Repository navigation
fix(license): preserve exact Maven headings and legal notice tables - #1458
Merged
Merged
Conversation
 [Medium impact] The PR appears safe to merge; the previous filename issue is fixed and no new actionable issues were found. SummaryPreserves exact Maven license headings and declarations in legal-notice tables.
The previous finding is addressed. No new actionable issues were found. Tests were inspected, not executed. Reviews (2) · Last reviewed commit: "fix(license): preserve exact Maven headi..." · Reviewed by Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Signed-off-by: Maxim Stykow <maxim.stykow@gmail.com>
mstykow
force-pushed
the
fix/maven-license-detection
branch
from
October 14, 2026 17:15
74cfce9 to
b2f2367
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Maven “Project Licenses” pages could lose an exact Apache-2.0 heading when a longer partial rule reused the same tokens and won overlap refinement. Discard partial sequence matches that add no query tokens beyond exact, non-clue matches of the same expression, preserving the complete reference as a detection.
License tables in
LICENSE,LICENCE,COPYING,NOTICE, and copyright files now retain their declarations, including plural third-party notices/license filenames. README comparison-table pruning and negative/comparative-mention filters remain covered by regression tests. Scanner contract tests exercise the Maven heading in isolation and in a page, plus Apache, BSD, and MPL links across legal-notice filenames.The CI advisory gate also required a targeted lockfile update from
rustls0.23.45 to 0.23.46 (RUSTSEC-2026-0346 through RUSTSEC-2026-0349). Dependency policy passes without exceptions.Issues
Closes #1456.
How to verify
Unzip the issue attachment and run
cargo run --bin provenant -- --license --json-pp - --strip-root maven-apache. All three files should reportapache-2.0; repeat with--compat-mode scancodefor the compatibility lane.Follow-up work
The nearby-case investigation found cross-license partial matches that suppress BSD headings or add unrelated licenses to MPL headings. Reproductions and evidence are recorded in #1457; this fix deliberately requires identical license expressions.
Expected-output fixture changes
Adds a truncated Maven page and the small Markdown table from the issue, with generated license goldens. The page retains its exact Apache references and both fixtures yield an Apache-2.0 detection. Existing expected outputs are unchanged.
🤖 Prepared with Codex.