scancode-toolkit 3.2.3

ScanCode is a tool to scan code for license, copyright, package and their documented dependencies and other interesting facts.

A typical software project often reuses hundreds of third-party packages. License and origin information is not always easy to find and not normalized: ScanCode discovers and normalizes this data for you.

Read more about ScanCode here: scancode-toolkit.readthedocs.io.

Why use ScanCode?

• As a standalone command-line tool, ScanCode is easy to install, run, and embed in your CI/CD processing pipeline. It runs on Windows, macOS, and Linux.

• ScanCode is used by several projects and organizations such as the Eclipse Foundation, OpenEmbedded.org, the FSFE, the FSF, OSS Review Toolkit, ClearlyDefined.io, RedHat Fabric8 analytics, and many more.

• ScanCode detects licenses, copyrights, package manifests, direct dependencies, and more both in source code and binary files.

• ScanCode provides the most accurate license detection engine and does a full comparison (also known as diff or red line comparison) between a database of license texts and your code instead of relying only on approximate regex patterns or probabilistic search, edit distance or machine learning.

• Written in Python, ScanCode is easy to extend with plugins to contribute new and improved scanners, data summarization, package manifest parsers, and new outputs.

• You can save your scan results as JSON, HTML, CSV or SPDX. And you can use the companion ScanCode workbench GUI app to review and display scan results, statistics and graphics.

• ScanCode is actively maintained, has a growing users and contributors community.

• ScanCode is heavily tested with an automated test suite of over 20,000 tests.

See our roadmap for upcoming features.

Build and tests status

Branch	Coverage	Linux/macOS	Windows
Master
Develop

Documentation Build

Version	RTD Build
Latest

Documentation

The ScanCode documentation is hosted at scancode-toolkit.readthedocs.io.

If you are new to Scancode, start here.

Other Important Documentation Pages:

• A synopsis of ScanCode command line options.

• Tutorials on:

  • How to run a scan

  • How to visualize scan results

• An exhaustive list of all available options

• Documentation on Contributing to Code Development

• Documentation on Plugin Architecture

• FAQ

See also https://aboutcode.org for related companion projects and tools.

Installation

Before installing ScanCode make sure that you have installed the prerequisites properly. This means installing Python (Python 3.6 is required in most cases). See prerequisites for detailed information on the support platforms and Python versions.

There are a few common ways to install ScanCode.

• *Recommended* installation as an application: Download a release archive, extract and run.

• Development installation from source code: git clone

• Development installation as a library: via pip install scancode-toolkit[full]

• Run as a Docker container: git clone and docker run

Quick Start

Note the commands variation across installation methods and platforms.

You can run an example scan printed on screen as JSON:

./scancode -clip --json-pp - samples

Follow the How to Run a Scan tutorial to perform a basic scan on the samples directory distributed by default with Scancode.

See more command examples:

./scancode --examples

See How to select what will be detected in a scan and How to specify the output format for more information.

You can also refer to the command line options synopsis and an exhaustive list of all available options.

Archive extraction

ScanCode does not extract by default files from tarballs, zip files, and other archives as part of the scan. The archives that exist in a codebase must be extracted before running a scan: the bundled utility extractcode is a mostly-universal archive extractor. For example, this command will recursively extract the mytar.tar.bz2 tarball in the mytar.tar.bz2-extract directory:

./extractcode mytar.tar.bz2

See all extractcode options and how to extract archives for details.

Support

If you have a problem, a suggestion or found a bug, please enter a ticket at: https://github.com/nexB/scancode-toolkit/issues

For discussions and chats, we have:

• an official Gitter channel for web-based chats. Gitter is also accessible via an IRC bridge. There are other AboutCode project-specific channels available there too.

• an official #aboutcode IRC channel on freenode (server chat.freenode.net). This channel receives build and commit notifications and can be noisy. You can use your favorite IRC client or use the web chat.

Source code and downloads

• https://github.com/nexB/scancode-toolkit/releases

• https://github.com/nexB/scancode-toolkit.git

• https://pypi.org/project/scancode-toolkit/

• https://github.com/nexB/scancode-thirdparty-src.git

License

• Apache-2.0 with an acknowledgement required to accompany the scan output.

• Public domain CC0-1.0 for reference datasets.

• Multiple licenses (GPL2/3, LGPL, MIT, BSD, etc.) for third-party components.

See the NOTICE file and the .ABOUT files that document the origin and license of the third-party code used in ScanCode for more details.