#1152499 ITP: golang-github-google-licenseclassifier -- analyze text to determine what type of license it contains (library)

Package:
wnpp
Source:
wnpp
Submitter:
Juan Manuel Méndez Rey
Date:
2026-10-30 05:23:01 UTC
Severity:
normal
#1152499#5
Date:
2026-10-30 01:39:16 UTC
From:
To:
* Package name    : golang-github-google-licenseclassifier
  Version         : 2.0.0
  Upstream Contact: https://github.com/google/licenseclassifier/issues
* URL             : https://github.com/google/licenseclassifier
* License         : Apache-2.0 (bundled license texts keep their own licenses)
  Programming Lang: Go
  Description     : analyze text to determine what type of license it contains (library)

 The license classifier is a library and set of tools that can analyze text
 to determine what type of license it contains. It searches for license
 texts in a file and compares them to an archive of known licenses. These
 files could be, e.g., LICENSE files with a single or multiple licenses in
 it, or source code files with the license text in a comment.
 .
 A "confidence level" is associated with each result indicating how close
 the match was. A confidence level of 1.0 indicates an exact match, while a
 confidence level of 0.0 indicates that no license was able to match the
 text.
 .
 This is a substantial revision of the license classifier with a focus on
 improved accuracy and performance.

Copyright: 2017, 2020 Google Inc.

This package is a dependency of trivy (ITP https://bugs.debian.org/929458).
I will maintain it in the Debian Go Packaging Team.

trivy uses the v2 module (github.com/google/licenseclassifier/v2), so the
binary package will be golang-github-google-licenseclassifier-v2-dev.
#1152499#10
Date:
2026-10-30 05:18:45 UTC
From:
To:
Follow-up to the csaf thread [1], where Bastian set licence texts apart
from standards texts [2].

github.com/google/licenseclassifier/v2 (ITP #1152499, needed by trivy)
embeds 266 licence texts as the corpus it matches against. Some are texts
of non-free licences whose own wording allows verbatim copying, for example
JSON ("shall be used for Good, not Evil"), CC-BY-NC/ND and SSPL.

Can those texts stay in main as the detector's data, the way licence texts
are shipped in common-licenses, or do they belong in non-free?

Texts that give no permission to copy them at all (SDK EULAs such as
Xcode, Android SDK, Windows SDK) are removed from the tarball either way.

[1] https://lists.debian.org/debian-legal/2026/09/msg00019.html
[2] https://lists.debian.org/debian-legal/2026/10/msg00004.html

Juan