Quick Start

This page takes you from nothing to a first report in a few minutes. You need the remixware command (see Download) and a project to check.

1. Pick What to Compare With

Remixware compares your code with code you give it. It doesn’t come with a copy of all the world’s open source, so the first step is an index of the code you want to check against. Good first choices are the dependencies that already sit on your disk:

cd my-project
remixware index node_modules --out deps.rmx            # a JavaScript project
remixware index ~/go/pkg/mod --out deps.rmx            # Go: the module cache
remixware index .venv/lib --out deps.rmx               # Python: the virtual environment

You can name several folders at once, and add any project you suspect was copied from, cloned with git clone --depth 1. Remixware finds the components inside the folders by their manifests and licence files, reads each one’s licence, and prints what it found. For the small open source projects in Remixware’s own tests, that’s:

Indexed 10 files (539 lines) in 10 components into upstream.rmx (22 KB) in 25ms.
Licences: MIT 2, AGPL-3.0-or-later 1, Apache-2.0 1, BSD-3-Clause 1, GPL-3.0-or-later 1, ISC 1, MPL-2.0 1, NONE 1, Zlib 1
1 component has no licence: copies of its code will be reported as no-license.

2. Scan Your Project

remixware scan . --index deps.rmx --html remixware-report.html

Each finding names your file and lines, the source it matches, the licence that came with it, and what that licence asks:

CONFLICT             internal/files/order.go:7-46
                     example.org/gplsort, natural.go:14-53 (GPL-3.0-or-later), copied with names changed, 98% match
                     GPL-3.0-or-later code can't go into an MIT project unless the whole program is
                     released under GPL-3.0-or-later. Remove it, rewrite it, or relicense.

Open remixware-report.html in a browser to see your code and the source side by side. The sample reports show what a full report looks like.

Remixware reads your project’s licence from its licence file. If it can’t find one, or the code ships under other terms, say so with --license MIT (any SPDX expression works).

3. Fix What It Found

  • Conflict: the copied code’s licence doesn’t fit yours. Remove the code, rewrite it without looking at the original, or ask its author for other terms.
  • No license: nobody gave permission to copy it. Remove it or ask the author.
  • Review: a person needs to look, for example at MPL-2.0 code, which has to stay in its own file under its own licence. Until its notice is in, such a copy shows as attribution missing.
  • Attribution missing: the licence allows the copy but wants its copyright line and licence text shipped with your code. Remixware can write those for you:
remixware notice . --index deps.rmx --out THIRD_PARTY_NOTICES.md

notice adds one entry per component, with the copyright lines, the licence text and the files that use it, and leaves alone the entries the file already has.

4. Check It in CI

remixware check works like scan but exits with 1 when findings break your policy, so a build stops there:

remixware check . --index deps.rmx

By default it fails on conflicts, code with no licence and missing attribution. A .remixware.json file in your project can change that, ignore folders, and accept specific findings with a reason. The reference lists every option, and the CI post has a ready GitHub Actions step.

5. Go Wider With SCANOSS

An index only knows what you put in it. To compare your code with a large share of all public open source, add --scanoss:

remixware check . --index deps.rmx --scanoss

Remixware sends fingerprints of your files to the free SCANOSS service, never the code or the file names, and applies your policy to SCANOSS’s matches as it does to your index’s. A copy that both find is reported once. The free service has usage limits. If you have a SCANOSS API key, put it in SCANOSS_API_KEY. Using Remixware with SCANOSS explains what each part does.