Wide Coverage With SCANOSS, Offline Checks With Remixware

Remixware compares your code with code you index, and an index only knows what you put in it. That’s enough for the libraries in your own stack, which is where most copies come from. But a function can come from anywhere, such as a project you never installed or an old gist.

For those, Remixware works with SCANOSS, which keeps a large knowledge base of public open source that you can check files against for free. SCANOSS finds the matches. Remixware applies your policy to them, sorts them into the same statuses as its own findings, writes the notices, and gives you one report and one pass or fail.

Running the Two Together

remixware check . --index deps.rmx --scanoss --html report.html

You can leave out --index and use SCANOSS alone, or leave out --scanoss and use your index alone. When both find the same copy, Remixware reports it once. --scanoss-out scanoss.json saves SCANOSS’s answers, and --from scanoss.json reads them back later without asking the service again.

SCANOSS’s own scanner works too. Run it from the project’s top folder, so the paths in its results match the project, and pass its results with --from:

pip3 install scanoss
scanoss-py scan -o scanoss.json .
remixware check . --from scanoss.json --index deps.rmx

The sample shop in Remixware’s tests comes with a results file in SCANOSS’s format, written for the tests. The index finds nine copies in the shop. The results file adds one entry the index has nothing for, a minified chart library. The entry was written for the tests and names a file the shop doesn’t have, web/vendor.min.js. Since no licence is reported for it, Remixware marks it for review instead of guessing.

What Each Part Does

SCANOSS keeps the knowledge base and does the matching. With --scanoss, Remixware makes its fingerprints the way SCANOSS’s own scanner does, and for each file it sends a number with the file’s extension, the file’s MD5 checksum and size, and hashes of its text. The code and the file names stay on your machine, and the answers come back about the numbers. SCANOSS’s own scanner sends each file’s path in place of the number unless you run it with --obfuscate. The free service at api.osskb.org is run by the Software Transparency Foundation and needs no account. Its terms apply: it comes with no guarantees, has usage limits and may log usage. With a SCANOSS API key in SCANOSS_API_KEY, Remixware asks SCANOSS’s own service at api.scanoss.com instead.

Remixware connects to nothing unless you add --scanoss. It treats SCANOSS’s matches like any other input and picks the licence SCANOSS found at the most specific place: an SPDX line in the file first, then a licence header, then the component’s licence file, then what the component declares. It then compares that licence with yours, checks your notice files for credit, applies your allow rules, and writes the HTML report, the notices and the SPDX document.

When to Use Which

Use an index on every pull request: it’s fast, it works offline, and it covers the code your team most often copies from. Add --scanoss before a release or an audit, when wider coverage is worth asking the service. Remixware treats both the same, so the policy and the reports don’t change.