The First Remixware Release Finds Copied Open Source Code and the Licence That Came With It

Code gets into a project from all over the place. Somebody pastes a function from a library they like, or an AI assistant writes a helper that looks a lot like one it saw in training. It works, the tests pass, and nobody writes down where it came from. The terms of the project it was taken from came along with it anyway, and they don’t go away when the code moves.

Remixware 0.1 is a free command-line tool that finds those pieces. It compares your project with open source code you point it at, and for every match it names the source, the licence that came with it, and what that licence asks of you. GPL code in an MIT app is a conflict. An MIT helper that lost its copyright line is missing attribution, and code with no licence at all is code nobody gave you permission to use.

What a Finding Looks Like

Here’s one from the sample shop that comes with Remixware’s tests. A function for sorting file names was copied from a GPL project, with every variable renamed:

CONFLICT             internal/files/order.go:7-46
                     example.org/gplsort, natural.go:14-53 (GPL-3.0-or-later), copied with names changed, 98% match
                     GPL-3.0-or-later code can't go into an MIT project unless the whole program is
                     released under GPL-3.0-or-later. Remove it, rewrite it, or relicense.

Renaming didn’t hide it, because Remixware compares the structure of the code: comments and layout are dropped and every name is replaced by a number. The HTML report puts your lines next to the source’s, so anyone can see the match for themselves.

Where the Originals Come From

Remixware doesn’t ship with a copy of the world’s open source. You build an index from the code you want to compare with, and the obvious place to start is code that’s already on your disk: node_modules, vendor, the Go module cache, a Python virtual environment, or a project you suspect someone copied from. Remixware finds the components in those folders, reads each one’s licence from its licence files and manifest, and stores fingerprints of every source file.

For a check against far more code, Remixware reads the results of the free SCANOSS scanner, which compares your files with a large knowledge base of public open source. Remixware applies your policy to those matches the same way, so you get one list either way.

What It Writes

• An HTML report with every finding, your code and the source side by side, and the reason behind each status.
• Third-party notices, with the copyright lines and licence texts that permissive licences ask you to ship. remixware notice adds the missing entries to your notices file.
• A JSON file for other tools, and an SPDX 2.3 document for a software bill of materials.
• A pass or fail for CI: remixware check exits with 1 when findings break your policy.

How Well It Works

The benchmark plants thousands of copies of real open source functions in a test project, changed in different ways, and counts how many Remixware traces to the right function. It found 98% of the copies of 100 tokens or more, including copies with every name changed and copies of only part of a function. None was traced to the wrong project, and 99,198 lines of code from projects that weren’t indexed produced no false alarms. It skips matches under 50 tokens on purpose, because short code looks alike everywhere. How Remixware was tested has the whole story, misses included.

Get It

Remixware is one program for Linux, macOS and Windows, free and open source under the Apache License 2.0. Download it, follow the quick start to a first report in a few minutes, and see the sample reports to know what to expect. It flags licensing questions; it isn’t legal advice.