Remixware

Remixware finds code in your project that was copied from open source, names the licence that code came with, and tells you what that licence asks of you. It catches the GPL function pasted into an MIT project, the MIT helper whose copyright line got lost on the way, and the snippet an AI assistant reproduced from a library it learned from.

A finding reads like this:

CONFLICT             internal/files/order.go:7-46
                     example.org/gplsort, natural.go:14-53 (GPL-3.0-or-later), copied with names changed, 98% match
                     GPL-3.0-or-later code can't go into an MIT project unless the whole program is
                     released under GPL-3.0-or-later. Remove it, rewrite it, or relicense.

Remixware also guards dependency changes. remixware deps compares the packages your lockfiles name with those on your main branch, and fails a pull request that brings in a package nobody allowed, a package that runs install scripts, or a release from a new publisher. See Dependency changes.

Remixware is one program. It connects to nothing unless you ask it to, with --scanoss (it sends fingerprints of your files, never the code) or with deps --online (it asks the npm registry and PyPI about package versions). It's free and open source under the Apache License 2.0. Site: remixware.com.

Remixware flags licensing questions. It isn't legal advice: when a finding matters, ask someone who can give it.

Install

Download the archive for your system from the latest release, unpack it and put remixware on your PATH. The archives are remixware_linux_amd64.tar.gz, remixware_linux_arm64.tar.gz, remixware_darwin_arm64.tar.gz, remixware_darwin_amd64.tar.gz and remixware_windows_amd64.zip, and SHA256SUMS lists their checksums. The archives hold the program and its README, licence and notices with no folder around them, so unpack one into an empty folder.

Or build it with Go 1.24 or later. Remixware uses only the Go standard library:

go install github.com/softdevstudio/remixware/cmd/remixware@latest

Quick start

Remixware compares your code with code you point it at. First make an index of that code, then scan your project against it:

# 1. Fingerprint the open source code you depend on, or any code you suspect was copied.
remixware index ~/go/pkg/mod node_modules --out deps.rmx

# 2. List what your project shares with it, with an HTML report.
remixware scan . --index deps.rmx --html remixware-report.html

# 3. Fail a CI build on licence conflicts, code with no licence and missing attribution.
remixware check . --index deps.rmx

# 4. Write the notices that missing attribution asks for.
remixware notice . --index deps.rmx --out THIRD_PARTY_NOTICES.md

# 5. In a pull request, fail on new packages nobody allowed and on install scripts.
remixware deps . --base-ref origin/main

check exits with 1 when findings break your policy, so a build stops there. After notice has written the entries, the same check passes for attribution. When notice can't find something an entry needs, such as a copyright line, it says so, and that entry counts once you've filled it in. Conflicts and code with no licence can't be fixed with a notice: those need the code removed, rewritten, or a different licence.

What to index

An index holds fingerprints of source files, the component each file belongs to, and that component's licence. Good things to index:

• Your dependencies as they sit on disk: node_modules, vendor, the Go module cache (~/go/pkg/mod), a Python virtual environment's site-packages, Cargo's sources (~/.cargo/registry/src).
• Projects you suspect, cloned with git clone --depth 1.
• Your company's other code, with --license LicenseRef-Proprietary, to see what moved between projects. In a proprietary project those copies are listed for review (fine when both belong to the same owner); in an open source project they are conflicts.

Remixware finds the components inside a folder by their manifests (go.mod, package.json, Cargo.toml, composer.json, pyproject.toml, .dist-info folders) and by folders with a licence file. A component's licence comes from its manifest, its licence files and LICENSES/ folders (REUSE). A folder without a licence takes the licence of the folder above it, except across node_modules, vendor, third_party and similar folders, where it gets none. Code with no licence at all is reported as no-license, because nobody has given permission to copy it.

This is the beginning of the README. Read the rest at the original. Read the full README ↗