AboutCode.org

Mentors: Student: ROHIT POTTER

<p><a href="https://github.com/nexB/scancode-toolkit" target="_blank">ScanCode</a> is an opensource software and detects licenses, copyrights, package manifests &amp; dependencies and more by scanning code. This allows to automated discovery of third-party packages, licenses being used in a project. Scancode currently handles various package metadata formats, such as for npm (package.json), python (setup.py). The goal of this project is to add additional package metadata and lockfile parsers to scancode-toolkit. Scancode currently implements parsers for Python packages (setup.py, .whl), package-lock.json/npm-shrinkwrap.json , Ruby Gems (Gemfile, Gemfile.lock), Java Jars, PHP Composer Packages, Debian .deb files/Yum .rpm files, Rust crates.</p> <p>However, there a few formats still missing - such as:</p> <ul> <li>Ruby Gems (.gemspec)</li> <li>.podspec</li> <li>Go (go.mod, go.sum)</li> <li>Scala (.sbt)</li> <li>OCaml(.opam)</li> <li>Python packages (requirements.txt, pipfile.lock)</li> <li>Rust (cargo.lock)</li> </ul>

Mentors: Student: Tushar Goel

<p>The goal of this project is to create a smart tool/library that provides a universal package and code download from VCS, web, ftp, etc.</p>

Mentors: Student: ayansinha23

<p>ScanCode license detection is using multiple techniques to accurately detect licenses based on automatons, inverted indexes, and multiple sequence alignments. The detection is not always accurate enough. The goal of this project is to improve the accuracy of license detection leveraging the ClearlyDefined data set, where ScanCode is used to massively scan millions of packages.</p> <p>Some of the cases (not limited to) where this project proposes to improve license detection accuracy are:</p> <ul> <li>when multiple licenses are detected with a low score and some detections are incorrect.</li> <li>when some unknown licenses may not be detected correctly.</li> <li>text/code identical to license tags resulting in false-positives</li> <li>when license references such as "see license in file LICENSE.txt" are reported as unknown license references.</li> </ul> <p>This project aims to write tools and create models to massively analyze the accuracy of license detection and detect areas where the accuracy could be improved. These tools and models would be reusable to assist in the semi-automated review of scan results. It will also create new license detection rules semi-automatically to fix the detected anomalies.</p>

Mentors: Student: Abhishek Kumar

<p>Python 2.7 has already retired and it will no longer be maintained therefore it will better to drop the support of Python 2. It will also include removal of test suite for scancode-toolkit and this project is an extension of my previous year GSoC 2019 porting project. Also to add the support for python 3.7 and python 3.8 and to improve the third party package provision. Currently, we maintain a third party repository which locks all dependencies of scancode.But we face the following problems. a)We supported Python 2 &amp; Python 3.6. Each version of python may need a pre-built wheel if there is native code. And to add support for python 3.7, 3.8 we have to add wheels in the third party repo of 4 variants(oses) for each dependency.<br> b)We support Windows, Linux, macOS and possibly FreeBSD each with some possible architecture variants. For each of these we are storing a variant for each of the Python versions above. This creates way too many wheels that end up making ScanCode checkouts very long and tarballs too big. Therefore i decided to improve the provision of third party dependencies to minimise the problem we facing till now.</p>

Mentors: Student: Shivam Sandbhor

<p>Software development is undergoing a gradual increase in pace. The direct result of this is more software vulnerabilities. Countless vulnerabilities are reported and published on different mediums. This data needs to be collected in one place. VulnerableCode aims to fulfil this need.</p> <p>This project enables VulnerableCode to precisely map vulnerabilities from National Vulnerability Database to the vulnerable packages, down to obtaining their package URLs. To do so the current data models are tweaked to capture more details. Data from more ecosystem-specific advisories is collected to minimize reliance on the National Vulnerability Database as well as to get more details. Finally, to allow the community to view and curate the data in a human-friendly way, a basic frontend for VulnerableCode is implemented.</p>