Simple npm license clarity is not reported correctly

[pombredanne]

See attached. Adding pkg:npm/%40swc/core-darwin-arm64@1.11.18 as a package, the declared license is detected correctly, but the license clarity is not.

Download URL: https://registry.npmjs.org/@swc/core-darwin-arm64/-/core-darwin-arm64-1.11.18.tgz

[tdruez]

DejaCode displays data as provided by ScanCode.io (powered by ScanCode-toolkit).
If the presented values seem wrong, this is likely an issue on the toolkit side.

$ scancode --json-pp - --info --summary --license --license-text --package --classify --license-clarity-score core-darwin-arm64-1.11.18.tgz-extract/

...
"summary": {
    "declared_license_expression": "apache-2.0 AND mit",
    "license_clarity_score": {
      "score": 0,
      "declared_license": false,
      "identification_precision": false,
      "has_license_text": false,
      "declared_copyrights": false,
      "conflicting_license_categories": false,
      "ambiguous_compound_licensing": true
    },
...

Moving the ticket to the scancode-toolkit repo for action.

[AyanSinhaMahapatra]

This is essentially tracked in:

• Look in package-ecosystem specific key-files for referenced licenses and summary #3707
• Improve License Clarity at Top Package Level #3792

Because the npm package has a structure where there is a package directory in the downloaded package and all the key-files are present there. The way we currently compute the clarity score and summary is closely based on key files present at the root of the downloaded package and this fails when the key files are present not at the root, but some other ecosystem specific structure or directory (or you initiate the scan with a input directory which is not the directory where the key files are present).

To fix this we are implementing at #3792 to:

• check for key files in ecosystem specific places (or by default check next to the package manifests)
• compute the summary and clarity score from these