Sample Remixware Reports: An Online Shop, a Firmware Project and a Clean One

These are real reports from the test projects that come with Remixware, made by the same commands you’d run on your own code. The projects are small on purpose, so you can read every finding, and each one is planted for a reason: a copy with names changed, a copy with lines edited, a copy that’s credited properly, and code that only looks like someone else’s.

The open source they copy from is a set of small projects written for the tests, under MIT, BSD, ISC, zlib, Apache 2.0, MPL 2.0, GPL, AGPL and no licence at all. Each report was made with remixware scan against an index of those projects.

An Online Shop Under MIT

Open the shop’s report, nine findings in 11 files.

The shop is an MIT project in Go, Python and JavaScript. It has two conflicts: a sorting function copied from a GPL project with every name changed, and a Python slug helper copied from an AGPL wiki. One formatter came from code with no licence. Five copies are missing their attribution: four under MIT, ISC and BSD, and a cache copied from an MPL 2.0 project, which also needs a look because MPL works file by file. Once its notice is in, that one is left for review. A retry helper from an Apache 2.0 project is fine, because the shop’s notices file already credits it.

The shop also has code of its own that looks like the sources without being copied, and a vendored library in vendor/, which isn’t scanned unless you ask. Neither shows up.

More from the same scan:

• the findings as JSON and as an SPDX 2.3 document
• the output of remixware check, which fails with eight findings that break the default policy
• the notices remixware notice writes for the missing attribution, and the whole loop of check, notice and check again, with the two entries it asks you to finish
• the report with SCANOSS results added, ten findings, from a results file in SCANOSS’s format written for the tests

Firmware Under GPL-2.0-only

Open the firmware report, three findings in 4 files.

A small C and Go tree licensed GPL version 2 only. An Apache 2.0 retry helper and a GPL-3.0 sort function are both conflicts there, for reasons the firmware post explains. A zlib string buffer copied with its names changed needs its notice kept.

A Clean Project

Open the clean report, no findings in 5 files.

An Apache 2.0 project written to look like the others without copying them: flag definitions, a sort.Interface type, a table-driven test, keyword arguments passed through, a chart helper in JavaScript. Code like that has the same shape in every project, and Remixware leaves it alone.

Make Your Own

Download Remixware and follow the quick start. The commands that made these reports are in scripts/record-results.sh, and the reports themselves are in test/results/gallery.