Remixware Now Checks Your Code Against SCANOSS With One Flag

An index only knows the code you put in it. For everything else, Remixware 0.1 read the results of SCANOSS’s scanner, which compares files with a large knowledge base of public open source. That meant installing a Python tool, running it, and handing its results file to Remixware.

Remixware 0.2 asks the SCANOSS service itself. Add --scanoss to a scan or a check:

remixware check . --scanoss

What remixware check –scanoss sends for one file of the sample shop: the file goes as 3.go, with its MD5 checksum, its size and hashes of its text, while the code and the file’s name stay on your machine.

It works together with an index, and a copy that both find is reported once:

remixware check . --index deps.rmx --scanoss --html report.html

What Leaves Your Machine

Remixware makes its fingerprints the way SCANOSS’s own scanner does, and a test checks them against that scanner’s output byte for byte. For each file it sends a number with the file’s extension, the file’s MD5 checksum and size, a second checksum taken with the other kind of line endings, and hashes of short runs of its letters and digits. The code stays on your machine, and so do the file names. SCANOSS answers about the numbers, and Remixware matches the answers to your files itself. SCANOSS’s own scanner sends each file’s path instead of a number, unless you run it with --obfuscate. Each request also names Remixware’s version, and carries your API key if you set one.

It sends the files a scan reads, plus the minified files a scan skips (.min.js and .min.css files, and source files with very long lines), since SCANOSS can name a whole minified library. Generated files and binaries stay out, and so do dependency folders unless you add --include-deps. --exclude and your policy’s ignore patterns apply as usual.

The Free Service and Its Limits

By default Remixware asks the free service at api.osskb.org, which the Software Transparency Foundation runs. It needs no account, and its terms apply: it comes with no guarantees, has usage limits and may log usage. When it asks Remixware to slow down for a moment, Remixware waits and tries again. When it asks for a longer wait, as it does once a limit is used up, Remixware stops and says how long, and for a long wait until when. This is what it said on the day 0.2 was finished, when the free service had turned away GitHub’s test machines for the rest of the month:

remixware: SCANOSS: api.osskb.org asks Remixware to wait 5.5 days, until 2026-11-01 00:00 UTC (HTTP 503): {"error":"Rate limit exceeded","retry_after":475287.876556037}. Try again then, or use a SCANOSS API key (--scanoss-key)

A check that gets no answer, or an answer that leaves files out, exits with 2, so it can’t pass on files SCANOSS didn’t look at. With a SCANOSS API key, set SCANOSS_API_KEY and Remixware asks SCANOSS’s own service at api.scanoss.com. --scanoss-url points it at another SCANOSS server, such as one your company runs.

Keeping the Answers

--scanoss-out scanoss.json saves SCANOSS’s answers as a results file. --from scanoss.json reads it back, so you can change your policy, check again or write notices without asking the service a second time. Results files from SCANOSS’s own scanner still work the same way.

Upgrading

Get 0.2 from the download page. Indexes, policy files and reports work as before, and the reference lists the new options. Using Remixware with SCANOSS shows how SCANOSS and your own index fit together.