+            "rule_identifier": "spdx-license-identifier-mit-5da48780aba670b0860c46d899ed42a0f243ff06",
+            "rule_url": null,
+            "matched_text": "MIT"
+          }
+        ],
+        "identifier": "mit-a822f434-d61f-f2b1-c792-8b8cb9e7b9bf"
+      }
+    ],
+    "other_license_expression": null,
+    "other_license_expression_spdx": null,
+    "other_license_detections": [],
+    "extracted_license_statement": "MIT",
+    "notice_text": null,
+    "source_packages": [],
+    "file_references": [],
+    "is_private": false,
+    "is_virtual": false,
+    "extra_data": {},
+    "dependencies": [],
+    "repository_homepage_url": "https://www.nuget.org/packages/ExpressionLicenseExample/1.0.0",
+    "repository_download_url": "https://www.nuget.org/api/v2/package/ExpressionLicenseExample/1.0.0",
+    "api_data_url": "https://api.nuget.org/v3/registration3/expressionlicenseexample/1.0.0.json",
+    "datasource_id": "nuget_nupsec",
+    "purl": "pkg:nuget/ExpressionLicenseExample@1.0.0"
+  }
+]

tests/packagedcode/data/nuget/LicenseURLOnly.nuspec

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2013/05/nuspec.xsd">
+  <metadata>
+    <id>LicenseUrlOnlyExample</id>
+    <version>1.0.0</version>
+    <requireLicenseAcceptance>false</requireLicenseAcceptance>
+    <licenseUrl>https://opensource.org/licenses/MIT</licenseUrl>
+  </metadata>
+</package>