The accompanying open-source tool ScanCode Toolkit, designed for scanning code for intersections with third-party copyrights, identifying used licenses, and detecting unresolved vulnerabilities, has criticized a project that created an AI version of ScanCode, rewritten from Python to Rust (the name of the clone is not mentioned, but it appears to be about the Provenant project). It is claimed that the rewritten project has infringed on the ScanCode trademark and removed mentions of copyrights and licenses. The allegations are explained by the fact that the rewritten clone continues to use the key algorithms of ScanCode, preserving the project architecture and code structure.
According to the ScanCode maintainer, the successful creation of the clone was facilitated by the availability of a comprehensive automated test suite, including over 90,000 tests, of which 40,000 are dedicated to detecting the use of various licenses in code. The authors of the rewritten version claimed a significant increase in performance (by 10 to 100 times), but according to the ScanCode maintainer, the cost of this acceleration was an incomplete pass of the test suite, as well as a decrease in the correctness of operation and completeness of provided information (the clone produced incorrect results and did not find all information during analysis).
While in specialized performance tests, the Rust port significantly outperformed ScanCode, during the standard test suite the clone turned out to be slower, even though it skipped some checks. After optimizations were made to ScanCode, such as caching, ScanCode's performance when scanning code became as good as that of the Rust clone, while fully maintaining operational accuracy.
The authors of the clone are also accused of violating copyrights and the Apache 2.0 license under which the ScanCode code is distributed. It is noted that four main requirements of the license were violated during the rewriting process: leaving the original file with a notice (NOTICE), preserving mentions of copyrights, highlighting made changes, and renaming the derivative work. After being notified, the authors of the clone added a NOTICE file and renamed their project, but the other two violations remain unaddressed.
The accompanying ScanCode believes that the community should develop criteria for distinguishing between what should be considered a derivative work when using AI and what constitutes an independent implementation. In his view, after rewriting code in another language while maintaining algorithms and structure, the result continues to be a derivative work, even if variable names have been changed and comments have been modified or removed in the process. The claims of the authors of the Rust port regarding an independent reworking, merely inspired by the ScanCode project, are incorrect in this case, as the work aims to create the appearance of original development, which is even worse than direct copying since such manipulations are harder to detect.
A significant problem when generating code through AI is the lack of tracking of the origin of the code that was used to produce the result. By default, AI agents using code from open projects ignore information about the authors unless specific tools for identifying and preserving metadata about licenses and authorship are implemented. The attribution issue affects not only the work of rewriting code from one language to another but also code generation in general—the result in this case can quite accurately replicate patterns from existing open code used in the model training process.
Source: opennet.ru
