Skip to content

Remixware v0.2.0

Choose a tag to compare

@github-actions github-actions released this 26 Oct 14:10
· 4 commits to main since this release
32ab52a
  • --scanoss asks the SCANOSS service directly, so a check covers a large
    share of public open source without running SCANOSS's scanner first.
    Remixware makes its fingerprints the way that scanner does and sends
    them with numbers in place of file names: no code and no file names
    leave the machine. It works with scan, check and notice, alone or
    together with --index and --from.
  • --scanoss-key (or SCANOSS_API_KEY) uses a SCANOSS API key and the
    service for key holders, --scanoss-url (or SCANOSS_SCAN_URL) another
    SCANOSS server, and --scanoss-out saves the answers as a SCANOSS results
    file for --from. As with SCANOSS's scanner, the URL's host is asked at
    /scan/direct. Redirects aren't followed, and a user name, password or
    query in the URL never shows up in output or reports.
  • An answer has to cover every file sent. One that leaves files out, as
    the service does when part of its work fails, is asked for again and then
    ends the command with exit code 2, so a check can't pass on files
    SCANOSS didn't look at.
  • A rate limit, a server error or an incomplete answer is tried again,
    after as long as the service asks, a minute at a time, with a line saying
    so. When the service asks for a longer wait than the tries left could
    cover, Remixware stops at once and says how long, and for a long wait
    until when. A refused
    key, an answer that isn't SCANOSS results or a service that doesn't
    answer ends the command with exit code 2.
  • The minified files a scan skips (.min.js, .min.css and source files
    with very long lines) go to SCANOSS too, since it can name a whole
    minified library.
  • JSON reports list the service as an input of kind scanoss-api, with
    its address.
  • Text from SCANOSS answers, results files and indexes made elsewhere
    can't act on a terminal: escape sequences, line breaks inside a name and
    direction marks are taken out, and everything else stays, spacing
    included, so copyright lines still match. Everything the command prints
    goes through the same filter. A copyright line that would start a
    Markdown block in a notices file is escaped.
  • An entry of a results or findings file whose path points outside the
    project or holds such characters is left out with a warning, counted as
    dropped in the JSON report's inputs, and makes check exit with 2.
  • A results file may give one file at most 100 SCANOSS matches, each with
    at most 100 licences, copyright lines or package URLs, and a findings
    file at most 20,000 findings per file, each with at most 100 copyright
    lines; more ends the command with exit code 2, since a broken or made-up
    file could otherwise cost hours.
  • SCANOSS answers write a missing vendor as "None". Remixware no longer
    puts "None/" in front of such a component's name, in results files read
    with --from too.