remixware.com

Checking AI-Written Code for Open Source It Reproduced

Mon, 26 Oct 2026 00:00:00 +0000

AI coding assistants write a lot of code now, and most of it is new: glue between your own functions and small helpers built for the problem in front of them. Now and then, though, an assistant writes something it has seen many times before. A well-known function from a popular library comes out nearly word for word, sometimes with the names changed to fit your code.

That copy can carry the licence of the code it came from. If the original was MIT, you owe its authors a copyright line in your notices. If it was GPL, the copy may not belong in a closed product at all. The assistant doesn’t tell you which happened, and code review rarely catches it, because the code looks fine and does what it should.

Copied Code Brings Its Licence Along: What Open Source Licences Ask of You

Mon, 26 Oct 2026 00:00:00 +0000

Open source code is free to use, and it comes with conditions. Every open source project comes with a licence, and the licence is the deal: you may copy, change and share this code, as long as you do certain things in return. Those things are usually small. Sometimes they’re large enough to decide how you can ship your whole product.

The conditions travel with the code. When a function moves from a library into your project, however it got there, its licence comes with it, even if the licence text stays behind. Here’s what the common licences ask, from the least to the most.

Getting Ready for a Code Audit Before a Sale or a Big Customer

Mon, 26 Oct 2026 00:00:00 +0000

Sooner or later someone outside the team asks what’s in your code. A company that wants to buy yours runs a scan as part of due diligence, or a large customer’s procurement team sends a questionnaire about open source. Both are asking the same thing: is there code in here that the company doesn’t have the right to ship the way it ships it?

The worst time to find out is when their report lands. A GPL file in the core product turns into a price cut or a promise to rewrite it before closing. Running the same kind of check months earlier turns it into an ordinary task.

GPL 2 Firmware and the Apache Code That Cannot Go In

Mon, 26 Oct 2026 00:00:00 +0000

A lot of firmware is licensed under GPL version 2, because it’s built on Linux, BusyBox or U-Boot, and a lot of it says “version 2 only”. That choice shuts out more code than people expect. Apache 2.0 code can’t go in, even though Apache is permissive. GPL version 3 code can’t go in either, even though it’s the GPL. The same Apache code would be fine in an MIT product and the GPL-3.0 code in a GPL-3.0 one, so a function that’s harmless in one of your products can be a problem in another.

How Remixware Was Tested: 2880 Planted Copies of Real Open Source Code

Mon, 26 Oct 2026 00:00:00 +0000

A tool that says “this code was copied” has to be right in two directions. It has to find the copies, including the ones that were tidied up, renamed or cut down. And it has to stay quiet about code that only looks like something else, because a report full of false alarms gets ignored. Remixware’s tests measure both, on real open source, and every test and benchmark number here comes from the files the tests write.

Remixware Now Checks Your Code Against SCANOSS With One Flag

Mon, 26 Oct 2026 00:00:00 +0000

An index only knows the code you put in it. For everything else, Remixware 0.1 read the results of SCANOSS’s scanner, which compares files with a large knowledge base of public open source. That meant installing a Python tool, running it, and handing its results file to Remixware.

Remixware 0.2 asks the SCANOSS service itself. Add --scanoss to a scan or a check:

remixware check . --scanoss

Sample Remixware Reports: An Online Shop, a Firmware Project and a Clean One

Mon, 26 Oct 2026 00:00:00 +0000

These are real reports from the test projects that come with Remixware, made by the same commands you’d run on your own code. The projects are small on purpose, so you can read every finding, and each one is planted for a reason: a copy with names changed, a copy with lines edited, a copy that’s credited properly, and code that only looks like someone else’s.

The open source they copy from is a set of small projects written for the tests, under MIT, BSD, ISC, zlib, Apache 2.0, MPL 2.0, GPL, AGPL and no licence at all. Each report was made with remixware scan against an index of those projects.

Stop GPL Code at the Pull Request: A Licence Check in CI

Mon, 26 Oct 2026 00:00:00 +0000

The cheapest moment to deal with copied code is before it merges. Once it ships, a GPL function in a closed product means a release to pull back and a rewrite under pressure. In a pull request it means a red build and a few lines to replace.

remixware check is made for that moment. It scans the project, applies your policy, prints what breaks it, and exits with status 1, so the build stops. When nothing breaks the policy it prints PASS and exits with 0. A check that couldn’t do its job exits with 2 instead of passing: a file it can’t read, or a folder with no source files to scan, which usually means a wrong path or an --exclude that covers everything.

The First Remixware Release Finds Copied Open Source Code and the Licence That Came With It

Mon, 26 Oct 2026 00:00:00 +0000

Code gets into a project from all over the place. Somebody pastes a function from a library they like, or an AI assistant writes a helper that looks a lot like one it saw in training. It works, the tests pass, and nobody writes down where it came from. The terms of the project it was taken from came along with it anyway, and they don’t go away when the code moves.

Third-Party Notices Without the Spreadsheet

Mon, 26 Oct 2026 00:00:00 +0000

Most open source licences ask for one thing in return: keep the copyright line and the licence text with the code. For dependencies, package tools and app stores help with that. For code that was copied into your own files, nothing does, so the credit usually gets lost on the way and the notices file never hears about it.

Remixware finds those copies and writes the missing entries. The loop has three steps: check, write the notices, check again, with a stop in between when an entry needs something only you can find.

Why Remixware: Software Built From Other Software

Mon, 26 Oct 2026 00:00:00 +0000

In music, a remix is a new track made from recordings that already exist. The producer takes the vocals from one song, the drums from another, a bass line from a third, and builds something that wasn’t there before. Nobody pretends the parts were recorded from scratch, and when it’s done properly, the people who made them get credit.

Most software is made the same way now. A new program pulls in a web framework and a pile of libraries, and on top of those it carries smaller pieces, like a snippet from a forum answer or a helper an AI assistant wrote after seeing thousands like it. Software built from other software. Remixware is a name for that kind of software, and for a tool that keeps track of the parts.

Wide Coverage With SCANOSS, Offline Checks With Remixware

Mon, 26 Oct 2026 00:00:00 +0000

Remixware compares your code with code you index, and an index only knows what you put in it. That’s enough for the libraries in your own stack, which is where most copies come from. But a function can come from anywhere, such as a project you never installed or an old gist.

For those, Remixware works with SCANOSS, which keeps a large knowledge base of public open source that you can check files against for free. SCANOSS finds the matches. Remixware applies your policy to them, sorts them into the same statuses as its own findings, writes the notices, and gives you one report and one pass or fail.

About

Mon, 01 Jan 0001 00:00:00 +0000

remixware.com is the home of Remixware, a free tool that finds code in your project that came from open source, names the licence it came with, and tells you what that licence asks of you. It runs on your own machine and reads your code there. It sends nothing anywhere unless you ask it to check with SCANOSS, and then only fingerprints of your files go out.

Why It Exists

Code moves between projects all the time, and it rarely comes with a note saying where it was before. Each copy carries the terms of the project it came from, and those terms don’t show in the code. An MIT helper needs its copyright line kept. A GPL function can force the whole program it lands in to go out under the GPL.

Contact

Mon, 01 Jan 0001 00:00:00 +0000

remixware.com would like to hear from:

Anyone trying Remixware out. What it found, what it missed, and what you used before.
Anyone who found a bug. A copy it didn’t report, a match it shouldn’t have made, or a licence it read wrong.
Anyone with an idea for a licence, a language or a report format it should handle.

Write to info@remixware.com.

Bug reports are also welcome on GitHub. It helps to include what remixware version prints, your operating system, and a small example that shows the problem. Please don’t send your company’s private code: two small files that show the same match are enough.

Download Remixware

Mon, 01 Jan 0001 00:00:00 +0000

The remixware command is one file with nothing else to install. Each archive below holds it with its license files and the manual. The links always point to the latest release.

System	Download
Linux, x86-64	remixware_linux_amd64.tar.gz
Linux, ARM64	remixware_linux_arm64.tar.gz
macOS, Apple silicon	remixware_darwin_arm64.tar.gz
macOS, Intel	remixware_darwin_amd64.tar.gz
Windows, x86-64	remixware_windows_amd64.zip

Checksums are in SHA256SUMS. Every release is listed on GitHub.

Install

Each archive holds the program next to its README and licence files, with no folder around them, so unpack it into an empty folder. On Linux or macOS, using the name of the archive you downloaded:

Quick Start

Mon, 01 Jan 0001 00:00:00 +0000

This page takes you from nothing to a first report in a few minutes. You need the remixware command (see Download) and a project to check.

1. Pick What to Compare With

Remixware compares your code with code you give it. It doesn’t come with a copy of all the world’s open source, so the first step is an index of the code you want to check against. Good first choices are the dependencies that already sit on your disk:

Reference

Mon, 01 Jan 0001 00:00:00 +0000

Every command, option, status and file format in Remixware 0.2. The README that ships with the program covers the same ground.

Commands

remixware index <folder>... [--out FILE]      fingerprint third-party code into an index
remixware scan [project] --index FILE         compare a project with indexes, list the matches
remixware check [project] --index FILE        the same, as a pass/fail gate for CI
remixware notice [project] --index FILE       write third-party notices for what you copied
remixware licenses                            list the licences Remixware knows
remixware version

scan, check and notice compare the project with --index files, with --from results files, with the SCANOSS service (--scanoss), or with any mix of them. The project defaults to the current folder. Flags can come before or after it, and remixware help <command> lists a command’s flags.