incubator-general mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Romain Manni-Bucau <rmannibu...@gmail.com>
Subject Re: What is the best tool to scan the code?
Date Wed, 04 Sep 2019 21:22:30 GMT
Hi,

1. ossindex from sonatype covers a lot
2. not sure what you means, findbugs or more checkstyle/pmd?
3. rat plugin for example (see apache creadur tools too, there are license
tools). Also note that with the initial dep review + review of the license
each time a new dep is added in standard asf review flow you rarely need to
scan them actually.
4. you can also check binary only contains your code + deps so no need to
rescan in such a case.

Blackduck is good but does not scale well for huge projects (> 60 modules)
and is not free, sourceclear is also a not that bad alternative but is not
free too I think.

My 2cts being that the previous setup works well for asf projects, stays
free and integrated to the build (compared to blackduck or sourceclear
which are using two steps/async process as solutions).

Hope it helps

Le mer. 4 sept. 2019 à 23:13, Xun Hu <xun.hu@futurewei.com> a écrit :

> We would like to scan our code to:
> 1) dependency analysis
> 2) snippet matching
> 3) license analysis
> 4) binary analysis  - optional
>
> We found one paid solution - black duck, not sure there is any open source
> solution on the market.
>
> Thanks,
> -xun
>
> -----Original Message-----
> From: Justin Mclean <justin@classsoftware.com>
> Sent: Wednesday, September 4, 2019 1:59 PM
> To: general@incubator.apache.org
> Subject: Re: What is the best tool to scan the code?
>
> HI,
>
> > We have one open source project, and I would like to find a tool to scan
> the code before we open it.
>
> Sorry but it unclear to me, what you what to scan the code for.
>
> Thanks,
> Justin
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: general-unsubscribe@incubator.apache.org
> For additional commands, e-mail: general-help@incubator.apache.org
>
>

Mime
  • Unnamed multipart/alternative (inline, None, 0 bytes)
View raw message