How Xray Detects Package Licenses?

Xray detects licenses and validates them against any package licenses by:

1. Matching licenses to public components from JXray (JFrog’s global vulnerability database server) by comparing the checksums of these components
2. Scanning metadata files (pom.xml, package.json, etc.) inside given artifacts
3. Analyzing the licenses.txt files and to determine if there’s at least an 85% match (using Levenshtein distance logic, also known as edit distance)
   Please note this method is not utilized for detecting licenses in Conan packages.

To elaborate further, let’s consider an example in which Xray compares the license text to a package license file and discovers a match. For example, take a look at the BSD 3-Clause Clear License HERE, which appears to be almost identical to the LICENSE.md text HERE. In this instance, Xray would compare the latter’s text with other licenses and the match would be flagged, accordingly.

About Percentage Matching

Xray executes a logic routine that compares known licenses with package licenses (text). If 85% or more of any two texts are similar, a match will be flagged.

In the example above, the License.md and the BSD 3-Clause Clear License comparison was flagged as such a match. The reason why 100% matching is not required for match flagging is that people tend to change licenses by editing discrete aspects of the text, let alone the fact that different licenses are often likely to bear the names of different authors.