Posts on remixware.com

Checking AI-Written Code for Open Source It Reproduced

Mon, 26 Oct 2026 00:00:00 +0000

AI coding assistants write a lot of code now, and most of it is new: glue between your own functions and small helpers built for the problem in front of them. Now and then, though, an assistant writes something it has seen many times before. A well-known function from a popular library comes out nearly word for word, sometimes with the names changed to fit your code.

That copy can carry the licence of the code it came from. If the original was MIT, you owe its authors a copyright line in your notices. If it was GPL, the copy may not belong in a closed product at all. The assistant doesn’t tell you which happened, and code review rarely catches it, because the code looks fine and does what it should.

Copied Code Brings Its Licence Along: What Open Source Licences Ask of You

Mon, 26 Oct 2026 00:00:00 +0000

Open source code is free to use, and it comes with conditions. Every open source project comes with a licence, and the licence is the deal: you may copy, change and share this code, as long as you do certain things in return. Those things are usually small. Sometimes they’re large enough to decide how you can ship your whole product.

The conditions travel with the code. When a function moves from a library into your project, however it got there, its licence comes with it, even if the licence text stays behind. Here’s what the common licences ask, from the least to the most.

Getting Ready for a Code Audit Before a Sale or a Big Customer

Mon, 26 Oct 2026 00:00:00 +0000

Sooner or later someone outside the team asks what’s in your code. A company that wants to buy yours runs a scan as part of due diligence, or a large customer’s procurement team sends a questionnaire about open source. Both are asking the same thing: is there code in here that the company doesn’t have the right to ship the way it ships it?

The worst time to find out is when their report lands. A GPL file in the core product turns into a price cut or a promise to rewrite it before closing. Running the same kind of check months earlier turns it into an ordinary task.

GPL 2 Firmware and the Apache Code That Cannot Go In

Mon, 26 Oct 2026 00:00:00 +0000

A lot of firmware is licensed under GPL version 2, because it’s built on Linux, BusyBox or U-Boot, and a lot of it says “version 2 only”. That choice shuts out more code than people expect. Apache 2.0 code can’t go in, even though Apache is permissive. GPL version 3 code can’t go in either, even though it’s the GPL. The same Apache code would be fine in an MIT product and the GPL-3.0 code in a GPL-3.0 one, so a function that’s harmless in one of your products can be a problem in another.

How Remixware Was Tested: 2880 Planted Copies of Real Open Source Code

Mon, 26 Oct 2026 00:00:00 +0000

A tool that says “this code was copied” has to be right in two directions. It has to find the copies, including the ones that were tidied up, renamed or cut down. And it has to stay quiet about code that only looks like something else, because a report full of false alarms gets ignored. Remixware’s tests measure both, on real open source, and every test and benchmark number here comes from the files the tests write.

Remixware Now Checks Your Code Against SCANOSS With One Flag

Mon, 26 Oct 2026 00:00:00 +0000

An index only knows the code you put in it. For everything else, Remixware 0.1 read the results of SCANOSS’s scanner, which compares files with a large knowledge base of public open source. That meant installing a Python tool, running it, and handing its results file to Remixware.

Remixware 0.2 asks the SCANOSS service itself. Add --scanoss to a scan or a check:

remixware check . --scanoss

Sample Remixware Reports: An Online Shop, a Firmware Project and a Clean One

Mon, 26 Oct 2026 00:00:00 +0000

These are real reports from the test projects that come with Remixware, made by the same commands you’d run on your own code. The projects are small on purpose, so you can read every finding, and each one is planted for a reason: a copy with names changed, a copy with lines edited, a copy that’s credited properly, and code that only looks like someone else’s.

The open source they copy from is a set of small projects written for the tests, under MIT, BSD, ISC, zlib, Apache 2.0, MPL 2.0, GPL, AGPL and no licence at all. Each report was made with remixware scan against an index of those projects.

Stop GPL Code at the Pull Request: A Licence Check in CI

Mon, 26 Oct 2026 00:00:00 +0000

The cheapest moment to deal with copied code is before it merges. Once it ships, a GPL function in a closed product means a release to pull back and a rewrite under pressure. In a pull request it means a red build and a few lines to replace.

remixware check is made for that moment. It scans the project, applies your policy, prints what breaks it, and exits with status 1, so the build stops. When nothing breaks the policy it prints PASS and exits with 0. A check that couldn’t do its job exits with 2 instead of passing: a file it can’t read, or a folder with no source files to scan, which usually means a wrong path or an --exclude that covers everything.

The First Remixware Release Finds Copied Open Source Code and the Licence That Came With It

Mon, 26 Oct 2026 00:00:00 +0000

Code gets into a project from all over the place. Somebody pastes a function from a library they like, or an AI assistant writes a helper that looks a lot like one it saw in training. It works, the tests pass, and nobody writes down where it came from. The terms of the project it was taken from came along with it anyway, and they don’t go away when the code moves.

Third-Party Notices Without the Spreadsheet

Mon, 26 Oct 2026 00:00:00 +0000

Most open source licences ask for one thing in return: keep the copyright line and the licence text with the code. For dependencies, package tools and app stores help with that. For code that was copied into your own files, nothing does, so the credit usually gets lost on the way and the notices file never hears about it.

Remixware finds those copies and writes the missing entries. The loop has three steps: check, write the notices, check again, with a stop in between when an entry needs something only you can find.

Why Remixware: Software Built From Other Software

Mon, 26 Oct 2026 00:00:00 +0000

In music, a remix is a new track made from recordings that already exist. The producer takes the vocals from one song, the drums from another, a bass line from a third, and builds something that wasn’t there before. Nobody pretends the parts were recorded from scratch, and when it’s done properly, the people who made them get credit.

Most software is made the same way now. A new program pulls in a web framework and a pile of libraries, and on top of those it carries smaller pieces, like a snippet from a forum answer or a helper an AI assistant wrote after seeing thousands like it. Software built from other software. Remixware is a name for that kind of software, and for a tool that keeps track of the parts.

Wide Coverage With SCANOSS, Offline Checks With Remixware

Mon, 26 Oct 2026 00:00:00 +0000

Remixware compares your code with code you index, and an index only knows what you put in it. That’s enough for the libraries in your own stack, which is where most copies come from. But a function can come from anywhere, such as a project you never installed or an old gist.

For those, Remixware works with SCANOSS, which keeps a large knowledge base of public open source that you can check files against for free. SCANOSS finds the matches. Remixware applies your policy to them, sorts them into the same statuses as its own findings, writes the notices, and gives you one report and one pass or fail.