Example comment erroneously triggering license scanner

[fitzthum]

It looks like this project can be licensed with either Apache-2.0 or MIT. A license scanner for a project that depends on this one is flagging the project as GPL-2. The reason is that cortex-m-semihosting/src/lib.rs contains the following section which has the string GNU GPL v2 in it.

//! ``` text
//! $ openocd -f $INTERFACE -f $TARGET -l /tmp/openocd.log
//! Open On-Chip Debugger 0.9.0 (2016-04-27-23:18)
//! Licensed under GNU GPL v2
//! For bug reports, read
//!         http://openocd.org/doc/doxygen/bugs.html
//! # the command will block at this point
//! ```

Given that this appears to be just an example command, would it be possible to change the example to something that does not contain GNU GPL v2? I would make PR myself but I am not familiar with this project and I am not sure what a sensible replacement would be.

[thejpster]

This seems like a bug in the licence scanner though? Not every reference to a licence means the file is under that licence.

[fitzthum]

This seems like a bug in the licence scanner though? Not every reference to a licence means the file is under that licence.

It is absolutely a bug in the license scanner, but the scanner is closed-source and even if it were open it's not trivial to effectively scan repositories. That's why I wonder if we can just change this one example and then not worry about it.

[thejpster]

Is this for a commercial project?

[fitzthum]

It's for Confidential Containers, which is a CNCF Sandbox project. Totally open source but the CNCF isn't a big fan of GPL. The CNCF wants projects to use a license scanner called FOSSA, which isn't the most robust thing.

Anyway, I realize this is kind of a weird request, but it seems like it could be an easy fix and I think it probably effects other people too.

[jamesmunns]

@fitzthum does FOSSA support an override/manual approval/exception configuration? You may want to follow up with your sales rep to figure out how to add a manual exception for this.

[thejpster]

In the mean time, if you'd like to submit a PR proposing alternative wording for the example that works for you, but still meets the sprit of what the example is trying to show (a realistic view of what it looks like to use OpenOCD) then we can certainly look at that. Currently I can't fix it for you because I don't know what your (buggy) closed-source tool does or does not like.

[fitzthum]

I'm also not really sure what FOSSA looks for when it scans, but it's probably safe to assume that the string GNU GPL v2 is triggering it. Unfortunately it looks like OpenOCD prints this out no matter what command you run, so there might not be much we can do.

We are looking into overriding the scan, but no luck yet.

[adamgreig]

Just to clarify, does your project depend on cortex-m or cortex-m-semihosting? Only the latter crate has the GNU GPL string; they just happen to share a repository. Does the scanner look at the git repository or the downloaded crate you actually depend on? (In other words, does it matter if we just update the repository or do you need a new published version?)

[fitzthum]

It is cortex-m-semihosting. I'm not sure if the scanner gets the source from GitHub or just by downloading the crate. That said, updating either one of those might not actually help because we are apparently pulling in version 0.3.7. I am trying to figure out exactly where the dependency comes from. It is being flagged as a 9th-level dependency in four different Rust projects none of which seem to have anything to do with this project.