Re: License auditing

[Philippe Ombredanne]

On Wed, 3 Aug 2016 19:55:11 +0200, Danny Milosavljevic wrote:
> See also <https://spdx.org/licenses/> (especially
> <https://github.com/triplecheck/>),
> <http://www.sciencedirect.com/science/article/pii/S0164121216300905> (also
> lists several license checkers; Fossology seems to be a whole webservice which
> does that).

On Wed, 3 Aug 2016 14:05:06 -0400, Leo Famulari wrote:
> There could also be binaries with no source code, some code with a
> unique license, or countless other ways to confuse a license parser.

On Thu, 4 Aug 2016 00:59:52 +0200, David Craven wrote:
> I found a promising package to help with license auditing. It's not
> perfect judging from the bug reports, but it seems pretty nice. It is
> the only option I found which is intended for scripted usage (has a
> nice cli interface). I'll package it tomorrow. Interesting would be to
> write a plugin for guix to see how it's findings compare to the
> licenses declared in guixsd.
> [0]
> https://github.com/nexB/scancode-toolkit/blob/develop/src/scancode/cli.py#L204


Hello guixers!
Scancode maintainer here.
Scancode detects licenses and more and it tries hard not to get
(too) confused by the countless ways licenses are written or mentioned.

It also does not require any specific install beyond a Python
interpreter and runs from the command line and could come
handy there.

There are bugs but I track these actively and fix them eventually.

I am curious if this breaks a few assumptions in Guix or not:
I vendor all third-parties such that a simple tarball has
everything it needs to run except for a Python interpreter.

But this could be eventually broken down in a python package
and several lib deps to package it in Guix.
See also this conversation with David [1]

PS: I am also one of the SPDX co-founders.

I will be glad to help in any modest way I can.

 [1] https://github.com/nexB/scancode-toolkit/issues/288

-- 
Cordially
Philippe Ombredanne