Provenant
Website · Why Provenant? · Workflows · Install · CLI Guide · Benchmarks · Supported Formats · Architecture
Provenant is a fast, Rust-based code scanner for licenses, copyrights, package metadata, file metadata, and related provenance data, focused on correctness, safe static parsing, and native execution.
Provenant ports the ScanCode Toolkit engine to Rust and builds on it; on documented workloads it is typically well over 10× faster — and more on large repositories — while adding broader package and dependency extraction, lower-noise results, and CI-ready compliance gating. See Why Provenant?.
The same astral-sh/uv scan, identical flags (--license --package), one process each: Provenant finishes in seconds while the reference is still going. See the annotated speed & output-quality comparison, or the full benchmarks.
Quick Start
brew install getprovenant/tap/provenant
provenant scan --json-pp - --license --package /path/to/repo
Not on Homebrew? On Windows, use Scoop. Otherwise cargo install --locked provenant-cli, grab a prebuilt archive, or run the container image.
Why Provenant?
- Benchmark-backed speed — well over 10× faster than the reference on same-host runs, and more on large repositories
- Package and dependency extraction across many ecosystems, reading manifests and lockfiles into structured package metadata and dependencies
- Complete SBOMs — SPDX and CycloneDX exports promote every resolved dependency to a component with a package URL and a closed dependency graph, not a packages-only summary that references materials it never lists; see real, verified examples in
examples/sbom/
- Monorepo-aware inventories — workspace, reactor, and multiproject layouts (Cargo, npm/pnpm/yarn, Maven, Gradle, uv, Mix, Dart, and related) attribute nested sources and shared locks to the package that owns them
- Low-noise license and copyright detection — suppresses common false-positive classes such as code and prose bleed, and treats bare-word GPL/LGPL mentions as license clues; see documented improvements
- CI license-compliance gating — policy severities with a build-failing
--fail-on gate and SARIF output for the code-scanning UI
- Source-faithful file-level copyright by default — accented names are kept as written (e.g.
Björn, not ASCII-folded to Bjorn) and statements such as All rights reserved. aren't trimmed away
- Attested releases — every release binary and container image ships with SLSA build-provenance attestation, verifiable with
gh attestation verify
- Security-first static parsing — no execution of scanned code or package-manager code, with bounded resource use
This is the beginning of the README. Read the rest at the original. Read the full README ↗
