Remixware v0.2.1

Running Remixware on real projects for the case studies on remixware.com
found code credited in ways it didn't read. These are fixed:

• A licence file kept with the code now counts as credit, as projects that
  vendor a library keep it: typer keeps Click's licence in
  typer/_click/LICENSE.txt, pip keeps each vendored library's in its
  folder, and coyim keeps xmpp-client's in LICENSE.xmpp-client at its
  top. Remixware reads the licence and notice files anywhere in the project,
  outside the folders a scan skips such as vendor/ and node_modules/,
  and a full copyright line or a name in one of them credits the copy, as
  in a notices file. 0.2.0 read only notice files in the top folder and
  the copied file's own header, and called these copies
  attribution-missing. Paths --exclude and the policy's ignore name
  are left out, and source files named like notices (attribution.go)
  and build files named like them (ThirdParty.cmake) aren't read as
  notices, at the top either. Findings that are credited
  carry "credited": true in the JSON report, and notice writes no
  entry for them.
• For a source whose licence text names no copyright holder (the Apache and
  Mozilla texts don't), its own licence text kept whole counts as credit in
  the nearest folder with a licence file (LICENSE, COPYING), starting with
  the copy's own and short of the project's top. If the
  source ships a NOTICE, its NOTICE text has to be there too, and the
  finding says so when only the licence is.
• A short licence file that offers others as a choice ("either of the
  licenses found in LICENSE.APACHE or LICENSE.BSD", as packaging's does) is
  read as that choice, no longer as an unrecognised licence. The files have
  to be listed as alternatives in a sentence that offers the choice; other
  short files that name licence files are read as before.
• Archives and images whose names start like a licence file
  (license.dist-0.1-py2.py3-none-any.whl) aren't read as licence files.
• A source release built with setuptools keeps its licence file at the top
  and its metadata in an .egg-info folder. The package indexed from that
  metadata now takes the release's licence text, copyright lines and
  NOTICE. An index no longer passes a licence or its texts across a
  _vendor or vendored folder, and a project reached through a symbolic
  link is read like any other with --from alone too.
• A licence given in words in pyproject.toml ("ISC License") is read as
  its SPDX id, and words Remixware can't place no longer become a licence
  of their own.
• scripts/case_studies.py records the case studies (typer and Click,
  coyim and xmpp-client, pip's vendored libraries) in
  test/results/case-studies.

Remixware v0.2.0

• --scanoss asks the SCANOSS service directly, so a check covers a large
  share of public open source without running SCANOSS's scanner first.
  Remixware makes its fingerprints the way that scanner does and sends
  them with numbers in place of file names: no code and no file names
  leave the machine. It works with scan, check and notice, alone or
  together with --index and --from.
• --scanoss-key (or SCANOSS_API_KEY) uses a SCANOSS API key and the
  service for key holders, --scanoss-url (or SCANOSS_SCAN_URL) another
  SCANOSS server, and --scanoss-out saves the answers as a SCANOSS results
  file for --from. As with SCANOSS's scanner, the URL's host is asked at
  /scan/direct. Redirects aren't followed, and a user name, password or
  query in the URL never shows up in output or reports.
• An answer has to cover every file sent. One that leaves files out, as
  the service does when part of its work fails, is asked for again and then
  ends the command with exit code 2, so a check can't pass on files
  SCANOSS didn't look at.
• A rate limit, a server error or an incomplete answer is tried again,
  after as long as the service asks, a minute at a time, with a line saying
  so. When the service asks for a longer wait than the tries left could
  cover, Remixware stops at once and says how long, and for a long wait
  until when. A refused
  key, an answer that isn't SCANOSS results or a service that doesn't
  answer ends the command with exit code 2.
• The minified files a scan skips (.min.js, .min.css and source files
  with very long lines) go to SCANOSS too, since it can name a whole
  minified library.
• JSON reports list the service as an input of kind scanoss-api, with
  its address.
• Text from SCANOSS answers, results files and indexes made elsewhere
  can't act on a terminal: escape sequences, line breaks inside a name and
  direction marks are taken out, and everything else stays, spacing
  included, so copyright lines still match. Everything the command prints
  goes through the same filter. A copyright line that would start a
  Markdown block in a notices file is escaped.
• An entry of a results or findings file whose path points outside the
  project or holds such characters is left out with a warning, counted as
  dropped in the JSON report's inputs, and makes check exit with 2.
• A results file may give one file at most 100 SCANOSS matches, each with
  at most 100 licences, copyright lines or package URLs, and a findings
  file at most 20,000 findings per file, each with at most 100 copyright
  lines; more ends the command with exit code 2, since a broken or made-up
  file could otherwise cost hours.
• SCANOSS answers write a missing vendor as "None". Remixware no longer
  puts "None/" in front of such a component's name, in results files read
  with --from too.

Remixware v0.1.1

• Copyright lines no longer come from inside a licence's own text. Item
  (c) of a licence's list, such as the MPL-2.0's "(c) under Patent Claims
  infringed by Covered Software" or the Apache-2.0's "(c) You must retain
  ...", was taken for a copyright line, and so was a licence document's own
  copyright, such as the Free Software Foundation's at the top of the GPL.
  A copyright line counts as credit, so a notices file carrying the same
  licence text for another library could credit the copied code. Templates
  such as "Copyright (C) year name of author" are skipped too. A component
  under one of those licences with no copyright line of its own now gets a
  notice entry that asks for one, as other components already did.
• The README lists index --max-common and --quiet, and every language
  Remixware reads.

Remixware v0.1.0

First release.

• remixware index fingerprints third-party code (dependency folders, the
  Go module cache, cloned projects) and records each file's component and
  licence. Components are found by go.mod, package.json, Cargo.toml,
  composer.json, pyproject.toml and .dist-info folders, and by
  folders with a licence file. Licences come from manifests, licence
  files, REUSE LICENSES/ folders, Cargo workspaces and the comments at
  the top of each file. A file header adds to its component's licence but
  can't replace a stricter one, a header offering a choice is read as one,
  and dual licence files such as LICENSE-MIT and LICENSE-APACHE read as
  a choice.
• remixware scan finds code a project shares with the indexes, including
  copies that were reformatted, had their comments changed, had their names
  changed or were partly edited, and reports each with its source, its
  licence and a status: conflict, no-license, review, attribution-missing,
  attributed, allowed or ok. A copy that needs a review and its notice
  counts as attribution-missing until the notice is there. Indexed code
  inside the project counts as third-party when it sits in a vendor-style
  folder or has a licence of its own, and as the project's own otherwise.
  Symbolic links in the project aren't followed, and the scan says how
  many it passed.
• remixware check is the same as a pass or fail gate for CI, with exit
  code 1 when findings break the policy. A check that couldn't read a file,
  or found nothing to scan, exits with 2 instead of passing.
• remixware notice writes third-party notice entries with copyright lines
  and licence texts, and skips entries the notices file already has. An
  entry it couldn't finish doesn't count as credit until it's finished.
• --from reads results files from the SCANOSS scanner (scanoss-py scan -o results.json) and findings files from remixware scan --json. A copy
  found by both an index and SCANOSS is reported once.
• A policy file (.remixware.json) sets the project's licence, the
  statuses that fail a check, paths to ignore, notice files, and allow
  rules that need a reason.
• Reports: a self-contained HTML page with both sides of every match, a
  JSON findings file and an SPDX 2.3 document that passes SPDX validation.
• Indexes are data: a damaged or made-up index is refused, including one
  that unpacks to far more than its size or lists more files than it could
  hold, and an indexed file is read back only when its bytes match the
  checksum the index holds. No index makes a scan skip a file. Symbolic
  links aren't followed when indexing, and nothing outside the indexed
  folders is read.
• Reads Go, C and C++, Java, C#, Kotlin, Swift, Scala, JavaScript and
  TypeScript, Rust, Python, Ruby, PHP, shell, Perl, SQL, Lua, CSS and a few
  more. Windows line endings give the same results as Unix ones.
• remixware licenses lists the licences Remixware knows and what copying
  each one into an MIT project needs.