aboutcode-org / aboutcode-org/scancode-toolkit

Scancode for licenses scans the same package from different sources

Open
#4,144 6 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Python
Stars
2.6k
Forks
791
Avg merge
1d 12h
Merged PRs (30d)
5

Description

### Description

I am only looking to use scancode to check licenses in my project, and it runs extremely slowly, even when limited to only looking through the package.json files in my repo. I believe scancode doesn't optimize for when multiple installed packages have the same dependency, and it will scan that dependency many times. This causes it to take ~30 minutes to run, whereas this [license compliance package](https://www.npmjs.com/package/license-compliance) runs in under 10 seconds. I would prefer using scancode over this package, however I can't justify a 30 minute run.

### How To Reproduce

> Tell us how to reproduce the issue.

Install multiple npm packages that share the same peer dependency and run `scancode --licenses`

### System configuration

> For bug reports, it really helps us to know:

* What OS are you running on? (Windows/MacOS/Linux)
* What version of scancode-toolkit was used to generate the scan file?
* What installation method was used to install/run scancode? (pip/source download/other)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.