Update the Scancode configuration

Oct 13, 2025 by pinkandtrash.com 102 views

Introduction

The Scancode license scan is a powerful tool used to identify and analyze licenses in software projects. However, it has been reported that the Scancode license scan ignores packages without licenses defined. This behavior is undesired, especially when enforcing that all packages fall under an allowed license. In this article, we will delve into the issue, explore the possible causes, and provide a solution to this problem.

Description

The issue was first reported in the Scancode Toolkit GitHub issue #1778. The reporter was running the scancode --package --license command on their repository and noticed that one of their packages was being ignored. The package in question had a package.json file that did not specify a license. The reporter wanted to use Scancode to enforce that all packages fall under an allowed license, but the tool seemed to be ignoring packages that did not specify a license.

How To Reproduce

To reproduce the issue, you can follow these steps:

Install the cycle npm package using the following command:

npm install cycle

Run the Scancode command with the following options:

scancode --verbose --license --package --processes=4 --json-pp scan_results.json --include **/node_modules/**/package.json .

This command will scan the repository and generate a scan results file in JSON format.

System Configuration

To help the Scancode Toolkit developers diagnose the issue, it is essential to provide the following system configuration information:

OS: The operating system being used (Windows, MacOS, or Linux).
Scancode Toolkit version: The version of Scancode Toolkit used to generate the scan file.
Installation method: The method used to install or run Scancode (pip, source download, or other).

Possible Causes

There are several possible causes for this issue:

Package.json file not being read: The Scancode license scan may not be reading the package.json file correctly, leading to the package being ignored.
License not specified: The package may not have a specified license, which could be causing the Scancode license scan to ignore it.
Scancode configuration: The Scancode configuration may be set to ignore packages without licenses defined.

Solution

To resolve this issue, you can try the following solutions:

Specify a license in the package.json file: Add a license field to the package.json file with the desired license.
Update the Scancode configuration: Update the Scancode configuration to include packages without licenses defined.
Use a different Scancode command: Use a different Scancode command that includes packages without licenses defined.

Conclusion

The Scancode license scan ignoring packages without licenses defined is an undesired behavior, especially when enforcing that all packages fall under an allowed license. By understanding the possible causes and solutions, you can resolve this issue and ensure that your software projects comply with the desired licenses.

Future Work

The Scancode Toolkit developers are working on resolving this issue and improving the Scancode license scan. In the future, the Scancode license scan will be able to identify and analyze licenses in software projects more accurately.

References

Scancode Toolkit GitHub issue #1778
Scancode Toolkit documentation
Scancode Toolkit community forum

Appendix

Additional Information

Scancode Toolkit version: 3.0.0
OS: Ubuntu 20.04
Installation method: pip

Exact Commands

scancode --verbose --license --package --processes=4 --json-pp scan_results.json --include **/node_modules/**/package.json .

System Configuration

OS: Ubuntu 20.04
Scancode Toolkit version: 3.0.0
Installation method: pip
Scancode License Scan Ignores Packages Without Licenses Defined: Q&A ====================================================================

Introduction

The Scancode license scan is a powerful tool used to identify and analyze licenses in software projects. However, it has been reported that the Scancode license scan ignores packages without licenses defined. In this article, we will answer some frequently asked questions (FAQs) related to this issue.

Q: What is the Scancode license scan?

A: The Scancode license scan is a tool used to identify and analyze licenses in software projects. It scans the project's code and dependencies to determine the licenses used.

Q: Why is the Scancode license scan ignoring packages without licenses defined?

A: The Scancode license scan is designed to ignore packages without licenses defined. This is because some packages may not have a specified license, and the Scancode license scan is not able to determine the license used.

Q: How can I resolve this issue?

A: To resolve this issue, you can try the following solutions:

Specify a license in the package.json file: Add a license field to the package.json file with the desired license.
Update the Scancode configuration: Update the Scancode configuration to include packages without licenses defined.
Use a different Scancode command: Use a different Scancode command that includes packages without licenses defined.

Q: What are the possible causes of this issue?

A: There are several possible causes of this issue:

Package.json file not being read: The Scancode license scan may not be reading the package.json file correctly, leading to the package being ignored.
License not specified: The package may not have a specified license, which could be causing the Scancode license scan to ignore it.
Scancode configuration: The Scancode configuration may be set to ignore packages without licenses defined.

Q: How can I specify a license in the package.json file?

A: To specify a license in the package.json file, you can add a license field with the desired license. For example:

{
  "name": "my-package",
  "version": "1.0.0",
  "license": "MIT"
}

Q: How can I update the Scancode configuration?

A: To update the Scancode configuration, you can use the scancode command with the --config option. For example:

scancode --config my-config.json

Q: What are the benefits of using the Scancode license scan?

A: The Scancode license scan has several benefits, including:

Identifying licenses used: The Scancode license scan can identify the licenses used in a project.
Analyzing licenses: The Scancode license scan can analyze the licenses used in a project.
Enforcing license compliance: The Scancode license scan can enforce license compliance in a project.

Conclusion

Future Work

References

Scancode Toolkit GitHub issue #1778
Scancode Toolkit documentation
Scancode Toolkit community forum

Appendix

Additional Information

Scancode Toolkit version: 3.0.0
OS: Ubuntu 20.04
Installation method: pip

Exact Commands

scancode --verbose --license --package --processes=4 --json-pp scan_results.json --include **/node_modules/**/package.json .

System Configuration

OS: Ubuntu 20.04
Scancode Toolkit version: 3.0.0
Installation method: pip