use cases

Getting Ready for a Code Audit Before a Sale or a Big Customer

Sooner or later someone outside the team asks what’s in your code. A company that wants to buy yours runs a scan as part of due diligence, or a large customer’s procurement team sends a questionnaire about open source. Both are asking the same thing: is there code in here that the company doesn’t have the right to ship the way it ships it?

The worst time to find out is when their report lands. A GPL file in the core product turns into a price cut or a promise to rewrite it before closing. Running the same kind of check months earlier turns it into an ordinary task.

A readiness summary from a Remixware scan: two conflicts and one file with no licence to fix, five notices to add and one copy already credited, with the HTML, SPDX and notices files ready to hand over.

Build the Index Wide

An audit looks at everything, so index more than you would for a pull request check:

  • the dependencies on disk, for every language in the repository;
  • projects that people on the team are known to have copied from, cloned with git clone --depth 1;
  • code the company doesn’t own, such as a contractor’s earlier work, indexed with its real licence, or with --license LicenseRef-Proprietary when it has none you can use.

Then add SCANOSS for everything else with --scanoss, which asks the SCANOSS service with fingerprints of your files. --scanoss-out scanoss.json keeps its answers, so you can check again later with --from scanoss.json and get the same list without asking again. Remixware puts both sources into one list.

Work Through the List

remixware scan . --index deps.rmx --scanoss --scanoss-out scanoss.json --html audit.html --spdx audit.spdx.json

Fix the conflicts and the code with no licence first, since those need code changes or a conversation with an author. Then run remixware notice for the missing attribution. For findings you decide to keep, such as code covered by a commercial licence, add an allow rule with the reason to .remixware.json. The reason appears next to the finding in the text, HTML and JSON reports, so the decision is written down where the next reader will look.

What to Hand Over

  • The HTML report. One file that works offline, with each finding and the reason for its status, both sides of every match from an index, and a link to the source for SCANOSS matches. Lawyers can read it without installing anything.
  • The SPDX document. An SPDX 2.3 file listing each copied snippet with its source, licence and copyright lines, for the buyer’s or customer’s software bill of materials tools.
  • The notices file. Proof that the attribution the licences ask for is in place.

A lawyer still needs to look, and a buyer will run their own tools anyway. With this done first, their findings shouldn’t surprise you. Remixware flags licensing questions; it isn’t legal advice, and the review findings in particular need a person who knows how the code is used.