6

What would be a recommended tool to scan software code for open source licenses and copyrights?

Some specs:

  • free and open source preferred. No more than $100/month otherwise.
  • should be a tool, not a library, either CLI or GUI/Web.
  • OS, platform and programming language do not matter.
Improve this question
2
  • 1
    A ready-to-use software, or an API/library? On which platform (or in which programming language, if you're after an API), and what is your price limit? Please see: What is required for a question to contain "enough information"? ;)
    – Izzy
    Commented Mar 14, 2017 at 20:06
  • 1
    Did you ever choose a solution? If so, please either accept one of the answers or post and suggest your own. Doing so will help others who read his question in future.
    – Mawg
    Commented Mar 25, 2021 at 18:21

2 Answers 2

Reset to default
4

ScanCode is a tool to scan code and detect licenses, copyrights, packages metadata & dependencies and more... to find, discover, inventory open source and third-party components used in your code.

ScanCode is a suite of utilities used to scan a codebase for license, copyright and other interesting information that can be discovered in files.

A typical software project often reuses hundreds of thirdparty components. License and origin information is often scattered and not easy to find: ScanCode discovers this data for you.

ScanCode provides reasonably accurate scan results and the line position where each result is found. The results can be formatted as JSON or HTML, and ScanCode provides a simple HTML app for quick visualization of scan results.

Improve this answer
3

The debian project developed the Perl script licensecheck. It is available as debian package.

Licensecheck attempts to determine the license that applies to each file passed to it, by searching the start of the file for text belonging to various licenses.

The package is also available on metacpan.

It is used on the command line

$ licensecheck --check '.*' --recursive --deb-machine --lines 0 *
Improve this answer
1
  • It's a dud. I ran the Ubuntu-installed version of this on a distro source tree and it keeps reporting UNKNOWN for large numbers of COPYING files which are verbatim copies of GPLv2.
    – Kaz
    Commented Oct 17, 2023 at 17:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.