Create license scan quality improvement campaigns for specific ecosystems

aboutcode-org / scancode.io

ScanCode.io is a server to script and automate software composition analysis pipelines with ScanPipe pipelines. This project is sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ Google Summer of Code, nexB and others generous sponsors!

https://scancodeio.readthedocs.io

Apache License 2.0

115 stars 85 forks source link

Create license scan quality improvement campaigns for specific ecosystems #34

Open pombredanne opened 4 years ago

pombredanne commented 4 years ago

Doing massive scans of all the packages of a given ecosystem (say Maven, PyPi, etc.) I would like to:

run the https://github.com/nexB/scancode-results-analyzer/ on each to determine where there are issues or no issue
working closely with that package community, organize a review queue based on detected issue
based on the https://github.com/nexB/scancode-results-analyzer/ output generate new scancode detection rules to improve license detection and bring these in a review queue

Some candidates for these could be these:

Debian with @pabs @jonassmedegaard and other
CPAN with @StuartJMackintosh
PyPI with the PyPA folks and the the community there
Go

mjherzog commented 3 years ago

This type of work will require engagement/support from the ecosystem leaders and participants and the specific approach may vary by ecosystem/community. I suggest that we start with PyPi since we already have some engagement there.

StuartJMackintosh commented 3 years ago

Thanks for the mention and ready to support engagement with the Perl ecosystem.

pombredanne commented 3 years ago

@StuartJMackintosh excellent! let's try to hook up sometimes next week to discuss the specifics. I can be reached at pombredanne@gmail.com or pom@nexb.com

pombredanne commented 3 years ago

Some progress... we have put together Google summer of code project ideas to support this. I will be looking also for doing some fundraising. Help is much welcomed there.