Re: License auditing

[Philippe Ombredanne <pombredanne@nexb.com>]

On Wed, 3 Aug 2016 19:55:11 +0200, Danny Milosavljevic wrote:
> See also <https://spdx.org/licenses/> (especially
> <https://github.com/triplecheck/>),
> <http://www.sciencedirect.com/science/article/pii/S0164121216300905> (also
> lists several license checkers; Fossology seems to be a whole webservice which
> does that).

On Wed, 3 Aug 2016 14:05:06 -0400, Leo Famulari wrote:
> There could also be binaries with no source code, some code with a
> unique license, or countless other ways to confuse a license parser.

On Thu, 4 Aug 2016 00:59:52 +0200, David Craven wrote:
> I found a promising package to help with license auditing. It's not
> perfect judging from the bug reports, but it seems pretty nice. It is
> the only option I found which is intended for scripted usage (has a
> nice cli interface). I'll package it tomorrow. Interesting would be to
> write a plugin for guix to see how it's findings compare to the
> licenses declared in guixsd.
> [0]
> https://github.com/nexB/scancode-toolkit/blob/develop/src/scancode/cli.py#L204


Hello guixers!
Scancode maintainer here!
Scancode detects licenses and more and it tries hard not to get
confused by the countless
ways licenses are written or mentioned.

It also does not require any specific install beyond a Python
interpreter and runs
from the command line and could come handy there.

There are bugs but I track these actively and fix them eventually!
I am curious if this breaks a few assumptions in Guix or not.
For instance, I vendor all third-parties such that a simple tarball
has everything it
needs to run except for a Python interpreter. But this could be
eventually borken down
in a python package and several lib deps if you want to go this route in Guix.

PS: I am also one of the SPDX co-founders.

I would be glad to help in any way I can.
-- 
Cordially
Philippe Ombredanne