Provenance & attribution

What Provenant is derived from

Provenant is a derivative of ScanCode Toolkit, built by nexB and the AboutCode community, which over more than a decade defined what accurate open-source license and copyright detection looks like. Two distinct things come from it:

• The detection engine — ported to Rust from ScanCode's Apache-2.0 licensed code.
• The license dataset — Provenant's embedded license index is built from ScanCode's license and rule corpus, which is licensed CC-BY-4.0.

Both obligations are treated as engineering requirements, not paperwork. ScanCode is a trademark of nexB Inc. Provenant is an independent project, not affiliated with or endorsed by nexB Inc. or the AboutCode project.

How the attribution actually works

All of this is verifiable in the repository:

• A NOTICE file reproduces nexB's attribution verbatim, including Apache-2.0 AND CC-BY-4.0 and the ScanCode data-attribution block, and states the trademark.
• Every source file whose Rust is derived from ScanCode carries dual copyright headers (nexB Inc. and others alongside Provenant contributors) plus a “Derived from ScanCode Toolkit” change notice.
• The authoritative list of those files lives in .license-headers.toml and is enforced in CI — a derived file cannot silently lose its attribution, and the list cannot quietly drift.
• Every modification to the license dataset is documented, each with a written justification, and each scan emits license-index provenance recording which dataset it used and how that dataset differs from upstream.
• LICENSE, NOTICE, and a third-party licence disclosure ship inside the published crate and the release archives, not just in the repository.

Provenant also aims to be more transparent about its own provenance than scanners typically are: the lineage is in the output, not only in the documentation.

The timeline, including the mistake

We would rather state this plainly than have it discovered.

• February 2025 — the mistake. The project began as a personal experiment: an exercise in Rust and in agentic development, a handful of commits, no users, and no intention of releasing anything. It was named scancode-rust and carried no NOTICE. That name infringed nexB's trademark, and the missing attribution did not meet Apache-2.0's requirements. Both were genuine failures. They came from not thinking the question through, at a point when there was nothing to show — not from a decision to take credit for someone else's work.
• Early 2026 — the real build. A small team built the bulk of the current codebase over roughly four months.
• March 2026 — corrected. nexB raised both issues privately. The same day, the project was renamed to Provenant, the published scancode-rust crate versions were yanked and deprecated, and a NOTICE with full upstream attribution was added.
• Since then — hardened. We audited the codebase file by file, added per-file attribution and change notices with automated enforcement, added the third-party disclosure to the release archives, and — after review with an external IP lawyer — reduced how much our own materials lean on the ScanCode name, defining Provenant's identity on its own terms instead.

Contributing upstream

Porting a mature tool surfaces gaps in it. In March 2026 we filed 28 issues to ScanCode Toolkit — package formats and metadata sources we had found missing, plus bugs — and several have since been implemented upstream. Provenant's existence is not intended to take anything away from ScanCode, and where our work turns up something useful to it, we would rather report it than sit on it.

If you think something is missing

Attribution is the kind of thing that is never finished, and we would rather be corrected than be right. If you can identify a specific file, notice, or published artifact where our attribution is incomplete or wrong, tell us and we will correct it. A concrete pointer — a path, a clause, an archive — is all we need.

Open an issue, or email hello@getprovenant.dev.