Scan Benchmarks

This document records explicit compare-outputs benchmark runs with high-level timing metrics and notable end-state Provenant-vs-ScanCode outcomes on recorded targets.

These rows are not ad hoc performance snapshots. They are the public record of an iterative compare-review-fix-rerun loop on one concrete target at a time.

Provenant and ScanCode are run on the same repository or artifact with the maintained shared profile, the resulting deltas are reviewed to find where ScanCode currently performs better on that target, Provenant is improved with generic fixes and focused regression coverage, and the comparison is rerun until Provenant reaches parity or a justified better result on that target. Each row is therefore a maintained verification checkpoint and a snapshot of one recorded compare-outputs run, not a blanket claim about every scan mode, target, or future revision.

Scan duration vs. file count

The chart below uses a log-log scatter plot: file count on the x-axis, wall-clock duration in seconds on the y-axis, and both scanners on the same numeric axes. That keeps tiny artifact snapshots and very large repository scans readable in one view without flattening the smaller runs.

Provenant is faster on 254 of 254 recorded runs, with a 19.7× median speedup and 19.7× geometric-mean speedup overall; the median gap grows from 9.1× on sub-100-file targets to 37.2× on 10k+ file targets. Generated from the benchmark timing rows in this document via cargo run --manifest-path xtask/Cargo.toml --bin generate-benchmark-chart.

Current benchmark examples

The quick index below links to benchmark sections. Each benchmark entry then records the snapshot size, benchmark date, machine context, raw timing comparison, and notable end-state Provenant-vs-ScanCode outcome for that target.

Quick index

• Repository-backed targets
  • Android / AOSP
  • Chef
  • Python / Conda / Pixi
  • R / CRAN
  • Hugging Face / AI model repositories
  • Hex / Elixir / Erlang / OTP
  • JavaScript / TypeScript / web stacks
  • JVM / Java / Scala / Clojure
  • Rust / Go / native / infrastructure
  • Apple / Swift / Flutter / mobile
  • .NET / NuGet / Windows / vcpkg
  • Ruby / PHP / Perl
  • Julia / Nix / Haskell / other ecosystems
• Artifact/rootfs-backed targets
  • Container image layouts
  • Linux rootfs images
  • Installed package database snapshots
  • Package archives
  • Mobile app artifacts
  • Release binaries and extracted app snapshots
  • Generated dependency lock manifests
  • Legacy NuGet manifest sets
  • Conan lockfiles
  • Debian source packages

Repository-backed targets

Android / AOSP

aosp-mirror/platform_build @ 045a3d6 — 17.87× faster

• Files: 1,515
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 8.68s; ScanCode 155.12s
• Richer file-level Android package extraction (31 vs 18 package_data records) and dependency coverage (148 vs 145) across committed Soong METADATA, AndroidManifest.xml, TestApp.apk, cargo, and go.work surfaces, with correct The Android Open Source Project holder attribution where ScanCode leaves it null, plus declared licenses that avoid conflating the tools/compliance test-fixture licenses ScanCode pulls into the package expression

facebook/fresco @ c991a69 — 37.03× faster

• Files: 2,900
• Run context: 2026-06-17 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 9.79s; ScanCode 362.51s
• Richer Android and Gradle dependency extraction (768 vs 688) across committed build.gradle, nearby Kotlin buildSrc constant catalogs, and AndroidManifest.xml surfaces, with exact Maven coordinates for symbolic Gradle references such as Deps.AndroidX.*, Deps.Bolts.*, and TestDeps.* where ScanCode emits placeholder-only names like AndroidX, Bolts, or junit, plus direct Android package visibility and cleaner URL normalization

KhronosGroup/Vulkan-ValidationLayers @ d72c5f5 — 33.22× faster

• Files: 979
• Run context: 2026-06-17 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 12.37s; ScanCode 410.98s
• Direct AndroidManifest package visibility (1 vs 0 on tests/android/AndroidManifest.xml), clue-only weak GPL handling across Graphics Pipeline Library acronym sites instead of ScanCode's hard GPL-1.0-or-later detections, and cleaner Khronos documentation copyright or holder recovery without appended - ! Khronos Vulkan noise

Chef

chef/chef @ 0e353ff — 19.55× faster

• Files: 2,274
• Run context: 2026-06-17 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 12.03s; ScanCode 235.22s
• Richer mixed-surface package identity with fewer placeholder-only Debian rows and far broader dependency extraction (351 vs 278) across Gemfile, Gemfile.lock, chef-*/Gemfile, gemspec, Dockerfile, and fixture archive/control surfaces, plus email-preserving author normalization and cleaner placeholder-holder filtering

sous-chefs/apache2 @ 420d824 — 10.22× faster

• Files: 245
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.83s; ScanCode 49.37s
• Matched Chef package and dependency coverage on committed metadata.rb surfaces, with fuller Debian-style script-header author capture and cleaner rejection of weak README maintainer prose as an author

sous-chefs/mysql @ 6b7110b — 9.60× faster

• Files: 91
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.79s; ScanCode 45.99s
• Matched Chef package and dependency coverage on committed metadata.rb surfaces, with cleaner rejection of config-word author noise such as chef-client and fuller Author:: Name (<email>) identity capture

Python / Conda / Pixi

aboutcode-org/dejacode @ 4938cd4 — 16.97× faster

• Files: 1,278
• Run context: 2026-06-16 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 11.28s; ScanCode 191.41s
• Broader ABOUT, Python, wheel, and Docker package visibility (127 vs 1 packages, 146 vs 104 dependencies) across committed .ABOUT sidecars, bundled thirdparty/dist/*.whl artifacts, and product manifests, with real ecosystem PURLs derived from download_url metadata instead of fallback pkg:about/... identities

aboutcode-org/scancode.io @ 904373a — 12.83× faster

• Files: 763
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 22.82s; ScanCode 292.75s
• Broader ABOUT and Python package visibility (28 vs 1 packages, 292 vs 56 dependencies) across committed .ABOUT files, root and suffixed pyproject.toml manifests, and uv.lock, plus zero scan-file errors where ScanCode times out on large generated scan-result JSON fixtures

aboutcode-org/scancode-toolkit @ 6570c13 — 19.96× faster

• Files: 64,369
• Run context: 2026-06-17 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 207.10s; ScanCode 4134.60s
• Far broader ABOUT-adjacent package and dependency visibility (1294 vs 6 packages, 10952 vs 377 dependencies) across committed .ABOUT sidecars, Python/Swift/Dart/CocoaPods fixture manifests, and bounded RPM header metadata recovery, with real ecosystem PURLs derived from ABOUT download_url metadata instead of pkg:about/... fallbacks and zero scan-file errors where ScanCode times out on heavy fixture snapshots; the remaining ScanCode edge is concentrated in a small set of license-detection corpus and legal-text cases where it still preserves extra detections beyond Provenant’s current policy or refinement choices

apache/airflow @ 47ce5f3 — 22.72× faster

• Files: 11,935
• Run context: 2026-06-17 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 50.99s; ScanCode 1158.57s
• Far broader Python/provider package coverage (142 vs 1) and dependency extraction (7599 vs 1014) from uv.lock, provider pyproject.toml, and committed pnpm-lock.yaml inputs, plus extra Docker and Helm package visibility, safer URL credential stripping, and cleaner copyright/author normalization across large documentation and kernel-style metadata blocks

apache/superset @ cd8ac41 — 36.2× faster

• Files: 9,925
• Run context: 2026-06-29 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 35.25s; ScanCode 1276.89s
• Far broader Python/JS package and dependency extraction (37 vs 1 packages, 8219 vs 171 dependencies) from requirements/*.txt, root and websocket pyproject.toml/package.json, uv.lock, multiple yarn.lock/package-lock.json, Docker, .gitmodules GitHub Actions, and Helm inputs — including Yarn resolutions and npm overrides surfaced as is_pinned dependencies ScanCode omits — with the assembled pkg:pypi/apache-superset package carrying the complete apache-2.0 AND ofl-1.1 declared license from its LICENSE.txt where ScanCode reports only apache-2.0, plus rejection of the placeholder and binary-noise emails ScanCode emits such as the templated GITHUB_ACTOR actor address, the gettext LL@li.org placeholder, and .parquet byte-pairs

astral-sh/uv @ 9581f2b — 28.81× faster

• Files: 1,259
• Run context: 2026-06-18 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 9.47s; ScanCode 272.81s
• Far broader Python-family package and dependency extraction (113 vs 1 packages, 5279 vs 759 dependencies) from the large test/requirements/** tree, many fixture/workspace pyproject.toml files, and multiple uv.lock inputs that ScanCode leaves at zero, with safer URL credential stripping, Unicode-preserving party normalization, and METADATA-backed wheel identity instead of double-counting a misleading filename

astropy/astropy @ 40280e3 — 36.99× faster

• Files: 1,962
• Run context: 2026-06-17 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 9.63s; ScanCode 356.23s
• Broader Python package coverage (3 vs 1 packages) including direct CITATION.cff citation-metadata visibility, with matched dependency coverage (79 vs 77) from pyproject.toml and docs/rtd_environment.yaml, cleaner vendored holder recovery, and Unicode-preserving copyright normalization

conda/conda @ 37549c4 — 15.79× faster

• Files: 284
• Run context: 2026-06-17 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.02s; ScanCode 79.28s
• Broader Conda and Python package coverage (5 vs 2 packages, 73 vs 26 dependencies) from conda.recipe/meta.yaml, multiple environment.yml fixtures, and the root setup.py, with safer URL credential stripping across authentication test fixtures

conda/conda-build @ 5da509d — 7.61× faster

• Files: 835
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 9.24s; ScanCode 70.31s
• Far broader Conda recipe and dependency extraction (257 vs 1 packages, 164 vs 13 dependencies) across committed meta.yaml recipe fixtures, split-package test recipes, and sidecar Python manifests, with explicit malformed-recipe scan errors on duplicate-key negative fixtures instead of silently treating them as ordinary package metadata

conda-forge/pandas-feedstock @ 4063b72 — 6.31× faster

• Files: 49
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.79s; ScanCode 42.84s
• Direct schema-versioned conda-forge feedstock package visibility (1 vs 0 packages, 51 vs 0 dependencies) from recipe/recipe.yaml, plus assembled top-level Conda package identity and preserved source/about metadata

DefectDojo/django-DefectDojo @ 2f25c45 — 24.94× faster

• Files: 4,301
• Run context: 2026-06-18 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 43.27s; ScanCode 1079.38s
• Broader full-repo package and dependency extraction (3 vs 2 packages, 616 vs 535 dependencies) from .gitmodules, helm/defectdojo/Chart.yaml, helm/defectdojo/Chart.lock, and the root requirements*.txt manifests, with direct Helm chart package visibility, pinned PostgreSQL or Valkey chart dependencies, Git-submodule package metadata, and zero scan errors where ScanCode reports 3 scan-file failures on large vulnerability fixtures

django/django @ 09f27cc — 39.22× faster

• Files: 7,029
• Run context: 2026-06-17 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 13.85s; ScanCode 543.19s
• Far broader Python-family package and dependency extraction (2 vs 1 packages, 16 vs 6 dependencies) because pyproject.toml contributes both a real PyPI root package and 5 Python dependencies while docs/requirements.txt adds 5 more documentation dependencies that ScanCode leaves at zero, with clearer BSD-3-Clause declared-license capture and visibility into the vendored CVS marker that ScanCode skips

OpenMDAO/OpenMDAO @ bf1fcb6 — 27.03× faster

• Files: 1,199
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.80s; ScanCode 210.82s
• Broader Pixi, Julia, and Docker package visibility (3 vs 1 packages, 1489 vs 76 dependencies) from the root pixi.toml, resolved pixi.lock, and the experimental Julia Project.toml, with no pixi.lock scan errors where ScanCode times out and much richer lockfile license visibility

pandas-dev/pandas @ c385d01 — 32.0× faster

• Files: 2,608
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 13.09s; ScanCode 418.88s
• Far broader Python/Conda/Pixi package and dependency extraction (4 vs 1 packages, hundreds of additional dependencies) because pixi.lock and environment.yml surface large resolved Conda/Pixi package graphs with per-package license inventories ScanCode ignores entirely, while avoiding ScanCode's pixi.lock timeout, preserving SPDX-aligned BSD-3-Clause declared licensing, and skipping ScanCode's data-table copyright false positives such as (c) Rain (mm) Wind

prefix-dev/pixi @ 6458b15 — 12.84× faster

• Files: 2,372
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 27.77s; ScanCode 356.55s
• Broader Pixi package and dependency extraction (233 vs 128 packages, 22369 vs 3116 dependencies) from the root and example pixi.toml or pixi.lock surfaces plus feature-scoped pypi-dependencies and cargo workspace members that inherit the declared BSD-3-Clause license ScanCode leaves unset, with no example-lock scan errors where ScanCode times out and safer credential stripping or git URL normalization across Pixi source fixtures

pydata/xarray @ f7e47a1 — 22.17× faster

• Files: 429
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.60s; ScanCode 124.15s
• Broader Pixi and Conda environment coverage (3 vs 1 packages, 509 vs 84 dependencies) from the repo-root pixi.toml plus committed Binder and CI environment manifests, with direct Pixi package identity and cleaner URL normalization across docs and SVG metadata

pyodide/pyodide @ 86e27b0 — 14.25× faster

• Files: 540
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.67s; ScanCode 80.78s
• Broader dependency extraction (796 vs 718) and slightly broader package visibility (53 vs 52) from environment.yml, .gitmodules, and committed wheel artifacts, with extension-qualified wheel PURLs, richer patch-header author recovery, and the fuller Pyodide contributors and Mozilla documentation notice

pypa/pipenv @ fbce7b4 — 12.53× faster

• Files: 835
• Run context: 2026-06-27 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 11.16s; ScanCode 139.82s
• Far broader Python package and dependency extraction (6 vs 1 packages, 392 vs 296 dependencies) from the repo's Pipfile, Pipfile.lock, pyproject.toml/pylock.toml, and committed setup.py/setup.cfg fixtures plus bundled sdist/wheel artifacts that ScanCode collapses to a single pyproject-only package, including build-time setup_requires dependencies and PEP 503-normalized PyPI names such as jaraco-classes where ScanCode keeps the dotted jaraco.classes, with the MIT/ISC declared licenses consolidated onto the assembled packages rather than duplicated across each datafile

python/cpython @ 7a468a1 — 70.74× faster

• Files: 5,627
• Run context: 2026-06-18 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 17.27s; ScanCode 1221.65s
• Direct PEP 751 Doc/pylock.toml package visibility with 29 pinned PyPI documentation dependencies where ScanCode leaves the lockfile dependency-blind, plus cleaner FTP documentation URL extraction that keeps real FTP hosts while rejecting ftp.* method and member references

python-poetry/poetry @ bfce511 — 14.8× faster

• Files: 987
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 8.01s; ScanCode 118.91s
• Far broader Python package and dependency extraction (72 vs 16 packages, 840 vs 595 dependencies) from the root PEP 621 pyproject.toml, Poetry dependency groups, committed poetry.lock fixtures, and bundled wheel/sdist metadata, with the project's MIT license placed on the named poetry package rather than smeared onto a nameless lockfile aggregate, and clean handling of .dist-info Author/Author-email lines that ScanCode mangles into one malformed party

scipy/scipy @ 8a4633f — 43.01× faster

• Files: 2,998
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 11.54s; ScanCode 496.36s
• Far broader Python/Conda/Pixi package and dependency extraction (4 vs 1 packages, 1469 vs 78 dependencies) from pixi.lock's large resolved Conda graph, environment.yml, pixi.toml, and the aggregated requirements/*.txt tree that ScanCode leaves at zero, with cleaner pyproject.toml requirement shaping for exact pins and environment markers

UCBoulder/tardigrade_micromorphic_tools @ d03a8ca — 7.70× faster

• Files: 47
• Run context: 2026-06-06 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.06s; ScanCode 46.66s
• Broader Conda dependency extraction (17 vs 0 dependencies on recipe/recipe.yaml) by parsing the rattler-build recipe.yaml that ScanCode reads only as recipe/meta.yaml, with ${{ name|lower }} context templating resolved into a real pkg:conda/tardigrade_micromorphic_tools@0.0.0 identity and identical top-level license detection across the C++ source tree

R / CRAN

r-lib/devtools @ a3447b9 — 9.89× faster

• Files: 265
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.97s; ScanCode 49.16s
• Far broader CRAN package and dependency extraction (14 vs 1 packages, 45 vs 1 dependencies) from the root DESCRIPTION plus committed test-package fixtures, with correct filtering of fake pkg:cran/R dependency noise and cleaner maintainer or URL normalization

tidyverse/dplyr @ 2f9f49e — 19.42× faster

• Files: 462
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.52s; ScanCode 107.21s
• Direct CRAN package visibility on the root DESCRIPTION plus declared dependency extraction (29 vs 0) across Depends, Imports, Suggests, Enhances, and LinkingTo, with cleaner Rd or markdown URL normalization and preserved shipped license-holder metadata

tidyverse/ggplot2 @ 7d79c95 — 17.82× faster

• Files: 1,154
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.59s; ScanCode 117.46s
• Direct CRAN package visibility on the root DESCRIPTION plus declared dependency extraction (41 vs 0) across Imports, Suggests, and Enhances, with correct hyphenated CRAN version constraints such as sf (>= 0.7-3) and cleaner Rd or roxygen URL recovery

Hugging Face / AI model repositories

openai/clip-vit-base-patch32 @ 3d74acf — 11.66× faster

• Files: 12
• Run context: 2026-06-27 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.79s; ScanCode 90.82s
• Direct Hugging Face CLIP model package identity (1 vs 0) that ScanCode cannot model because it ships no Hugging Face parser: Provenant assembles the repository's config.json and model-card README.md into one pkg:huggingface/openai/clip-vit-base-patch32 package, with both scanners reporting zero copyright and holder detections across the model weights and the BPE-merges tokenizer.json whose mojibake © byte-pairs (e.g. pok é) carry no genuine notice

segmind/tiny-sd @ cad0bd7 — 18.6× faster

• Files: 17
• Run context: 2026-06-27 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.96s; ScanCode 92.04s
• Direct Hugging Face Diffusers pipeline package identity (1 vs 0) that ScanCode cannot model because it ships no Hugging Face parser: Provenant assembles the repository's model_index.json together with its text_encoder, unet, and vae component config.json files into one pkg:huggingface/SG161222/Realistic_Vision_V4.0 Stable Diffusion pipeline package anchored on the config's _name_or_path

sentence-transformers/all-MiniLM-L6-v2 @ 1110a24 — 9.75× faster

• Files: 30
• Run context: 2026-06-07 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.05s; ScanCode 68.76s
• Direct Hugging Face model package identity (1 vs 0 packages, 22 vs 0 dependencies) that ScanCode cannot model at all because it ships no HF parser: Provenant assembles the repository's config.json and model-card README.md into one pkg:huggingface/nreimers/MiniLM-L6-H384-uncased package, anchoring identity on the config's _name_or_path, normalizing the card's apache-2.0 declared license, and hoisting the base_model and datasets frontmatter into base_model- and dataset-scoped pkg:huggingface/... dependencies, with identical top-level license detection across the repository tree

bitwalker/distillery @ 3ab4d61 — 8.76× faster

• Files: 305
• Run context: 2026-06-06 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.53s; ScanCode 57.19s
• Broader Hex package and dependency extraction (6 vs 0 packages, 399 vs 0 dependencies): one pkg:hex package per mix.exs (the root distillery app plus five test/fixtures/* apps), each merging its sibling mix.lock for locked identities, parsing the root lockfile's legacy 7-element hex tuples ScanCode does not read and defaulting hexpm as the repository for tuples that omit it, with MIT license detection preserved across the Elixir source tree

elixir-ecto/ecto @ 28d9282 — 13.56× faster

• Files: 156
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.85s; ScanCode 65.75s
• Broader Hex package and dependency extraction (2 vs 0 packages, 27 vs 0 dependencies): a pkg:hex/ecto package and an examples/friends app, each pairing mix.exs identity with mix.lock locked dependencies such as ecto_sql, postgrex, and telemetry that ScanCode leaves dependency-blind

elixir-plug/plug @ 47649aa — 10.51× faster

• Files: 104
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.88s; ScanCode 51.28s
• Direct Hex package and dependency extraction (1 vs 0 packages, 13 vs 0 dependencies): a pkg:hex/plug package from mix.exs carrying locked plug_crypto, telemetry, ex_doc, and sibling Hex pins from mix.lock that ScanCode leaves at zero, with Unicode-preserving Loïc Hoguin holder normalization

erlang/otp @ 264def5 — 33.91× faster

• Files: 11,749
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 59.99s; ScanCode 2034.56s
• Broader OTP package visibility (51 vs 0 packages): one pkg:hex/<app> package per committed lib/*/src/*.app.src (41, with bounded %PLACEHOLDER% handling that keeps canonical manifests such as diameter.app.src scannable) alongside 10 pkg:autotools packages from per-application configure.ac build manifests, preserving the same non-stdlib runtime dependency inventory ScanCode finds

livebook-dev/livebook @ 77cbcd9 — 17.14× faster

• Files: 704
• Run context: 2026-06-27 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.33s; ScanCode 91.33s
• Direct Elixir/Hex project package identity (3 vs 0 pkg:hex/* packages) from Provenant's static mix.exs parser, which ScanCode does not model — it reports only the Rust NIF's pkg:cargo/livebook: each committed mix.exs assembles with its sibling mix.lock into a pkg:hex/<app> package (livebook, livebook_proto, livebook_space) that owns its resolved Hex dependencies (106 locked hex deps total), with the same Cargo package ScanCode finds plus broader bun.lock/package.json asset-dependency visibility

phoenixframework/phoenix @ e7b8081 — 14.38× faster

• Files: 476
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.49s; ScanCode 78.97s
• Direct Hex package visibility (3 vs 0 file-level package records) on the repo-root, installer/, and integration_test/ mix.exs/mix.lock surfaces — each pkg:hex package versioned from its mix.exs (phoenix@1.8.5, phx_new@1.8.5) and merged with its sibling lockfile — while preserving top-level package and dependency parity elsewhere and structured party metadata on the bundled pkg:npm/phoenix asset package

processone/ejabberd @ 87475d8 — 15.15× faster

• Files: 623
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 8.01s; ScanCode 121.38s
• Broader Erlang package and dependency extraction (3 vs 1 packages, 43 vs 3 dependencies): pkg:hex and pkg:autotools identities from the _checkouts/configure_deps app and root configure.ac alongside the pkg:npm project, with rebar dependencies recovered from the root rebar.config/rebar.lock and committed Dockerfiles, plus the bundled priv/mod_invites/copyright notice kept as clue-level license evidence instead of being overstated as Debian package metadata

vernemq/vernemq @ 4681e54 — 14.07× faster

• Files: 441
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.12s; ScanCode 86.10s
• Broader Erlang/Rebar dependency extraction (119 vs 0) from the repo-root and per-app rebar.config / .app.src manifests, plus direct .gitmodules package visibility and mixed Hex or git package identity across the VerneMQ app tree where ScanCode stays manifest-blind

JavaScript / TypeScript / web stacks

appsmithorg/appsmith @ 6ca79d1 — 34.56× faster

• Files: 13,366
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 33.43s; ScanCode 1155.18s
• Direct Helm chart package visibility on deploy/helm/Chart.yaml (1 vs 0) with declared dependency extraction (4 vs 0) for the pinned MongoDB, PostgreSQL, Prometheus, and Redis chart inputs that ScanCode leaves unmodeled

baserow/baserow @ 18a5fc1 — 46.79× faster

• Files: 8,755
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 17.87s; ScanCode 836.07s
• Direct Helm package visibility on deploy/helm/baserow/Chart.yaml and Chart.lock (2 file-level Helm surfaces vs 0), with declared plus locked dependency extraction (12 vs 0 on each chart file) covering sibling baserow-common aliases and the pinned Bitnami/Caddy chart inputs that ScanCode leaves at zero

catppuccin/gitea @ 6a78970 — 6.76× faster

• Files: 23
• Run context: 2026-06-06 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.02s; ScanCode 40.69s
• Deno v4 lockfile dependency extraction (37 vs 0 from deno.lock's resolved npm and jsr graphs) where ScanCode is lockfile-blind, plus deno.json import-map package visibility and cleaner rejection of a bare-URL holder mistaken from README prose; the deno.lock parser now covers lockfile formats v1–v5 rather than v5 alone

denoland/fresh @ 49c4be1 — 13.61× faster

• Files: 567
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.70s; ScanCode 63.97s
• Broader Deno package and dependency extraction (8 vs 0 packages, 966 vs 0 dependencies) from the root deno.json, deno.lock, and nested packages/*/deno.json manifests, with direct JSR and npm import-map or lockfile package identity where ScanCode stays manifest-blind

denoland/std @ a864f62 — 32.46× faster

• Files: 2,812
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.00s; ScanCode 227.22s
• Broader Deno package visibility (42 more packages, 0 missing) from the root and leaf */deno.json manifests across the standard-library tree, plus concrete Cargo lock package identities on embedded Rust fixtures instead of anonymous cargo_lock rows

getsentry/self-hosted @ 8728919 — 9.54× faster

• Files: 129
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.74s; ScanCode 45.20s
• Broader mixed Docker/npm/Python package extraction (2 vs 1 packages, 111 vs 0 dependencies) from the integration-test package-lock.json, uv.lock, and committed service Dockerfiles, plus the more specific Apache-2.0 AND FSL-1.1-ALv2 license classification on LICENSE.md where ScanCode reports only FSL-1.1-ALv2

github/opensource.guide @ 38d739c — 16.93× faster

• Files: 1,127
• Run context: 2026-07-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.89s; ScanCode 116.63s
• Reads copyright notices embedded in the bundled .woff/.woff2 fonts (Inter, Vazirmatn) that ScanCode leaves undetected, and rejects ScanCode's author false positives mined from the localized _articles/*/legal.md guides (bare GitHub URLs, the word did, sentence fragments) along with its LicenseRef-scancode-free-unknown matches on prose that merely mentions being free; the npm and gem manifests report an empty declared license where they declare none, rather than the repo-wide detected-license aggregate ScanCode assigns as declared_license_expression

iTowns/itowns @ 08e08f5 — 19.11× faster

• Files: 616
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.99s; ScanCode 114.48s
• Direct publiccode.yml package visibility on the root metadata file (1 vs 0 on that file), with matched top-level package and dependency counts elsewhere plus Unicode-preserving Potree copyright normalization and cleaner URL shaping across README and docs material

jashkenas/backbone @ da75718 — 12.27× faster

• Files: 122
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.03s; ScanCode 61.74s
• Matched Bower package and dependency coverage on the repo-root bower.json, with datasource-tagged Bower package identity instead of a bare purl-only row and package-level party metadata from package.json

jquery/jquery-ui @ eda7aa3 — 30.01× faster

• Files: 1,083
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.70s; ScanCode 201.04s
• Matched Bower package and dependency coverage on the repo-root bower.json, with datasource-tagged Bower package identity instead of a bare purl-only row and cleaner Unicode-preserving author normalization across locale files and vendored docs

lodash/lodash @ cb0b9b9 — 20.62× faster

• Files: 159
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.91s; ScanCode 101.22s
• Matched npm package and dependency coverage on the repo-root package.json and package-lock.json, with source-faithful copyright recovery across lodash.js, dist/lodash*.js, and LICENSE, plus encoded-query URL preservation and extra Firebug asset URL visibility where ScanCode flattens or misses the underlying source text

metabase/metabase @ 10997b1 — 66.26× faster

• Files: 18,030
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 22.99s; ScanCode 1523.27s
• Broader package and dependency extraction (9 vs 1 packages, 7055 vs 423 dependencies) from the root and driver deps.edn manifests plus committed bun.lock and uv.lock, with cleaner OFL font URL normalization where ScanCode preserves broken concatenated links

microsoft/vscode @ 0c1e100 — 43.13× faster

• Files: 14,398
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 40.89s; ScanCode 1763.40s
• Broader monorepo package and dependency extraction (138 vs 1 packages, 7720 vs 1815 dependencies) from the root package-lock.json, many extension fixture manifests and lockfiles, and embedded Cargo/Docker metadata, plus richer named package identities where ScanCode emits generic lockfile and archive rows

npm/cli @ 05dbba5 — 40.20× faster

• Files: 6,732
• Run context: 2026-06-18 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 58.53s; ScanCode 2352.73s
• Clean root npm workspace manifest coverage without ScanCode's workspace-assembly scan errors, fewer large registry-fixture JSON timeouts, and cleaner handling of duplicated private-workspace dependency exports and repeated MIT-style registry-fixture metadata noise

oakserver/oak @ 185baef — 9.43× faster

• Files: 103
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.09s; ScanCode 47.99s
• Direct Deno package visibility on the root deno.json (1 vs 0 packages), plus Dockerfile package visibility on .devcontainer/Dockerfile, with cleaner trailing-slash URL normalization across README and docs material

oven-sh/bun @ 700fc11 — 52.00× faster

• Files: 12,551
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 21.17s; ScanCode 1100.75s
• Far broader Bun/npm-family package extraction (383 vs 29 packages, 14381 vs 323 dependencies) from the repo's 52 committed bun.lock / bun.lockb inputs that ScanCode leaves at zero, plus legacy bun.lockb coverage on bench/bundle and plainer BSD-2-Clause rebucketing where ScanCode uses the over-specific BSD-2-Clause-Views label

pnpm/pnpm @ 2a1ffe1 — 33.85× faster

• Files: 2,887
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.32s; ScanCode 247.80s
• Broader pnpm/npm monorepo package and dependency extraction (396 vs 282 packages, 11606 vs 3080 dependencies) from the root pnpm-lock.yaml, nested workspace member manifests, and shared workspace npm-shrinkwrap.json / pnpm-lock.yaml roots, plus zero scan-file errors where ScanCode crashes on the root workspace manifests and catalog-protocol fixture inputs

renovatebot/renovate @ 91a7213 — 44.83× faster

• Files: 3,663
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 11.09s; ScanCode 497.12s
• Broader fixture-heavy package and dependency extraction (52 vs 1 packages, 1778 vs 1485 dependencies) from committed project.clj, deps.edn, and cross-ecosystem manager fixtures, plus Leiningen package identity on lib/modules/manager/leiningen/__fixtures__/project.clj where ScanCode stays manifest-blind

select2/select2 @ 595494a — 16.71× faster

• Files: 704
• Run context: 2026-06-16 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.59s; ScanCode 93.41s
• Matched Bower package and dependency coverage on the repo-root bower.json, with datasource-tagged Bower package identity instead of a bare purl-only row and cleaner package-author normalization in package.json

triggerdotdev/trigger.dev @ d1f4302 — 42.62× faster

• Files: 4,169
• Run context: 2026-06-18 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.93s; ScanCode 337.98s
• Broader pnpm/npm workspace and Helm coverage (45 vs 39 packages, 6971 vs 6689 dependencies) from the root pnpm-lock.yaml, nested fixture lockfiles, workspace member manifests, .gitmodules, and hosting/k8s/helm/Chart.yaml, while private pnpm workspace root cleanup intentionally avoids a redundant root package row and remaining Yarn patch protocol deltas are representation differences rather than missing dependency evidence

vercel/next.js @ 8e5a36f — 25.74× faster

• Files: 28,044
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 47.66s; ScanCode 1226.76s
• Broader monorepo package and dependency extraction (466 vs 252 packages, 14259 vs 12345 dependencies) from the root pnpm-lock.yaml, many workspace fixture subtrees, and embedded Cargo/npm metadata, plus zero scan errors where ScanCode crashes on workspace package.json and pnpm-lock.yaml inputs

yarnpkg/berry @ c0274d6 — 24.12× faster

• Files: 3,790
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 8.65s; ScanCode 208.66s
• Broader dependency extraction (2835 vs 1301) from Berry yarn.lock, workspace manifests, and .pnp.cjs, plus cleaner workspace package assembly that avoids ScanCode's duplicated npm package rows (204 vs 395) and package.json / yarn.lock assembly crashes while still surfacing extra Docker and Windows package inputs committed in the tree

JVM / Java / Scala / Clojure

akka/akka @ 5ace141 — 40.29× faster

• Files: 4,623
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 10.57s; ScanCode 425.90s
• Broader top-level package coverage (11 vs 7): each build.sbt project is its own pkg:maven package (4 sbt projects) alongside the 7 Maven POM packages ScanCode also finds, with broader dependency extraction (49 vs 40) from the root build.sbt, sample applications, and native-image test manifests owned by their projects, plus cleaner rejection of weak actor-name author noise such as the ActorSystem and the ReceiveBuilder

apache/ant-ivy @ dc35d51 — 25.5× faster

• Files: 2,470
• Run context: 2026-06-27 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 14.71s; ScanCode 374.46s
• Far broader package coverage (248 vs 115) led by direct Apache Ivy ivy.xml extraction that ScanCode cannot model at all — 151 pkg:ivy/* packages carrying Ivy configuration-scope dependency mappings — with each standalone Maven .pom in a shared directory reported under its own coordinate, and fixture POMs whose version is an unresolved ${property} placeholder left out where ScanCode emits a literal placeholder coordinate

apache/felix-dev @ 20aee77 — 24.00× faster

• Files: 5,356
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 26.70s; ScanCode 640.75s
• Broader Maven/OSGi package coverage (201 vs 196) with richer dependency extraction (1033 vs 962) from classifier/type-aware Maven coordinates, OSGi integration-test POMs, and committed JAR or MANIFEST.MF metadata, plus declared licenses that stay faithful to each module's POM where ScanCode conflates bundled JUnit CPL/EPL licenses into the declared expression

apache/camel @ c9c34a1 — 16.72× faster

• Files: 38,007
• Run context: 2026-06-16 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 228.70s; ScanCode 3824.09s
• Matched Maven package coverage (699 vs 699) with broader dependency extraction (7694 vs 7645) across the large multi-module reactor, archetype template POMs, and mixed package-adjacent Helm, Docker, and Cargo surfaces, plus UTF-16 template license detection and broader notice-author recovery across Apache/Spring/OpenShift acknowledgements, with zero scan-file errors where ScanCode times out on the committed camel-sbom.json and camel-sbom.xml

apache/hadoop @ dbcc7cd — 26.52× faster

• Files: 16,370
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 121.35s; ScanCode 3218.68s
• Broader dependency extraction (5849 vs 3794) and slightly broader package visibility (123 vs 122) from the large multi-module Maven reactor, classifier/type-aware WAR identities, committed vcpkg metadata, and property-preserving Maven coordinates, with cleaner sourcemap/minified-banner party handling and reviewed remaining legal-text/author differences

apache/kafka @ 0d9fe51 — 28.75× faster

• Files: 7,179
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 39.52s; ScanCode 1136.27s
• Far broader Gradle and sidecar Python package extraction (6 vs 4 packages, 662 vs 15 dependencies) from the root multi-project build.gradle, Kafka module wiring, and the committed tests/setup.py, plus extra Docker package visibility on the bundled image fixtures

apache/maven @ 459de76 — 19.52× faster

• Files: 9,955
• Run context: 2026-06-16 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 33.78s; ScanCode 659.41s
• Broader Maven package coverage (2969 vs 2518) with richer dependency extraction (2550 vs 2267) from parent/module inheritance, dependencyManagement, and committed .pom fixtures, plus more specific classifier-bearing Maven identities where ScanCode flattens coordinates and quieter unresolved-placeholder handling that preserves Maven semantics without flooding the scan with property/cycle noise

clj-commons/aleph @ c930db6 — 9.81× faster

• Files: 94
• Run context: 2026-07-04 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.07s; ScanCode 49.73s
• Direct Leiningen and tools.deps package identity (2 vs 0 packages, 68 vs 0 dependencies) that ScanCode cannot model because it ships no project.clj/deps.edn parser: the root pkg:maven/aleph/aleph assembles its project.clj with the co-located generated deps.edn, resolving def-bound ~netty-version/~brotli-version dependency versions and a runtime (or (System/getenv …) …) project version into concrete coordinates and normalizing tools.deps artifact$classifier deps into clean purls with classifier metadata, plus source-faithful © copyright recovery on README.md where ScanCode renders (c) and rejection of the ${…}-templated CircleCI status URL ScanCode emits as a broken percent-encoded fragment

eclipse-vertx/vert.x @ 78ade62 — 20.94× faster

• Files: 1,752
• Run context: 2026-07-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 9.29s; ScanCode 194.51s
• Classifies the Apache-2.0 AND EPL-2.0 dual license on one more file than ScanCode and extracts the Java Javadoc @author contributor names wrapped in HTML homepage anchors (Tim Fox, Clement Escoffier) across hundreds of source files, while omitting ScanCode's LicenseRef-scancode-unknown-license-reference noise on the terms-of-service document

elastic/elasticsearch @ a414f3d — 38.84× faster

• Files: 40,293
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 106.84s; ScanCode 4149.25s
• Matched top-level package coverage (1 vs 1) with richer dependency extraction (2346 vs 2067) from the large multi-project Gradle build graph, plus extra Docker package visibility on committed fixture and distribution Dockerfiles

gradle/gradle @ 92068b4 — 22.64× faster

• Files: 27,912
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 93.96s; ScanCode 2127.58s
• Broader Gradle package and dependency extraction (74 vs 68 packages, 1725 vs 1541 dependencies) from committed build.gradle, build.gradle.kts, gradle.lockfile, and .module metadata across docs and test fixtures

Netflix/spectator @ fac9597 — 14.77× faster

• Files: 585
• Run context: 2026-06-25 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.10s; ScanCode 104.90s
• Exclusive Ivy-style dependencies.properties coverage: Provenant extracts all 33 Maven coordinates from the auto-generated root dependency list (both group:artifact = version and property = group:artifact:version forms) as direct pinned Maven dependencies where ScanCode emits 0 for that surface, with trailing inline # ... annotations stripped from captured versions so io.dropwizard.metrics5:metrics-core resolves to a clean @5.0.0-rc16 instead of a comment-polluted coordinate

yairm210/Unciv @ d54f33c — 30.07× faster

• Files: 4,057
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 9.25s; ScanCode 278.15s
• Far broader Gradle dependency extraction (51 vs 6 dependencies) from the root multi-project build.gradle.kts, module-local android/build.gradle.kts, and buildSrc/build.gradle.kts, with concrete version recovery for property-backed Kotlin DSL quoted configuration calls such as "implementation"("io.ktor:ktor-client-core:$ktorVersion"), "implementation"("com.badlogicgames.gdx:gdx-tools:$gdxVersion"), and classpath("org.jetbrains.kotlin:kotlin-gradle-plugin:$kotlinVersion") where ScanCode leaves $kotlinVersion / $gdxVersion unresolved and misses most of the centralized root build graph

playframework/playframework @ c2c114f — 24.01× faster

• Files: 2,579
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.69s; ScanCode 160.61s
• Broader SBT dependency extraction (7 vs 3) and file-level SBT package visibility across the root build and committed play-sbt-plugin fixture projects, plus correct no-year copyright and holder recovery on vendored jQuery banners that ScanCode-only parity previously exposed

scalatest/scalatest @ f6ba8f2 — 28.70× faster

• Files: 1,935
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 13.66s; ScanCode 392.06s
• Broader file-level SBT package visibility on build.sbt and project/build.sbt, with declared dependency extraction from project/build.sbt and correct copyright recovery from XML-attribute notices in the legacy build.xml ant workflow

spring-projects/spring-boot @ 53827d4 — 22.41× faster

• Files: 11,643
• Run context: 2026-06-16 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 44.52s; ScanCode 997.84s
• Broader JVM monorepo package and dependency extraction (174 vs 165 packages, 4438 vs 4233 dependencies) from nested Maven example POMs, the committed Antora package-lock.json, and Docker/WAR metadata, plus more specific SBOM license expressions where ScanCode flattens EPL-2.0 AND Classpath-exception-2.0 or BSD-2-Clause-Views AND BSD-3-Clause

technomancy/leiningen @ 4022732 — 10.80× faster

• Files: 301
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.06s; ScanCode 54.67s
• Broader Clojure manifest and dependency extraction (92 vs 10 dependencies) from the root, nested checkout, and test-project project.clj surfaces that ScanCode leaves at manifest-only visibility, plus OFL font-license recovery and cleaner URL normalization where ScanCode preserves regex suffixes, trailing-slash drift, or percent-encoded placeholder text

Rust / Go / native / infrastructure

alpinelinux/aports @ d6ebad7 — 37.75× faster

• Files: 23,293
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 30.81s; ScanCode 1163.13s
• Broader Alpine package visibility (12602 vs 12502) and dependency extraction (102278 vs 1438) from committed APKBUILD metadata plus nested Cargo and Docker surfaces, with static shell-style manifest handling that preserves concrete package identities instead of malformed placeholder expansions

archlinux/packaging/packages/grep @ 29d2e10 — 8.79× faster

• Files: 6
• Run context: 2026-06-22 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.88s; ScanCode 42.89s
• Direct Arch source-package visibility on committed .SRCINFO (1 vs 0 file-level package records) with broader dependency extraction (9 vs 0) across runtime, make, and check edges, plus Unicode-preserving maintainer recovery and exact trailing-slash URL normalization on PKGBUILD while avoiding ScanCode's low-coverage LGPL-2.0-or-later false positive

archlinux/packaging/packages/pacman @ 4ee8983 — 8.66× faster

• Files: 12
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.65s; ScanCode 40.26s
• Direct Arch source-package visibility on committed .SRCINFO (1 vs 0 file-level package records) with broader dependency extraction (26 vs 0) across runtime, make, check, and optional package metadata, plus copyright and holder recovery on the repo-owned LICENSE and REUSE.toml surfaces that ScanCode leaves empty

Amanieu/atomic-rs @ 44c213a — 9.31× faster

• Files: 11
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.71s; ScanCode 43.86s
• Matched Cargo package and dependency coverage (1 vs 1 packages, 5 vs 5 dependencies) while preserving the repository's Apache-2.0 OR MIT README license semantics and normalizing docs.rs and Keep a Changelog links without trailing-slash drift

apache/arrow @ f10c93c — 35.5× faster

• Files: 5,246
• Run context: 2026-07-02 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 24.16s; ScanCode 856.72s
• Far broader cross-ecosystem package assembly across the polyglot monorepo (19 vs 10 packages, 315 vs 112 dependencies): Provenant additionally models the pkg:cran/arrow R package, pkg:pypi/pyarrow, and the C++ pkg:meson/* and pkg:generic/vcpkg/* build/dependency manifests that ScanCode leaves unmodeled, while keeping declared-license metadata honest — dev/archery/setup.py, which carries only an Apache header comment and no license/classifier field, resolves to no package-declared license (the Apache-2.0 is still captured as a file-level detection) where ScanCode conflates that header into the package's declared license

bazelbuild/bazel @ eb5aeaa — 28.81× faster

• Files: 11,495
• Run context: 2026-06-18 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 48.49s; ScanCode 1396.87s
• Broader Bazel dependency extraction (129 vs 14 dependencies) from root and nested BUILD files plus direct MODULE.bazel dependency visibility, internal BUILD targets collapsed to one component per build directory (546 vs ScanCode's 1711 name-only per-target package shells with no license, dependency, or version), and richer Debian and RPM sidecar package metadata

bazelbuild/rules_python @ ee53e46 — 18.70× faster

• Files: 2,360
• Run context: 2026-06-27 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.29s; ScanCode 136.34s
• Far broader Bazel module coverage (29 vs 5 pkg:bazel/* packages, 1362 vs 736 dependencies) from the repo's MODULE.bazel bzlmod manifests, WORKSPACE, and BUILD files across the example and test trees that ScanCode largely leaves unmodeled, with the assembled pkg:bazel/py_toolchains carrying both apache-2.0 declared licensing and the The Bazel Authors holder where ScanCode attaches neither to its top-level package, plus extension-qualified installed-wheel PURLs and clean canonical PyPI dependency identities where ScanCode appends file_name archive qualifiers

bevyengine/bevy @ d227783 — 47.5× faster

• Files: 2,897
• Run context: 2026-07-01 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.64s; ScanCode 362.89s
• Structure-preserving dual-license identity across the Cargo workspace — the pkg:cargo/bevy* crates carry apache-2.0 OR mit with the OR intact — plus normalization of the informal npm "MIT/Apache2" declared string to apache-2.0 OR mit where ScanCode reports only mit, and source-faithful URL extraction that preserves author-written trailing slashes (for example https://bevy.org/donate/) that ScanCode strips inconsistently, on matched package and dependency coverage (94 packages, 1679 dependencies)

boostorg/boost @ 4f1cbeb — 14.47× faster

• Files: 241
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.20s; ScanCode 75.26s
• Direct .gitmodules package-adjacent visibility (1 vs 0 file-level package records, plus one raw dependency edge) across the umbrella superproject, cleaner XML author extraction that drops prose-tainted suffixes such as A.Meredith Compiler, and Unicode-preserving name normalization for identities such as René Ferdinand Rivera Morell, Ion Gaztañaga, and J. López

boostorg/graph @ ae8e08d — 18.83× faster

• Files: 2,117
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.01s; ScanCode 132.02s
• Cleaner URL and copyright normalization across Boost metadata files, preserving the real http://www.boost.org/ target while dropping ScanCode's broken pseudo-URL variant in example/boost_web.dat, plus Unicode-preserving René Ferdinand Rivera Morell handling on build.jam and top-level .gitattributes visibility in the final output

boostorg/json @ 70efd4b — 13.78× faster

• Files: 705
• Run context: 2026-06-18 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 11.70s; ScanCode 161.21s
• Cleaner benchmark-corpus author extraction in bench/data/gsoc-2018.json and bench/data/github_events.json, replacing ScanCode junk such as type' Person name' AadityaNair and prose fragments with actual participant names while preserving Unicode identities like Nils Jørgen Mittet, plus Unicode-preserving holder normalization for René Ferdinand Rivera Morell on build metadata

boostorg/serialization @ 097a6c6 — 14.30× faster

• Files: 541
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.85s; ScanCode 83.67s
• Richer and cleaner serialization notice recovery across headers, tests, and legacy HTML docs, with multi-person codecvt attribution that preserves both Ronald Garcia and Andrew Lumsdaine, Peter Dimov author attribution on test/test_mi.cpp, fuller Joaquin M Lopez Munoz identity capture, and Unicode-preserving René Ferdinand Rivera Morell normalization

catchorg/Catch2 @ 10f6248 — 19.71× faster

• Files: 576
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.14s; ScanCode 121.03s
• Broader Conan, Meson, and Bazel package visibility (2 vs 1 packages, 3 vs 0 dependencies) from the root conanfile.py, MODULE.bazel, and committed meson.build manifests, with the local LICENSE notice in .conan/test_package/conanfile.py collapsed to plain BSL-1.0 instead of ScanCode's extra unknown-reference placeholder

chriskohlhoff/asio @ bd500f0 — 23.46× faster

• Files: 1,468
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.95s; ScanCode 186.47s
• More correct root Autotools package identity on configure.ac instead of ScanCode's generic input placeholder, plus cleaner holder normalization on include/asio.hpp and the Oliver Kowalke C++ notice set; the remaining ScanCode edge is limited to two multiline continuation headers and a small Perl author/copyright-email-tail set

chuckha/crispy-tribble @ 20479cf — 19.28× faster

• Files: 471
• Run context: 2026-06-18 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.42s; ScanCode 123.76s
• Broader Go module graph dependency visibility (117 vs 61 dependencies) from committed go.mod.graph while preserving matched package coverage (10 vs 10) across go.mod, go.sum, and vendored manifests, plus cleaner rejection of Go AUTHORS boilerplate and code-comment author/copyright fragments

chromium/chromium @ 2befda7 — 42.72× faster

• Files: 491,354
• Run context: 2026-06-25 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 754.46s; ScanCode 32231.76s
• Provenant collapses internal Bazel/Buck build targets to one component per build directory (255 Bazel + 3 Buck vs ScanCode's per-target 962 + 9), a documented design choice (docs/improvements/bazel-buck-build-targets.md), so its top-level package count is lower (599 vs 1279) while real-ecosystem coverage holds at or above parity (Cargo 240 vs 239, npm 46 vs 33) and dependency extraction stays materially richer (16793 vs 12378) from vendored .gitmodules, Cargo, and npm surfaces

cli/cli @ 71fb4f5 — 23.31× faster

• Files: 1,289
• Run context: 2026-06-27 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.81s; ScanCode 158.71s
• Matched Go module package and dependency extraction (2 vs 2 packages, 535 vs 535 dependencies) from the root go.mod and go.sum, with the pkg:golang/github.com/cli/cli/v2 identity assembled from both the manifest and the checksum database (ScanCode reads only go.mod) and carrying the repository's mit license, plus cleaner deduplicated file-level license expressions such as bsd-new AND lgpl-3.0 where ScanCode emits redundant nested forms like lgpl-3.0 AND (bsd-new AND lgpl-3.0)

conan-io/conan-center-index @ bc78dfb — 36.57× faster

• Files: 14,527
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 12.00s; ScanCode 438.89s
• Broader Conan dependency extraction (4346 vs 3289) from versioned conandata.yml, conanfile.py, and committed test-package manifests, with zero scan errors where ScanCode still crashes on two recipe files, multi-source conandata.yml coverage across the recipe corpus, cleaner one-package-per-recipe assembly instead of ScanCode's duplicate unversioned-plus-versioned Conan rows, repo-root LICENSE following on docs and recipe reference notices such as docs/faqs.md and recipes/cpp-sort/all/conanfile.py, and cleaner recipe-corpus license classification by suppressing filename-token false positives such as lgpl.txt

containerd/containerd @ 83044a43 — 35.01× faster

• Files: 6,332
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 22.05s; ScanCode 771.98s
• Matched Go package coverage (2 vs 2) with slightly richer dependency extraction (652 vs 651) from vendored mkdocs-reqs.txt and committed Python sidecar requirements, while preserving Go module inventory parity on the root go.mod and go.sum surfaces

coreutils/coreutils @ fb631c3 — 19.26× faster

• Files: 1,310
• Run context: 2026-07-12 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 10.16s; ScanCode 195.66s
• Broader author coverage (142 vs 136) from multi-author <contribution> by <Name> headers and texinfo @c-comment attributions such as Assaf Gordon that ScanCode leaves unrecovered, with clean four-author capture on src/tail.c (Paul Rubin, David MacKenzie, Ian Lance Taylor, Giuseppe Scrivano) and reorganization-credit authors on cksum_crc.c; ScanCode holds a slim copyright edge on two prose lines that embed both the word copyright and a real name — a shell grep pattern in cfg.mk and a credits sentence in shred.c

curl/curl @ 2bb5c9b — 26.33× faster

• Files: 4,266
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 14.26s; ScanCode 375.45s
• Matched ScanCode's file-level Autotools configure.ac coverage while promoting one top-level Autotools package (1 vs 0), with the real pkg:autotools/curl identity instead of a generic input placeholder, plus extra Docker package and dependency visibility from the committed Dockerfile

Debian/apt @ 6b12812 — 16.24× faster

• Files: 889
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 11.53s; ScanCode 187.26s
• Matched Debian source-package coverage (7 vs 7) with broader dependency extraction (32 vs 0) from the root multi-binary debian/control Build-Depends plus runtime relation fields such as Depends, Recommends, Suggests, Breaks, Conflicts, and Provides

docker-library/official-images @ 71567fb — 10.27× faster

• Files: 365
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.79s; ScanCode 49.17s
• Matched top-level package coverage (1 vs 1) with broader dependency extraction (9 vs 2) from the repo-root Dockerfile and committed Ruby test Gemfiles, plus Docker-library Maintainers author recovery across library/* definitions with cleaner Unicode-preserving normalization and GitRepo trailers left out of author values

docker-library/python @ ced4ac7 — 9.49× faster

• Files: 53
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.65s; ScanCode 44.14s
• Broader Docker package visibility across 42 generated image Dockerfiles where ScanCode reports none, plus maintainer-line author recovery on generate-stackbrew-library.sh, with exact top-level package, dependency, and license parity elsewhere

e-ale/meta-pocketbeagle @ 7cb4956 — 8.64× faster

• Files: 31
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.21s; ScanCode 45.03s
• Broader BitBake package visibility (4 vs 0 packages) from committed .bb and .bbappend metadata, with linuxconsoletools_1.6.0.bb carrying source URL/checksum plus local file-reference evidence and wildcard append manifests such as u-boot%.bbappend and linux-yocto_%.bbappend retained as package records instead of scanner-silent inputs

ethereum/go-ethereum @ 59e89e8 — 28.2× faster

• Files: 2,353
• Run context: 2026-07-02 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 14.57s; ScanCode 410.23s
• Accurate split-copyleft handling on the repo's GPL-binary / LGPL-library layout — per-file detection matches ScanCode (cmd/* → gpl-3.0-plus, library sources → lgpl-3.0-plus) — while the assembled pkg:golang/github.com/ethereum/go-ethereum abstains from a package-level declared expression because the co-hosted COPYING (GPL-3.0) and COPYING.LESSER (LGPL-3.0) disagree, where ScanCode emits a malformed, duplicated gpl-3.0 AND lgpl-3.0 AND (lgpl-3.0 AND gpl-3.0); Provenant also assembles the vendored pkg:autotools/libsecp256k1 (mit) that ScanCode misses and flattens ScanCode's duplicated, over-parenthesized operands (e.g. (cc0-1.0 AND gpl-3.0) AND isc → cc0-1.0 AND gpl-3.0 AND isc)

facebook/buck2 @ 3359f75 — 25.46× faster

• Files: 9,600
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 26.73s; ScanCode 680.60s
• Slightly richer mixed-repository dependency extraction (7079 vs 7034) from committed yarn.lock, flake.nix / flake.lock, and Conan fixtures, plus zero scan errors where ScanCode still trips on prelude/third-party/hmaptool/METADATA.bzl

facebook/watchman @ 426a7b7 — 18.1× faster

• Files: 896
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 8.24s; ScanCode 149.22s
• Broad Buck target visibility across the tree (103 vs 56 Buck package records), each carrying a proper pkg:buck/<name> identity instead of a null purl, plus a resolved pkg:gem/ruby-watchman@0.0.2 version where ScanCode leaves the RubyWatchman::VERSION constant, with matched zero-scan-error output

ffmpeg/ffmpeg @ 056562a — 39.45× faster

• Files: 10,200
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 29.14s; ScanCode 1149.65s
• Matched ScanCode's file-level Autotools configure package identity while also promoting one top-level Autotools package (1 vs 0), plus cleaner clue-only handling of weak configure variable-name and bare-word GPL noise such as EXTERNAL_LIBRARY_GPL_LIST and LICENSE_LIST="gpl"

fmtlib/fmt @ 2cb3983 — 13.57× faster

• Files: 133
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.60s; ScanCode 76.01s
• Matched package and dependency parity (0 packages, 1 dependency) while collapsing the local LICENSE-MIT notice in support/docopt.py to plain MIT, with cleaner copyright normalization on mkdocstrings support code and consistent URL normalization across README and docs

git/git @ 9f223ef — 42.67× faster

• Files: 4,734
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 14.62s; ScanCode 623.80s
• Broader package-adjacent Git metadata visibility on the tracked .gitmodules manifest (1 vs 0 dependencies on that file), plus one extra top-level package row (4 vs 3) from treating the manifest as package metadata instead of leaving it scanner-silent

glfw/glfw @ ed6452b — 17.15× faster

• Files: 177
• Run context: 2026-07-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.18s; ScanCode 88.79s
• Copyright rendering in the vendored Wayland protocol descriptions preserves the literal © glyph and accented holder names (Copyright © 2014 Jonas Ådahl) where ScanCode normalizes the sign to (c) and folds the name to Adahl; both classify the repository LICENSE.md as Zlib, and a Doxygen build-config prose fragment (doxygen. Using) is kept out of the author list where ScanCode reports it

go-gitea/gitea @ 47fdf3e2 — 26.3× faster

• Files: 5,201
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 15.66s; ScanCode 412.03s
• Broader package and dependency extraction from flake.nix, flake.lock, Dockerfile, and uv.lock, plus a correct root Go module identity on go.mod where ScanCode emits the malformed pkg:golang/%28 package row, with remaining license deltas confined to generated assets/go-licenses.json inventory noise and README author prose

godotengine/godot @ d7c45b1 — 34.0× faster

• Files: 14,013
• Run context: 2026-06-29 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 76.33s; ScanCode 2591.46s
• Broader package and dependency extraction (17 vs 1 packages, 214 vs 187 dependencies) across the modules/mono .csproj NuGet manifests ScanCode misses, with cleaner license accounting over the large thirdparty/ tree: deduplicated, flattened compound expressions on multi-license registries such as COPYRIGHT.txt, thirdparty/libjpeg-turbo/LICENSE.md, and glslang/LICENSE.txt where ScanCode emits deeply nested duplicate groups; the more specific (riverbank-sip OR gpl-2.0 OR gpl-3.0) over ScanCode's vague other-copyleft; the more complete info-zip-2009-01 AND zlib on minizip/unzip.c where ScanCode reports only zlib; and rejection of ScanCode false positives such as gpl-2.0 WITH universal-foss-exception-1.0 matched at 12.9% coverage against a BSD "see LICENSE" header and ngpl matched inside an ICU .dat binary

goharbor/harbor @ eb944bb — 25.16× faster

• Files: 3,233
• Run context: 2026-06-18 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 13.01s; ScanCode 327.33s
• Broader package and dependency extraction (5 vs 2 packages, 2972 vs 2407 dependencies) from committed Pipfile/Pipfile.lock, npm-family, Docker, and Go manifests, with local Go replace paths kept out of invalid PURLs, templated Conda YAML skipped instead of degraded into false metadata, and URL differences limited to normalization/truncation/canonicalization after review

goharbor/harbor-helm @ 7233a81 — 7.57× faster

• Files: 96
• Run context: 2026-06-06 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.36s; ScanCode 48.15s
• Direct Helm chart package visibility (1 vs 0 packages, pkg:helm/harbor@1.4.0-dev from the apiVersion-v1 Chart.yaml) plus a Dockerfile image package from test/e2e/Dockerfile, with identical top-level license detection and matching Go module coverage from the bundled test/go.mod / test/go.sum terratest harness

grpc/grpc @ f87c29f — 28.89× faster

• Files: 10,361
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 31.30s; ScanCode 904.39s
• Far broader dependency extraction (418 vs 92) from the root .gitmodules, MODULE.bazel, and vendored package surfaces, internal Bazel BUILD targets collapsed to one component per build directory (270 vs ScanCode's 761 name-only per-target package shells), and direct Git-submodule visibility on 17 tracked third-party submodules where ScanCode reports zero package data on the same manifest

guillemj/dpkg @ 0061122 — 32.78× faster

• Files: 1,766
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 13.06s; ScanCode 428.07s
• Broader Debian source-package and dependency extraction (23 vs 19 packages, 18 vs 0 dependencies) from the root multi-binary debian/control file plus committed .dsc fixtures, with explicit package visibility for dpkg-dev, libdpkg-dev, and libdpkg-perl and one extra top-level Autotools package on configure.ac

hashicorp/terraform @ e02391a — 35.6× faster

• Files: 5,425
• Run context: 2026-06-29 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 9.96s; ScanCode 354.17s
• Cleaner URL extraction that rejects {account}-templated host placeholders ScanCode emits as navigable URLs, and author capture that drops the README maintainer prose ScanCode records as a party, on otherwise matched Go module package, dependency, and declared-license coverage — the assembled pkg:golang/github.com/hashicorp/terraform resolves the repo-root LICENSE to the same bsl-1.1 AND mpl-2.0 ScanCode reports

ifduyue/musl @ b306b16 — 19.65× faster

• Files: 2,660
• Run context: 2026-07-12 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.12s; ScanCode 100.58s
• Copyright rendering preserves the literal © glyph (Copyright © 1994 David Burren) where ScanCode normalizes it to (c); the bare word BSD in musl's COPYRIGHT roster is reported as a bsd-new license clue where ScanCode emits none; and the hand-written configure script yields no package where ScanCode names a degenerate pkg:autotools/input after the scan-root directory. ScanCode holds a marginal author edge (13 vs 12) from one multi-contributor by-chain Provenant reports as a single merged attribution

ImageMagick/ImageMagick @ 55e52c4 — 37.07× faster

• Files: 2,256
• Run context: 2026-07-12 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 12.41s; ScanCode 459.99s
• Source-faithful copyright rendering that preserves the literal © glyph and strips presentational HTML wrappers such as <small>…</small> from notices like Copyright © 1999 ImageMagick Studio LLC, with richer package and dependency extraction (8 vs 5 file-level package_data records, 16 vs 13 dependencies) and rejection of ScanCode's MagickCore (c)-style code false positives; ScanCode keeps a copyright-count edge (1315 vs 1114) concentrated in generated Doxygen HTML API pages under www/api/**, whose notices duplicate the ones Provenant already captures in the underlying C++ sources

KDE/kirigami @ 0ff3ed5 — 14.9× faster

• Files: 491
• Run context: 2026-07-02 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.56s; ScanCode 82.76s
• Faithful handling of the REUSE licensing model: the LICENSES/ directory (including the KDE-specific LicenseRef-KDE-Accepted-LGPL) and the pervasive per-file SPDX-License-Identifier tags across the C++/QML sources resolve to the same expressions as ScanCode (lgpl-2.0-plus, lgpl-2.1-plus, …), while Provenant preserves each SPDX-FileCopyrightText: line verbatim where ScanCode rewrites it to Copyright, and surfaces the project-template android and maven manifests as package data that ScanCode does not

kubernetes/autoscaler @ 9045d28 — 32.10× faster

• Files: 5,929
• Run context: 2026-06-18 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 23.20s; ScanCode 744.62s
• Broader Go and Helm package visibility (11 vs 8 packages, 3127 vs 2892 dependencies), including 165 dependencies from addon-resizer/Godeps/Godeps.json where ScanCode reports none, direct chart packages for cluster-autoscaler and vertical-pod-autoscaler, cleaner rejection of ScanCode malformed Go-version package rows such as pkg:golang/v2.4.0, and generic author cleanup for Markdown Authors: lines with trailing bare handles

kubernetes/kubernetes @ d3b9c54 — 32.96× faster

• Files: 29,080
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 98.23s; ScanCode 3237.19s
• Broader Dockerfile and go.work package coverage, richer staging-workspace dependency extraction (7008 vs 6950), and richer BSD-3-Clause AND Apache-2.0 compound license classification where ScanCode collapses many of the same files to plain Apache-2.0

libevent/libevent @ 4829651 — 15.1× faster

• Files: 260
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.63s; ScanCode 85.01s
• Matched ScanCode's file-level Autotools configure.ac coverage while promoting one top-level Autotools package (1 vs 0) with the real pkg:autotools/libevent identity, and avoids ScanCode's prose-fragment author noise such as Hagne Mahre and then Hannah and team of volunteers

libgit2/libgit2 @ 1f34e2a — 25.62× faster

• Files: 8,406
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 9.93s; ScanCode 254.45s
• Broader mixed-repository dependency extraction (12 vs 0) from committed script/api-docs/package.json and script/api-docs/package-lock.json, while preserving top-level Autotools package parity (1 vs 1)

LinuxCNC/linuxcnc @ cd534c9 — 14.54× faster

• Files: 9,078
• Run context: 2026-06-18 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 114.17s; ScanCode 1659.92s
• Direct Meson package visibility on the root meson.build plus declared dependency extraction (2 vs 0 packages, 2 vs 0 dependencies) for boost and python2, with Debian copyright metadata carrying a Debian namespace instead of an unqualified source-package row

madler/zlib @ f9dd600 — 12.48× faster

• Files: 261
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.24s; ScanCode 65.39s
• Broader native-build package and dependency visibility (5 vs 0 packages, 3 vs 0 dependencies) from the root configure, MODULE.bazel, and committed .csproj surfaces, with the real pkg:autotools/zlib identity instead of ScanCode's generic input placeholder, direct Bazel and NuGet surface coverage, and the more specific LicenseRef-scancode-info-zip-2009-01 AND Zlib classification on contrib/minizip/unzip.c

mesonbuild/meson @ b300d95 — 18.79× faster

• Files: 5,425
• Run context: 2026-06-27 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 9.45s; ScanCode 177.55s
• Direct Meson package and dependency extraction (1154 vs 0 pkg:meson/* packages, 314 more top-level dependencies) that ScanCode cannot model because it ships no Meson parser: Provenant promotes every meson.build declaring a project() into a pkg:meson/<name> package that owns the dependency() calls in that build file (zlib, glib-2.0, boost), skipping subdirectory build files without a project() and nameless dependency('') placeholders so neither floods the output, plus SPDX-aligned apache-2.0 declared licensing that avoids ScanCode's spurious (apache-2.0 OR gpl-2.0-plus) AND unknown reading of the setup.cfg license blob

moby/moby @ 21bd660 — 49.68× faster

• Files: 12,375
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 28.00s; ScanCode 1391.11s
• Matched top-level package coverage (5 vs 5) with slightly richer dependency extraction (1093 vs 1088) from relative Go module edges, vendored .gitmodules, and committed requirements.txt, plus extra Docker package visibility on committed Dockerfiles and cleaner rejection of weak prose-only author or holder matches such as the Prometheus

mongodb/mongo @ d6877a3 — 44.75× faster

• Files: 52,443
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 143.10s; ScanCode 6404.29s
• Broader polyglot package and dependency extraction (49 vs 1 packages, 727 vs 7 dependencies) from poetry.lock, pnpm-lock.yaml, RPM spec, Nix, Cargo, and Conan metadata plus vendored gRPC Buck BUILD files collapsed to one component per build directory, with richer Debian namespace/PURL identity on package metadata and cleaner SBOM author recovery that leaves score-fusion code examples as code data instead of people

nmap/nmap @ d9199d7 — 26.96× faster

• Files: 2,595
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 25.48s; ScanCode 686.99s
• Broader package/dependency extraction (19 vs 2 packages, 13 vs 2 dependencies), preserved NPSL/source-available handling across core Nmap and Zenmap reference-notice files, and cleaner rejection of weak translated-manpage GPL bare-word and placeholder noise

nginx/nginx @ 6e14e95 — 25.10× faster

• Files: 521
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.70s; ScanCode 143.06s
• Direct CPAN package visibility (1 vs 0 packages) from the embedded Perl src/http/modules/perl/Makefile.PL, with concrete pkg:cpan/nginx@%%VERSION%% identity and author metadata instead of ScanCode's generic CPAN placeholder, plus safer rejection of nginx's custom auto/configure shell script as Autotools package metadata and cleaner author, email, and URL normalization across manpage markup and README badge links

openembedded/meta-openembedded @ 7bf89d0 — 31.22× faster

• Files: 6,983
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 10.19s; ScanCode 318.17s
• Broader BitBake package and dependency visibility (1437 vs 0 packages, 10149 vs 0 dependencies) from committed .bb, .bbappend, and .inc metadata, plus recipe-side declared-license and source-reference recovery on manifests such as nilfs-utils_v2.2.11.bb, with patch-header and comment-style author recovery kept separate from ScanCode's bare-word GPL/LGPL and patch-prose overcalls

openssl/openssl @ 7fb28b9 — 38.63× faster

• Files: 6,074
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 21.79s; ScanCode 841.78s
• Broader package and dependency visibility (1 vs 0 packages, 41 vs 0 dependencies) from bundled external/perl/Text-Template-1.56 CPAN metadata plus committed .gitmodules and test/quic-openssl-docker/Dockerfile surfaces, with stronger Written by ... author recovery on OpenSSL-style comment headers and cleaner rejection of weak CPAL or MIT overcalls on standard OpenSSL license footers

prometheus/prometheus @ 351447a — 30.1× faster

• Files: 1,637
• Run context: 2026-07-01 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 9.99s; ScanCode 300.33s
• Broader Go package and dependency extraction (9 vs 7 packages, 3995 vs 2324 dependencies) across the workspace go.mod/go.sum/go.work and nested module manifests, with the assembled pkg:golang/github.com/prometheus/prometheus carrying a clean apache-2.0 declared license from the repo-root LICENSE where ScanCode conflates the sibling NOTICE's bundled-dependency licensing into an apache-2.0 AND mit AND bsd-new AND (apache-2.0 AND unknown-license-reference) aggregate, plus author capture that rejects the README prose and Go test-code fragments ScanCode records as parties

pulseaudio/pulseaudio @ b096704 — 29.70× faster

• Files: 867
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 8.58s; ScanCode 254.79s
• Broader Meson dependency visibility (8 vs 0 top-level dependencies) from meson.build, more correct LGPL-2.0/LGPL-2.1 notice classification across the source and manpage trees, and cleaner rejection of placeholder COPYRIGHT HOLDER, contributor-tail, and code-fragment noise, with the remaining deltas concentrated in low-value translation-header placeholders and source-faithful Unicode/name rendering

protocolbuffers/protobuf @ e3370c2 — 46.15× faster

• Files: 3,463
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 13.25s; ScanCode 611.44s
• Broader Bazel and cross-language dependency extraction (144 vs 64 dependencies) from root and example MODULE.bazel, many BUILD files, committed *.csproj, and Maven BOM imports, internal BUILD targets collapsed to one component per build directory (110 vs ScanCode's 537 name-only per-target package shells), and direct Git-submodule package visibility on .gitmodules

qemu/qemu @ da6c4fe — 46.14× faster

• Files: 10,989
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 32.26s; ScanCode 1488.40s
• Broader Meson and package-adjacent dependency extraction (22 vs 21 packages, 260 vs 176 dependencies) from the root .gitmodules, python/tests/minreqs.txt, and many committed subprojects/**/meson.build manifests, with the real pkg:autotools/qemu root identity instead of ScanCode's generic input placeholder

redis/redis @ 5b5c326 — 24.4× faster

• Files: 1,803
• Run context: 2026-07-01 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 11.16s; ScanCode 272.71s
• Direct pkg:autotools/jemalloc package identity (bsd-simplified) assembled from the vendored deps/jemalloc build manifests where ScanCode surfaces no package at all, cleaner per-file license expressions — the vendored deps/jemalloc/test SFMT sources resolve to a clean bsd-new where ScanCode bolts on the whole repo-license blob (bsd-new AND (bsd-new AND generic-cla AND mongodb-sspl-1.0 AND agpl-3.0 AND unknown-license-reference …)) — and source-faithful copyright capture that keeps complete multi-holder notices and their obfuscated-email contacts across the vendored deps/hiredis and deps/fpconv sources where ScanCode truncates to a single holder

rpm-software-management/dnf @ e47634f — 18.95× faster

• Files: 655
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.87s; ScanCode 130.21s
• Broader RPM package and dependency extraction (163 vs 138 packages, 579 vs 1 dependencies) from committed .rpm fixtures and sibling .spec metadata, with normalized RPM header license expressions and one-package-per-spec ownership across the shipped module fixture trees

rpm-software-management/libdnf @ d395731 — 17.41× faster

• Files: 1,162
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.97s; ScanCode 103.93s
• Broader RPM package and dependency extraction (352 vs 327 packages, 1441 vs 0 dependencies) from committed .rpm fixture trees and sibling .spec metadata, with normalized RPM header license expressions and cleaner rejection of config or doc false positives such as baseurl and doxygen. Using as holder or author data

marshallpierce/rust-base64 @ 13f4fe8 — 8.98× faster

• Files: 42
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.00s; ScanCode 44.92s
• Matched Cargo workspace package and dependency coverage (2 vs 2 packages, 190 vs 190 dependencies) while preserving the repository's dual-license README and manifest semantics, recovering SVG-linked URL evidence, and avoiding trailing-slash URL drift across the docs surfaces

mozilla/glean @ a4166fa — 20.46× faster

• Files: 1,079
• Run context: 2026-07-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.26s; ScanCode 128.06s
• Detects MPL-2.0 on one more file (13 vs 12) and rejects ScanCode's author false positives mined from config and documentation prose (the Glean, cron task <url>); the virtual [workspace] Cargo manifest and Cargo.lock report an empty declared license where ScanCode attributes mpl-2.0 to files that declare none

rust-lang/cargo @ b54fe55 — 24.6× faster

• Files: 2,883
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 8.34s; ScanCode 205.19s
• Matched top-level Cargo package coverage (77 vs 77) with workspace-inherited declared-license resolution so license.workspace = true members carry a normalized expression, broader declared-license coverage overall (66 package licenses ScanCode omits), legacy dev/build dependency manifest coverage, and zero scan errors on malformed fixture manifests

rust-lang/rust @ dab8d9d — 70.65× faster

• Files: 58,818
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 37.12s; ScanCode 2622.46s
• Near-parity native-tree package and dependency extraction (347 vs 345 packages, 5926 vs 5924 dependencies) with better nested Cargo lock dependency visibility across mixed workspaces, additional Nix package visibility, and more specific versioned Cargo package identities where ScanCode emits generic lockfile rows or versionless crate names; the lone Provenant scan-error entry is a deliberate safety skip of the intentionally malformed tests/ui/include-macros/invalid-utf8-binary-file.bin binary fixture

rustcrypto/aeads @ 9d05d81 — 10.53× faster

• Files: 268
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.88s; ScanCode 51.37s
• Matched Cargo workspace package and dependency coverage (14 vs 14 packages, 209 vs 209 dependencies) while preserving the member-crate Apache-2.0 OR MIT README semantics, keeping archived NCC Group review URLs intact in aes-gcm and chacha20poly1305, surfacing a concrete mgm lockfile package identity where ScanCode stays anonymous, and filtering weak team of volunteers SECURITY.md maintainer prose out of author output

sqlite/sqlite @ f2e2b82 — 66.55× faster

• Files: 2,217
• Run context: 2026-07-12 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 10.34s; ScanCode 688.10s
• Clean copyright output on the SQL-heavy public-domain tree — (c) tokens inside expressions such as max(c) OVER (...) and avg(c) FILTER (...) are treated as code rather than notices, yielding 43 copyrights against ScanCode's 40 — with richer author capture (19 vs 13), rejection of ScanCode's own grammar and fuzz/binary copyright noise ((c) JOIN in parse.y, byte runs in fuzzdata2.db), and a deduplicated public-domain AND blessing AND bsd-new expression on LICENSE.md more compact than ScanCode's repeated form

syncthing/syncthing @ 5277033 — 22.41× faster

• Files: 1,132
• Run context: 2026-07-12 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.90s; ScanCode 154.60s
• Author extraction captures the project's full AUTHORS contributor roster (279 authors against ScanCode's 7), and OFL-1.1 is detected in the vendored fork-awesome fonts — the LICENSE.txt plus the .woff/.ttf/.eot/.svg binaries — that ScanCode leaves as bare license clues; copyright rendering preserves the source ©/(C) where ScanCode normalizes to (c), over a slightly larger dependency set (355 vs 352). ScanCode reports cleaner holders in the gui/default/syncthing/core/aboutModalView.html "included software" credits list, where Provenant retains adjacent-entry fragments (Alec Thomas. beorn7/perks)

systemd/systemd @ 89d705a — 42.92× faster

• Files: 6,994
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 19.44s; ScanCode 834.45s
• Broader Meson dependency extraction (40 vs 2) from the root and nested meson.build files, with literal \x2d filenames preserved on committed unit and fuzz fixtures instead of being path-shaped into different resources

tensorflow/tensorflow @ 2cd48d2 — 35.79× faster

• Files: 36,237
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 117.09s; ScanCode 4190.35s
• Broader Bazel and mixed-tree dependency extraction (1471 vs 700 dependencies) from root and vendored MODULE.bazel, many committed BUILD files, Python lockfiles, Dockerfiles, and Debian control metadata, internal BUILD targets collapsed to one component per build directory (1236 vs ScanCode's 8056 name-only per-target package shells), plus direct CITATION.cff package visibility

PX4/eigen @ 7cf1c01 — 27.26× faster

• Files: 1,672
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.41s; ScanCode 202.03s
• Cleaner copyright, holder, and author recovery on this manifest-free native source tree, with structured Copyright Notice (...) extraction, normalized Author / Project / Copyright header splitting, rejection of .krazy control-file and disclaimer-list junk, and Unicode-preserving party normalization

ValveSoftware/eigen @ e9c4315 — 29.98× faster

• Files: 1,784
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.65s; ScanCode 229.36s
• Zero package, dependency, and top-level license-detection deltas on this manifest-free source tree, plus Unicode-preserving holder normalization such as Désiré Nuentsa-Wakam and split multi-person holder recovery where ScanCode merges names; the remaining ScanCode edge is limited to a weak Distributed holder overcapture in bench/eig33.cpp, a few legacy acknowledgment-shaped author/copyright cases, minor holder formatting differences, and URL normalization deltas

tokio-rs/tokio @ 5db10f5 — 18.69× faster

• Files: 833
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.55s; ScanCode 103.73s
• Matched Cargo workspace package and dependency coverage (12 vs 12 packages, 83 vs 83 dependencies) while preserving collective manifest-author names like Tokio Contributors <team@tokio.rs>, plus cleaner rejection of ScanCode's weak (c)-plus-URL copyright and holder noise and normalized docs.rs URL variants

tonsky/FiraCode @ 727682c — 20.41× faster

• Files: 234
• Run context: 2026-07-12 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.65s; ScanCode 94.92s
• Author extraction reports only the real author (Nikita Prokopov <niki@tonsky.me>) against ScanCode's 30, which include OpenType glyph and feature names (greater_equal_end.seq, greater_greater_hyphen_start.seq, …) and a package.json author value with the manifest's license/bugs/url fields bled in; package extraction is broader (5 vs 3 file-level package_data, 6 more dependencies) and the SIL OFL holder keeps its Authors (https://…) contact in the repo-root LICENSE. ScanCode reports cleaner copyright holders in a .glyphs-internal OFL notice and the generated googlefonts-qa/*.checks.md QA reports, where Provenant retains a Project Authors (git url) … prose fragment

unicode-org/icu4x @ 9827052 — 38.17× faster

• Files: 13,754
• Run context: 2026-07-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 35.74s; ScanCode 1364.11s
• Matches ScanCode's Unicode-3.0 declared license on the workspace's published crates via Cargo license.workspace = true inheritance, while the non-publishing fuzz and tooling crates report an empty declared license where ScanCode over-attributes the workspace Unicode-3.0 to crates that declare none; author detection rejects ScanCode's false positives mined from Rust, SQL, and localization data (statuses.id, type Person, TermDefinition.new) and from calendar prose (the Thai, the Indian), and copyright/holder output on the Unicode break-test and character-database data files keeps only the genuine © Unicode, Inc. header notice

xiph/opus @ 22244de — 15.24× faster

• Files: 754
• Run context: 2026-06-16 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.88s; ScanCode 120.11s
• Broader native-build package visibility (3 vs 2 packages, 52 vs 38 dependencies) from the repo-root configure.ac, nested meson.build, and tracked .gitmodules, with the real pkg:autotools/opus identity instead of ScanCode's generic input placeholder, plus stronger Written by ... header author recovery and more correct BSD-2 classification on hybrid DNN headers such as dnn/freq.h and dnn/vec_avx.h

torvalds/linux @ b42ed3b — 62.36× faster

• Files: 92,523
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 271.01s; ScanCode 16900.59s
• Broader sparse-tree package visibility (4 vs 2 packages, 20 vs 19 dependencies), plus cleaner common-profile author extraction on representative native-source docs such as sysrq, cpusets, and hwmon rosters while rejecting several ScanCode-only prose false positives like the Coreboot BIOS. and the Host

yoctoproject/poky @ cb2dcb4 — 30.75× faster

• Files: 6,295
• Run context: 2026-06-22 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 16.04s; ScanCode 493.15s
• Broader BitBake package and dependency visibility (546 vs 2 packages, 3061 vs 22 dependencies) from committed .bb, .bbappend, and .inc metadata, plus recipe-local declared-license output on manifests such as rdma-core_62.0.bb and libowfat_0.32.bb, with cleaner package records for wildcard append files and comment-style author recovery where ScanCode still mixes in low-signal project/community strings

Apple / Swift / Flutter / mobile

AFNetworking/AFNetworking @ d9f589c — 10.49× faster

• Files: 210
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.17s; ScanCode 54.22s
• Matched top-level CocoaPods package coverage (1 vs 1) with broader dependency extraction (124 vs 115) from AFNetworking.podspec subspec edges and the root Gemfile

Alamofire/Alamofire @ ac01666 — 23.18× faster

• Files: 567
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.25s; ScanCode 144.88s
• Matched top-level CocoaPods package coverage (1 vs 1) and main podspec/license parity, with slightly richer dependency extraction (56 vs 54) from the root Gemfile

Carthage/Carthage @ e33e133 — 14.41× faster

• Files: 183
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.94s; ScanCode 71.21s
• Matched top-level package coverage (9 vs 9) with direct Carthage manifest visibility and hoisted declared or pinned dependency extraction (20 vs 0) from committed Cartfile, Cartfile.private, and Cartfile.resolved, plus safer Package.resolved modeling as one resolved-file package record with structured pinned dependencies instead of exploded duplicate pseudo-packages

facebook/react-native @ 179e0cd — 36.71× faster

• Files: 7,765
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 20.45s; ScanCode 750.76s
• Far broader CocoaPods and sidecar package extraction (111 vs 34 packages, 2134 vs 1572 dependencies) from many committed .podspec files plus the root Gemfile and Kotlin build.gradle.kts plugin manifests, with richer package author visibility across React Native podspecs

firebase/flutterfire @ 90d2e1f — 22.74× faster

• Files: 3,615
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 10.56s; ScanCode 240.18s
• Spec-correct, internally consistent pkg:pub PURLs for the Flutter/Firebase graph (65 Dart packages, 690 Dart dependencies) from many committed pubspec.yaml, CocoaPods podspec / Podfile, and Android Gradle inputs, where ScanCode emits non-standard pkg:dart packages alongside pkg:pubspec dependencies, with more complete copyright-holder capture (e.g. Chromium project authors) and contributor-roster visibility from AUTHORS where ScanCode stays silent

flutter/flutter @ 238d79a — 43.67× faster

• Files: 15,670
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 41.81s; ScanCode 1825.77s
• Broader Dart/Flutter package and dependency extraction (141 vs 126 packages, 1477 vs 1185 dependencies) across repo-root, engine, benchmark, and integration-test pubspec.yaml manifests plus committed AndroidManifest and podspec surfaces, with contributor-roster visibility from AUTHORS files that ScanCode leaves empty

flutter/packages @ 06fee7a — 44.04× faster

• Files: 8,983
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 17.15s; ScanCode 755.27s
• Far broader Dart/Flutter monorepo package and dependency extraction (293 vs 201 packages, 2087 vs 1167 dependencies) from many package and example pubspec.yaml manifests plus committed podspec and Android build.gradle.kts inputs, with contributor-roster visibility across AUTHORS files that ScanCode leaves empty

i18next/react-i18next @ cb20d18 — 19.08× faster

• Files: 590
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.71s; ScanCode 128.04s
• Broader mixed-surface package and dependency extraction (17 vs 1 packages, 21579 vs 911 dependencies) across committed example-app package.json, React Native CocoaPods Podfile, Android AndroidManifest.xml, Gemfile, NuGet packages.config, and Buck surfaces, with concrete Flipper coordinates where ScanCode preserves ${FLIPPER_VERSION} placeholders and Unicode-preserving author normalization for Jan Mühlemann

Mantle/Mantle @ 2a8e212 — 9.74× faster

• Files: 79
• Run context: 2026-06-16 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.86s; ScanCode 47.35s
• Matched top-level package coverage (1 vs 1) with broader package-adjacent dependency extraction (11 vs 0) from .gitmodules, Cartfile.private, and Cartfile.resolved, plus Unicode-preserving author recovery for Robert Böhnke and cleaner normalization of repeated workflow contact addresses and GitHub query URLs

ocetnik/react-native-background-timer @ 244ea3e — 9.46× faster

• Files: 19
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.79s; ScanCode 45.33s
• Broader React Native mobile dependency extraction (1493 vs 1492) from the Android build.gradle React Native coordinate, plus direct AndroidManifest package visibility and Unicode-preserving Dávid Ocetník copyright and holder recovery instead of ScanCode's ASCII fallback

pointfreeco/swift-composable-architecture @ 7517cc3 — 16.6× faster

• Files: 1,098
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.17s; ScanCode 85.71s
• Matched Swift package coverage with safer Package.resolved modeling — resolved-file package records carrying structured pinned dependencies instead of exploded duplicate file-level pseudo-packages — and SPDX-aligned declared-license keys

ReactiveCocoa/ReactiveCocoa @ f2d9bd5 — 10.64× faster

• Files: 216
• Run context: 2026-06-16 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.66s; ScanCode 49.57s
• Matched top-level package coverage (7 vs 7) with broader package-adjacent dependency extraction (14 vs 0) from .gitmodules, Cartfile, Cartfile.private, Cartfile.resolved, and the sibling podspecs, plus safer Package.resolved modeling as one resolved-file package record with structured pinned dependencies instead of exploded duplicate pseudo-packages

rrousselGit/riverpod @ cac77b1 — 26.55× faster

• Files: 1,930
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.16s; ScanCode 163.56s
• Broader Dart/Flutter workspace package and dependency extraction (29 vs 26 packages, 1417 vs 1350 dependencies) from package, example, and test pubspec.yaml manifests across the monorepo, plus cleaner structured-literal copyright extraction on generated Dart and JSON fixtures

SDWebImage/SDWebImage @ c3ad5e1 — 16.45× faster

• Files: 369
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.61s; ScanCode 92.26s
• Matched top-level CocoaPods package coverage (3 vs 3) with broader dependency extraction (10 vs 0) from Podfile-declared pod relationships, while preserving separate package identities for the sibling test podspecs

SwiftFiddle/swiftfiddle-web @ df09b80 — 9.88× faster

• Files: 114
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.24s; ScanCode 51.75s
• Much richer dependency extraction (297 vs 36) from committed Resources/Package.swift.json, Package.resolved, and package-lock.json, matched Swift package coverage (32 vs 32), and extra Docker package visibility

.NET / NuGet / Windows / vcpkg

AvaloniaUI/Avalonia @ b7e95c2 — 43.1× faster

• Files: 5,273
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 11.06s; ScanCode 476.87s
• Broader .NET/NuGet package and dependency extraction (105 vs 3 packages, 145 vs 33 dependencies) from many *.csproj files plus Directory.Packages.props and Directory.Build.props across samples, tooling, and test projects, with zero scan errors and avoidance of ScanCode's unevaluated template-expression copyright noise such as $(System.DateTime::Now...) and (c) {DateTime.Now.Year} The Avalonia Project

bitwarden/server @ 051d0ef — 40.54× faster

• Files: 6,658
• Run context: 2026-06-05 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 14.83s; ScanCode 601.20s
• Far broader .NET/NuGet package and dependency extraction (61 vs 4 packages, 9962 vs 933 dependencies) because 58 committed packages.lock.json lockfiles contribute fully resolved transitive NuGet graphs alongside 57 *.csproj and Directory.Build.props manifests plus sibling npm, Cargo, and Docker surfaces, with direct AGPL-3.0-or-later identity on the bitwarden-server.slnx solution and source-faithful copyright recovery that keeps Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/> intact while rejecting Handlebars CurrentYear template placeholders, (c)-in-code fragments, and package.json field-jammed author noise

dotnet/extensions @ 7171956 — 23.92× faster

• Files: 3,643
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 11.78s; ScanCode 281.77s
• Broader .NET/NuGet package and dependency extraction (162 vs 2 packages, 1161 vs 690 dependencies) across many *.csproj files, Directory.Packages.props, Directory.Build.props, and imported eng/packages/*.props / Tests.props / Tools.props central-version surfaces, with root and nested central package manifests carrying resolved package-version dependency metadata instead of empty imported-props placeholders

dotnet/fsharp @ f7be8d0 — 38.12× faster

• Files: 10,138
• Run context: 2026-06-18 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 20.20s; ScanCode 769.93s
• Broader .NET/NuGet package and dependency extraction (111 vs 0 packages, 186 vs 0 dependencies) across *.fsproj, the FSharp.ProjectSystem.PropertyPages.vbproj, shipping *.nuspec, *.csproj, and Directory.Build.props surfaces that ScanCode leaves unassembled, plus matched dual CC0-1.0 AND MIT detection on the TaskBuilder-derived files where a public-domain dedication abuts the project-license reference, and cleaner rejection of F# quotation (c) code-fragment copyrights and holders, filename- and prose-shaped author noise, a placeholder email, and a malformed concatenated URL

dotnet/runtime @ d1163e5 — 58.40× faster

• Files: 57,611
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 107.09s; ScanCode 6254.44s
• Broader .NET/NuGet and sibling npm package visibility (2249 vs 5 packages, 986 vs 503 dependencies) across many *.csproj files, Directory.Packages.props, Directory.Build.props, and committed package-lock.json inputs

MaxRev-Dev/gdal.netcore @ 6cc0145 — 10.58× faster

• Files: 156
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.79s; ScanCode 50.68s
• Broader .NET/NuGet and vcpkg package and dependency extraction (5 vs 0 packages, 92 vs 4 dependencies) from many *.csproj and packages.config project manifests assembled into named pkg:nuget/* identities, alongside the full modern vcpkg manifest-mode surface in shared/: the shared/vcpkg.json manifest, the standalone shared/vcpkg-configuration.json registry-configuration surface that preserves the default-registry git baseline independently of the manifest, and the shared/vcpkg-lock.json registry-lock surface that preserves each registry location and its locked reference-to-revision mapping, plus sibling Dockerfile and pip-requirements visibility where ScanCode reports no top-level packages, with cleaner README and Natural Earth sample-data URL normalization that percent-encodes embedded query URLs and canonicalizes trailing slashes where ScanCode leaves raw variants

microsoft/onnxruntime @ 97e0a00 — 39.55× faster

• Files: 9,802
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 38.54s; ScanCode 1524.08s
• Broader mixed-repository package and dependency extraction (45 vs 1 packages, 3607 vs 80 dependencies) from cmake/vcpkg.json plus committed cmake/vcpkg-ports/*/vcpkg.json manifests, with the large package-lock.json license-count gap reduced with any residual license delta concentrated in ONNX model fixtures that still stay scan-error-free and explicit vcpkg package identities where ScanCode stays manifest-blind

microsoft/regorus @ 7f42115 — 21.39× faster

• Files: 1,121
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.45s; ScanCode 137.98s
• Broader mixed Rust/.NET/Ruby package and dependency extraction (19 vs 14 packages, 1253 vs 1238 dependencies) across committed bindings/csharp/Directory.Packages.props, consumer *.csproj, and Ruby sidecar manifests, with resolved Microsoft.Regorus central package version 0.9.1 propagated from same-file property composition instead of leaving the CPM expression unresolved

microsoft/terminal @ 84ae7ad — 30.65× faster

• Files: 3,625
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 9.93s; ScanCode 304.40s
• Broader mixed-package extraction (17 vs 2 packages, 40 vs 0 dependencies) from the root vcpkg.json, overlay-port dep/vcpkg-overlay-ports/*/vcpkg.json, and committed packages.config files, with explicit pkg:generic/vcpkg and pkg:nuget package identities where ScanCode reports none

microsoft/vcpkg @ 0bf3923 — 31.18× faster

• Files: 5,536
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.83s; ScanCode 244.13s
• Far broader classic vcpkg registry coverage: 1521 top-level pkg:generic/vcpkg packages — one per committed ports/*/CONTROL (1444) and early ports/*/vcpkg.json manifest — each owning its Build-Depends (4677 dependencies, with feature and platform qualifiers) where ScanCode surfaces only 9 file-level records and no dependencies, plus named Debian copyright package identities where ScanCode emits nameless standalone copyright rows, and URL normalization that preserves complete CMake variable expressions instead of truncating at ${... braces

microsoft/vcpkg @ b21ff8f — 34.04× faster

• Files: 13,670
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 11.35s; ScanCode 386.36s
• Far broader vcpkg registry package and dependency extraction (2942 vs 1 packages, 13653 vs 39 dependencies): 2940 top-level pkg:generic/vcpkg packages, one per committed ports/*/vcpkg.json manifest, each owning its host, feature, and platform-qualified dependencies, plus standalone Debian copyright package rows on ports/*/copyright where ScanCode stays largely manifest-blind

OrchardCMS/OrchardCore @ 01386f3 — 51.92× faster

• Files: 9,118
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 16.72s; ScanCode 868.10s
• Broader .NET/NuGet package and dependency extraction (276 vs 41 packages, 1758 vs 1597 dependencies) from many *.csproj files plus Directory.Packages.props and Directory.Build.props across Orchard modules, abstractions, and templates, with richer package visibility on the solution-style tree where ScanCode stays mostly manifest-local

Ruby / PHP / Perl

composer/composer @ a2bf8cb — 17.71× faster

• Files: 1,030
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.40s; ScanCode 113.37s
• Matched Composer package coverage (40 vs 40) and dependency extraction across composer.json and composer.lock, with broader URL recovery and Unicode-preserving author/holder normalization; the remaining ScanCode edge is per-package declared_license_expression on composer.lock entries, which Provenant's lockfile parser does not yet read from each package's license field (tracked as a fix)

gitlabhq/gitlabhq @ 48dc2f5 — 48.63× faster

• Files: 65,359
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 86.65s; ScanCode 4214.01s
• Far broader dependency extraction (9383 vs 6764) across the repo-root Gemfile, the nested gemspec and Gemfile.lock tree, and mixed Go or npm sidecar manifests, with real gem versions resolved from local Ruby constants where ScanCode leaves placeholder ::VERSION literals and with GitLab export project.json fixtures kept out of NuGet output

laravel/framework @ a3960e8 — 34.46× faster

• Files: 3,139
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.06s; ScanCode 243.30s
• Matched Composer package coverage (37 vs 37) with broader dependency extraction (656 vs 498) from the committed exception-renderer package-lock.json, plus cleaner rejection of Blade-template pseudo-copyrights and author false positives such as extends Model

libwww-perl/libwww-perl @ 7420d1b — 9.49× faster

• Files: 98
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.01s; ScanCode 47.52s
• Direct CPAN package identity and broader dependency extraction (1 vs 0 packages, 44 vs 0 dependencies) from META.json prereq scopes, with repository and homepage metadata preserved from CPAN resources

mastodon/mastodon @ 95d3b70 — 39.30× faster

• Files: 10,652
• Run context: 2026-07-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 9.70s; ScanCode 381.20s
• Reads copyright and OFL-1.1/Apache-2.0 license notices embedded in the bundled .woff/.woff2/.ttf fonts (Inter, Silkscreen, Roboto) that ScanCode leaves undetected, and rejects ScanCode's author false positives mined from Ruby, SQL, and localization JSON (statuses.id, type Person, param Account, dadau(-la) Vas); both report the top-level AGPL-3.0 license from the repository LICENSE

PerlDancer/Dancer2 @ a1faa22 — 12.84× faster

• Files: 436
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.88s; ScanCode 62.68s
• Direct CPAN package identity on the root dist.ini, extra dependency visibility from the shipped skeleton Makefile.PL, plus Docker package visibility on share/docker/Dockerfile, with unresolved template placeholders kept out of CPAN names and PURLs

Plack/Plack @ b3984f1 — 9.96× faster

• Files: 275
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.22s; ScanCode 51.98s
• Direct CPAN package identity and broader dependency extraction (1 vs 0 packages, 22 vs 0 dependencies) from META.json, dist.ini, and Makefile.PL, with CPAN resource metadata preserved from the distribution manifest

rails/rails @ 27fb2a9 — 34.58× faster

• Files: 4,869
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 8.27s; ScanCode 285.98s
• Broader Ruby/Bundler package and dependency extraction (20 vs 17 packages, 899 vs 802 dependencies) from the root Gemfile, the multi-gemspec Rails component tree, and resolved RAILS_VERSION-backed gemspec versions, with real 8.2.0.alpha gem identities where ScanCode leaves literal version placeholders

rubocop/rubocop @ 4e0d642 — 23.4× faster

• Files: 2,081
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.51s; ScanCode 175.80s
• Matched top-level package coverage (1 vs 1) with much richer Ruby dependency extraction (28 vs 10) from the root Gemfile, a resolved pkg:gem/rubocop@1.86.1 identity where ScanCode leaves the unresolved RuboCop::Version::STRING constant, more-correct CC-BY-NC-4.0 README logo licensing where ScanCode overstates it as CC-BY-NC-SA-4.0, and avoidance of URL/prose/code-fragment author noise

symfony/symfony @ 5b8e0c9 — 32.12× faster

• Files: 13,294
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 26.46s; ScanCode 850.01s
• Matched split-package Composer monorepo package and dependency coverage (189 vs 189 packages, 1461 vs 1461 dependencies), with Unicode-preserving author normalization, cleaner rejection of URL-style pseudo-authors such as Tobias Schultze http://tobion.de, and more explicit proprietary-license normalization where ScanCode leaves an unknown-license bucket

Julia / Nix / Haskell / other ecosystems

commercialhaskell/stack @ cb6070f — 14.99× faster

• Files: 1,060
• Run context: 2026-06-16 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.40s; ScanCode 95.91s
• Far broader Hackage package and dependency extraction (76 vs 1 packages, 525 vs 4 dependencies) from the root stack.cabal, stack.yaml, cabal.project, and committed integration-fixture manifests, with richer maintainer identity on Cabal metadata

crystal-lang/crystal @ 82b5094 — 35.03× faster

• Files: 2,683
• Run context: 2026-07-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.79s; ScanCode 272.86s
• More correct dual-license OR expressions on the Dragonbox and Ryu float-printer ports where the source offers Apache-2.0-with-LLVM-exception alternatively with BSL-1.0, Unicode-preserving Johannes Müller holder recovery without REUSE SPDX-License-Identifier field bleed, rejection of example-name authors and git@… SSH strings as emails, safer credential-stripping URL normalization, and cleaner rejection of changelog copyright-year bump prose as copyright or holder noise

elm/compiler @ 1bd5b36 — 13.28× faster

• Files: 239
• Run context: 2026-07-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.77s; ScanCode 63.35s
• Far broader Hackage and npm package and dependency extraction (8 vs 1 packages, 74 vs 5 dependencies) from sibling elm.cabal / worker/elm.cabal manifests plus the installer package.json binary packages, with avoidance of the weak Apache-2.0 OR BSD-3-Clause false positive on terminal/src/Publish.hs LICENSE UI strings and of SPDX catalog-name license clues in Elm.Licenses.hs

HaxeFlixel/flixel @ ec54c5a — 17.08× faster

• Files: 446
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.22s; ScanCode 89.17s
• Matched Haxe package and dependency coverage on the repo-root haxelib.json, with compound LicenseRef-scancode-public-domain AND OFL-1.1 font licensing on assets/fonts/monsterrat.ttf instead of split duplicate detections and cleaner URL normalization across docs and snippets

HeapsIO/heaps @ d2992b0 — 21.42× faster

• Files: 666
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.97s; ScanCode 106.46s
• Matched Haxe package and dependency coverage on the repo-root haxelib.json, with cleaner copyright and holder recovery on hxd/fmt/fbx/Writer.hx and samples/text_res/trueTypeFont.ttf plus safer trailing-slash URL normalization

JetBrains/JetBrainsMono @ 1937130 — 24.1× faster

• Files: 159
• Run context: 2026-06-27 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.23s; ScanCode 125.87s
• Cleaner embedded font legal metadata across 120 committed .otf, .ttf, and .woff2 files: Provenant reports the exact OFL-1.1 license, the Copyright 2020 The JetBrains Mono Project Authors notice, holder, and project/OFL URLs, where ScanCode mangles the same copyright into run-on strings padded with font family and version text, plus a more accurate empty declared license on requirements.txt where ScanCode conflates detected content licenses into a declaration

jgm/pandoc @ d9838eb — 22.54× faster

• Files: 2,768
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 9.78s; ScanCode 220.43s
• Broader mixed Hackage and Nix package extraction (5 vs 0 packages, 197 vs 0 dependencies) from sibling pandoc*.cabal manifests, stack.yaml, and flake.nix / flake.lock, with explicit package identities across pandoc, pandoc-cli, pandoc-lua-engine, and pandoc-server

JuliaAcademy/DataScience @ 201f2e6 — 40.81× faster

• Files: 50
• Run context: 2026-06-18 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.68s; ScanCode 231.82s
• Direct Julia package visibility and broader dependency extraction (1 vs 0 packages, 53 vs 0 dependencies) from the root legacy v1.0-format Manifest.toml and its Project.toml, with zero scan errors where ScanCode times out after 120s on 05. Clustering.ipynb and no spurious low-confidence GPL-3.0-only detection bleeding from the binary data/face_recog_qr.mat blob

JuliaLang/julia @ afc71c2 — 40.32× faster

• Files: 1,948
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 8.96s; ScanCode 361.23s
• Direct Julia package visibility and much broader dependency extraction (115 vs 0 packages, 240 vs 0 dependencies) from stdlib, test, and nested Project.toml / Manifest.toml pairs across the tree, with richer author recovery on Julia metadata and cleaner rejection of prose-only copyright or holder noise

JuliaLang/Pkg.jl @ c96cfdf — 11.47× faster

• Files: 475
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.21s; ScanCode 59.75s
• Direct Julia package visibility and much broader dependency extraction (110 vs 0 packages, 150 vs 0 dependencies) from Project.toml, Manifest.toml, and sibling project-plus-manifest assembly across root, docs, and test fixture trees, with safer URL credential stripping in Julia metadata examples

JuliaPlots/Plots.jl @ 70f0cd7 — 13.16× faster

• Files: 324
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.80s; ScanCode 63.17s
• Direct Julia package visibility and much broader dependency extraction (7 vs 0 packages, 202 vs 0 dependencies) from sibling Project.toml files across Plots, GraphRecipes, RecipesBase, and test environments, with richer author recovery on Julia metadata or README ownership lines and safer URL normalization

nix-community/dream2nix @ 69eb01f — 6.61× faster

• Files: 515
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 9.05s; ScanCode 59.81s
• Broader Nix package extraction (39 vs 11 top-level packages) from committed flake.lock inputs and flake-compat-backed default.nix wrapper surfaces, with version-qualified purls (pkg:cargo/app@0.1.0 where ScanCode emits an unversioned identity), declared-license enrichment on the bundled npm/minimal package, and junk-URL avoidance that skips the ${info.host template interpolation ScanCode mis-extracts

NixOS/nix @ 6a659e1 — 27.06× faster

• Files: 2,917
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.81s; ScanCode 157.23s
• Broader Nix package and dependency extraction (3 vs 0 packages, 69 vs 0 dependencies) from committed flake.lock, root default.nix, and other Nix manifest surfaces, with richer structured author, email, and URL recovery across repository docs and release metadata

NixOS/nixpkgs @ c407343 — 34.14× faster

• Files: 52,167
• Run context: 2026-06-23 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 103.10s; ScanCode 3520.06s
• Broader Nix package visibility (1299 vs 737 packages) across committed Nix manifests, provider metadata, and lockfile-adjacent package surfaces, with zero scan-file errors where ScanCode fails on huge generated metadata such as hackage-packages.nix and typst-packages-from-universe.toml, and more unique dependencies (16515 vs 14431) despite a far smaller raw dependency total because ScanCode duplicates composer.lock requirements ~400× (447627 rows collapsing to 14431 unique)

numtide/devshell @ 255a2b1 — 10.23× faster

• Files: 87
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.68s; ScanCode 47.86s
• Broader Nix package and dependency extraction (5 vs 0 packages, 17 vs 0 dependencies) from committed flake.lock, root default.nix, and template flake surfaces, with cleaner structured author, copyright, and URL recovery

ocaml/dune @ b13ab94 — 36.00× faster

• Files: 7,751
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.58s; ScanCode 272.90s
• Far broader opam and Nix package visibility (257 vs 2 packages, 130 vs 116 dependencies): one pkg:opam/<name> package per opam/*.opam manifest (256, named from the filename when the manifest omits name:) plus the flake.lock package, with structured opam description, maintainer, and dependency recovery instead of ScanCode's field-bleeding author text on those manifests

ocaml/merlin @ 30b4f24 — 32.07× faster

• Files: 2,120
• Run context: 2026-06-21 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 10.87s; ScanCode 348.59s
• Broader opam and Nix package visibility (5 vs 0 packages) with broader dependency extraction (27 vs 24): one pkg:opam package per repo-root merlin*.opam, dot-merlin-reader.opam, and ocaml-index.opam manifest (4) plus the flake.lock package, with Unicode-preserving copyright normalization across the Merlin source tree

ocaml/ocaml-lsp @ 788ff73 — 17.13× faster

• Files: 546
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.79s; ScanCode 99.19s
• Broader package visibility (11 vs 1 packages) with richer dependency extraction (380 vs 376): one pkg:opam package per root and submodule .opam manifest (8) alongside the flake.lock, package.json, and vendored-submodule configure.ac packages, with cleaner maintainer and email recovery on opam metadata and Unicode-preserving copyright normalization

openfl/openfl @ 74d8f72 — 13.61× faster

• Files: 1,196
• Run context: 2026-06-20 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 10.08s; ScanCode 137.21s
• Matched Haxe package and dependency coverage on the repo-root haxelib.json, with richer bundled Windows executable identity on assets/templates/bin/openfl.exe, extra Docker package visibility on Dockerfile, and cleaner URL normalization across shipped font metadata

ponylang/ponyc @ e540a09 — 27.71× faster

• Files: 1,712
• Run context: 2026-07-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.81s; ScanCode 161.02s
• Broader Docker and submodule dependency extraction (13 vs 0) from committed CI/release Dockerfiles and .gitmodules, with rejection of workflow-filename author noise and git@github.com SSH strings as emails, plus safer credential-stripping URL normalization and repaired http:// archive URLs

univention/Nubus @ fef2258 — 8.64× faster

• Files: 16
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.94s; ScanCode 42.68s
• Direct publiccode.yml package visibility on the root metadata file (1 vs 0 on that file), with cleaner SPDX copyright placeholder normalization for Univention GmbH and the same zero-scan-error behavior under the shared profile

yesodweb/yesod @ 1b033c7 — 12.00× faster

• Files: 318
• Run context: 2026-06-15 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.86s; ScanCode 58.32s
• Broader multi-package Hackage extraction (16 vs 0 packages, 392 vs 0 dependencies) from the repo's many sibling yesod-*/*.cabal manifests, with explicit package identities across the Yesod family where ScanCode stays manifest-blind

Artifact/rootfs-backed targets

Container image layouts

hello-world multi-arch OCI image layout @ sha256:ec15384 — 6.47× faster

• Files: 73
• Run context: 2026-06-07 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 6.90s; ScanCode 44.65s
• Provenant resolves the OCI image-layout index.json into one pkg:oci/hello-world@sha256:<config-digest> identity per platform (12 vs 0 packages), following the nested image index to recover each platform's image-config digest and emitting arch, tag, and repository_url qualifiers, where ScanCode has no OCI image-layout parser and emits no package for the layout, with identical license, copyright, URL, and email detection across the layout's blob and metadata files so the package identity is the only dimension that differs; reproduce the target with skopeo copy --all docker://hello-world@sha256:ec153840d1e635ac434fab5e377081f17e0e15afab27beb3f726c3265039cfff oci:hw-oci:docker.io/library/hello-world:1.0

Linux rootfs images

Alpine 3.23.3 minirootfs @ sha256:42d0e6d — 11.59× faster

• Files: 84
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.67s; ScanCode 54.13s
• Equal top-level Alpine package coverage emitted with PURL-spec-correct pkg:apk/alpine/<name> identities (type apk, distro namespace) where ScanCode uses the non-standard pkg:alpine/<name> type, with Alpine-native installed-db dependency requirements and virtual providers preserved and cleaner BusyBox/OpenSSL binary-text normalization

Azure Linux distroless/minimal 3.0 linux/amd64 @ sha256:0c64ab9 — 8.62× faster

• Files: 1,844
• Run context: 2026-06-03 · macOS 26.5.0 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.26s; ScanCode 62.57s
• Matched Azure Linux and Mariner RPM manifest package coverage (5 vs 5) from var/lib/rpmmanifest/container-manifest-2, with RPM package-license sidecar metadata merged from /usr/share/licenses/* and direct Linux distro PURL identity on usr/lib/os-release; reproduce the linux/amd64 rootfs with skopeo copy docker://mcr.microsoft.com/azurelinux/distroless/minimal@sha256:0c64ab9cfc44d4f100c0590bd59ead9afedda6cc54f14bb7465b5f9c35ddc037 oci:azurelinux-minimal:3.0 && skopeo copy --override-os linux --override-arch amd64 docker://mcr.microsoft.com/azurelinux/distroless/minimal@sha256:0c64ab9cfc44d4f100c0590bd59ead9afedda6cc54f14bb7465b5f9c35ddc037 docker-archive:azurelinux-minimal-amd64.tar (the immutable index digest is also tagged 3.0.20260517)

lambci/lambda:provided.al2 linux/amd64 @ sha256:7765ec11 — 18.40× faster

• Files: 4,085
• Run context: 2026-06-03 · macOS 26.5.0 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 17.19s; ScanCode 316.25s
• Broader Amazon Linux 2 RPM rootfs inventory (45 vs 0 packages, 590 vs 0 dependencies) from the real Berkeley rpmdb, with YumDB sidecar provenance merged onto matching installed RPM packages under extra_data.yumdb for repository, checksum, origin, and install-reason metadata while ScanCode reports one rpmdb assembly error and leaves top-level package/dependency output empty; reproduce the rootfs with skopeo copy docker://lambci/lambda@sha256:7765ec11e11603d4123630148e115f980812c33f7ab6943c5cbfafccca0f2f17 docker-archive:lambci-lambda-provided-al2.tar (single linux/amd64 manifest)

debian:bookworm-slim @ sha256:f065376 — 18.14× faster

• Files: 3,268
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 13.31s; ScanCode 241.45s
• More correct Linux-distro identity on usr/lib/os-release (debian instead of ScanCode's incorrect distroless) with homepage, support, and bug-report URLs preserved, plus broader dependency extraction (534 vs 0) from the real dpkg/status relation fields while preserving top-level package count parity (88 vs 88)

distroless base-debian12 @ sha256:e7e678c — 12.77× faster

• Files: 1,260
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.87s; ScanCode 74.98s
• Direct Distroless Debian 12 identity on usr/lib/os-release with homepage, support, and bug-report URLs preserved despite the sparse image layout, plus broader dependency extraction (53 vs 0) from status.d and zero scan errors where ScanCode crashes on six *.md5sums companions; reproduce by pulling the pinned image (skopeo copy --override-os linux --override-arch amd64 docker://gcr.io/distroless/base-debian12@sha256:e7e678c88c59e70e105a46549bb3fbfb3d732ee3b4afd3a19fdab2e15afaa6b3 oci:base-debian12:latest) and scanning its extracted rootfs layers

Fedora Minimal 42 container rootfs @ sha256:09a2061 — 21.68× faster

• Files: 1,983
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 15.74s; ScanCode 341.28s
• Direct Fedora distro identity on usr/lib/os-release with homepage, support, and bug-report URLs preserved (the DOCUMENTATION_URL the image still ships maps to no os-release package field in either scanner), plus richer installed-RPM identities on the same 102 packages — full fedora-namespaced PURLs with complete -N.fcXX release versions (e.g. pkg:rpm/fedora/bash@5.2.37-1.fc42 vs ScanCode's namespace-less, release-truncated pkg:rpm/bash@5.2.37) — and broader dependency extraction (1744 vs 0) from the real rpmdb; reproduce by pulling the pinned image (skopeo copy --override-os linux --override-arch amd64 docker://quay.io/fedora/fedora-minimal@sha256:09a2061e2cfb85ac8e7fa7f2234d0ace6ad4f2b7dfdf0f257c90405e4f07577d oci:fedora-minimal:latest) and scanning its extracted rootfs layers

Installed package database snapshots

Alpine 3.23.3 installed DB snapshot @ sha256:42d0e6d — 9.10× faster

• Files: 2
• Run context: 2026-06-22 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.65s; ScanCode 42.30s
• Matched standalone Alpine installed-db package and license coverage (16 vs 16 packages) on the shipped lib/apk/db/installed snapshot, with one extra maintainer email recovered from package metadata; the exact bytes are archived as a fixture at testdata/alpine/benchmark-minirootfs-3.23.3/rootfs/lib/apk/db/installed (extracted via tar -xzf alpine-minirootfs-3.23.3-x86_64.tar.gz lib/apk/db/installed from the immutable release tarball), scanned as the benchmark-minirootfs-3.23.3 directory whose second file is the co-located SOURCE.md

Conda base environment conda-meta snapshot @ sha256:7de9956 — 14.7× faster

• Files: 89
• Run context: 2026-06-27 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.21s; ScanCode 76.42s
• Matched conda installed-environment package coverage (87 vs 87) from a condaforge/miniforge3 base environment, with one package per conda-meta/<pkg>.json record carrying its own license, version, and dependency identity

debian:bookworm-slim dpkg DB snapshot @ sha256:f065376 — 13.08× faster

• Files: 437
• Run context: 2026-06-22 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.21s; ScanCode 68.16s
• Matched installed Debian package coverage (88 vs 88) with broader dependency extraction (536 vs 0) from the real status relation fields, richer Debian-qualified package identities on .list and .md5sums companions, and maintainer parties preserved in package metadata instead of only generic file-author guesses

distroless base-debian13 status.d @ sha256:57c1e4c — 8.36× faster

• Files: 18
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.21s; ScanCode 43.55s
• Matched distroless Debian package coverage (9 vs 9) with broader dependency extraction (84 vs 0) from status.d relation fields, maintainer parties preserved in package metadata, and zero scan errors where ScanCode crashes on all nine *.md5sums companions; reproduce by pulling the pinned image (skopeo copy --override-os linux --override-arch amd64 docker://gcr.io/distroless/base-debian13@sha256:57c1e4c72feb5925c4763ae4f6bd2013ad3854f57eff5b60dd9acb1ce0abc66e oci:base-debian13:latest) and scanning the extracted var/lib/dpkg/status.d subtree

Fedora Minimal 42 rpmdb SQLite snapshot @ sha256:09a2061 — 24.09× faster

• Files: 3
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.66s; ScanCode 112.26s
• Matched installed-RPM package coverage on the narrow SQLite rpmdb snapshot (102 vs 102) with richer identities — full fedora-namespaced PURLs and complete -N.fcXX release versions (e.g. pkg:rpm/fedora/alternatives@1.33-3.fc42 vs ScanCode's pkg:rpm/alternatives@1.33) — plus broader dependency extraction (1744 vs 0); reproduce by pulling the pinned image (skopeo copy --override-os linux --override-arch amd64 docker://quay.io/fedora/fedora-minimal@sha256:09a2061e2cfb85ac8e7fa7f2234d0ace6ad4f2b7dfdf0f257c90405e4f07577d oci:fedora-minimal:latest) and scanning the extracted var/lib/rpm/rpmdb.sqlite plus its -shm/-wal siblings

openSUSE Tumbleweed rpmdb NDB snapshot @ sha256:224594d — 24.27× faster

• Files: 2
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.81s; ScanCode 116.72s
• Direct installed-RPM package and dependency extraction (123 vs 0 packages, 1844 vs 0 dependencies) from the real openSUSE Packages.db/Index.db NDB snapshot where ScanCode stays package-blind, with zero scan errors; the exact Packages.db/Index.db bytes are archived as a fixture at testdata/opensuse/benchmark-tumbleweed-ndb (extracted from the pinned Tumbleweed image — see the co-located SOURCE.md)

Package archives

7zip 25.01-r0 .apk @ sha256:6602ccb — 8.66× faster

• Files: 1
• Run context: 2026-06-22 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.72s; ScanCode 40.88s
• Direct Alpine archive package visibility on the shipped .apk (1 vs 1 file-level package records), with a concrete pkg:alpine/7zip@25.01-r0?arch=x86_64 identity instead of ScanCode's weaker generic package-data row; because Alpine's v3.23/main keeps only the current build per branch, the exact 25.01-r0 bytes are archived as a fixture at testdata/alpine/apk/7zip-25.01-r0/7zip-25.01-r0.apk

bash 5.2.15-2+b10 .deb @ sha256:be3ab2f — 8.75× faster

• Files: 1
• Run context: 2026-06-22 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.58s; ScanCode 40.09s
• Matched shipped Debian package coverage (1 vs 1) with broader dependency extraction (9 vs 0) from the archive control metadata, plus the correct pkg:deb arch=amd64 qualifier where ScanCode uses the nonstandard architecture key; the exact bash_5.2.15-2+b10_amd64.deb bytes are retained on the Debian snapshot archive at https://snapshot.debian.org/file/bd6a22d6918ec3e917cc5840d8ac13235220553e

FreeBSD bash 5.3.15 +COMPACT_MANIFEST @ sha256:88cea96 — 9.09× faster

• Files: 1
• Run context: 2026-06-22 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.47s; ScanCode 40.62s
• Matched FreeBSD package-manifest package coverage (1 vs 1) on the real +COMPACT_MANIFEST extracted from the shipped bash .pkg, with normalized GPL-3.0-or-later declared-license reporting and a single top-level declared-license detection instead of ScanCode's duplicated GPL row; the manifest text is committed at testdata/freebsd/benchmark-bash-5.3.15/+COMPACT_MANIFEST since FreeBSD's latest repository prunes superseded builds

Humanizer.Core 3.0.10 .nupkg @ sha256:99f9521 — 8.91× faster

• Files: 1
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.45s; ScanCode 39.63s
• Real NuGet package-archive extraction on the shipped .nupkg (1 vs 0 packages, 6 vs 0 dependencies), with a named pkg:nuget/Humanizer.Core@3.0.10 identity instead of ScanCode's generic unnamed archive row, plus an MIT license detection from modern package metadata

pkg 2.7.5 .pkg +COMPACT_MANIFEST sample @ sha256:e0f3403 — 8.93× faster

• Files: 1
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.44s; ScanCode 39.67s
• Matched FreeBSD package-manifest package coverage (1 vs 1) on the +COMPACT_MANIFEST extracted from the shipped .pkg, with normalized BSD-2-Clause declared-license reporting where ScanCode leaves the package license unknown; reproduce by downloading the current pkg.pkg and extracting its manifest (tar --zstd -xf pkg.pkg +COMPACT_MANIFEST), which is sha256:e0f340319f63bc9596a8e6b079f805ed6cc81f5a66ca19757367b4773a72358a for pkg 2.7.5

python-construct 2.10.70-6 .PKGINFO from Arch package @ sha256:2020ae3 — 8.92× faster

• Files: 1
• Run context: 2026-06-22 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.72s; ScanCode 42.12s
• Direct Arch built-package visibility on real .PKGINFO metadata (1 vs 0 file-level package records) with twenty structured dependency edges across depend, makedepend, checkdepend, and optdepend, plus an arch-qualified pkg:alpm/arch/python-construct@2.10.70-6?arch=any identity instead of a scanner-silent package file; reproduce the target by extracting .PKGINFO from the immutable python-construct-2.10.70-6-any.pkg.tar.zst (tar --zstd -xf python-construct-2.10.70-6-any.pkg.tar.zst .PKGINFO)

rubocop 1.86.1 .gem @ sha256:44415f3 — 8.63× faster

• Files: 1
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.66s; ScanCode 40.20s
• Matched shipped gem package and dependency coverage (1 vs 1 packages, 10 vs 10 dependencies), with semantically combined author/email party data and an extra parser-declared MIT license detection on the archive file itself

sudo 1.9.15-7.p5.fc42 src.rpm @ sha256:96920ba — 9.42× faster

• Files: 1
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.17s; ScanCode 39.29s
• Matched shipped source-RPM package visibility (1 vs 1) with broader dependency extraction (17 vs 0) from the archive header metadata, plus an RPM namespace-qualified source package identity and an extra ISC license detection where ScanCode stays generic

Release binaries and extracted app snapshots

Apache Tomcat 10.1.52 extracted release snapshot — 14.48× faster

• Files: 643
• Run context: 2026-06-22 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 7.00s; ScanCode 101.38s
• Broader Apache Tomcat release-tree package visibility on shipped .war and WEB-INF/web.xml surfaces (7 file-level package records vs 0), plus more complete Apache-2.0 coverage across the bundled docs/webapps tree, HTML-entity-faithful © normalization on the shipped docs footer notices, and cleaner rejection of ScanCode's weak author fragments such as the Digester, the Cluster, and the Connector

Firefox langpack en-GB 141.0.2 .xpi — 9.21× faster

• Files: 1
• Run context: 2026-06-22 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.60s; ScanCode 42.35s
• Equivalent Mozilla XPI package visibility on the shipped Firefox language-pack artifact

Firefox Multi-Account Containers 8.3.7 .xpi @ sha256:7f6f5ef — 8.90× faster

• Files: 1
• Run context: 2026-06-22 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.67s; ScanCode 41.56s
• Equivalent Mozilla XPI package visibility on the shipped Firefox add-on artifact

ILSpy v9.1 binaries x64 snapshot @ sha256:1e925a4 — 11.14× faster

• Files: 40
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 5.12s; ScanCode 57.03s
• Shipped .deps.json coverage on the extracted ILSpy release (3 vs 0 packages, 86 vs 0 dependencies), with file-level NuGet dependency visibility across ILSpy.deps.json and plugin manifests plus cleaner rejection of ScanCode's binary-text holder noise such as LegalTrademarks OriginalFilename

itchyny/gojq v0.12.19 darwin arm64 release snapshot @ sha256:40208d4 — 9.31× faster

• Files: 2
• Run context: 2026-06-22 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.91s; ScanCode 45.70s
• Embedded Go build-info package visibility on the shipped gojq binary (9 file-level package records vs 0), plus cleaner rejection of ScanCode's weak binary author false positive the Go

BurntSushi/ripgrep 14.1.1 aarch64-apple-darwin release snapshot @ sha256:24ad767 — 9.67× faster

• Files: 13
• Run context: 2026-06-22 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 4.90s; ScanCode 47.37s
• Faithful multi-license detection across the shipped ripgrep release tree — the dual MIT OR Unlicense project license plus the vendored LGPL-2.0-plus/other-copyleft and exception-bearing expressions — on a real reproducible binary-release artifact

NSIS 3.12 setup.exe — 4.90× faster

• Files: 1
• Run context: 2026-06-14 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 8.76s; ScanCode 42.90s
• Matched NSIS installer plus Windows PE package visibility (2 vs 2 file-level package records), with a concrete pkg:winexe/nsis-3.12-setup@3.12 identity on the executable metadata record and cleaner rejection of ScanCode's spurious LicenseRef-scancode-unknown license inferred only from the LegalCopyright URL

VS Code extensions extracted VSIX snapshot (Open VSX: esbenp.prettier-vscode 11.0.0, redhat.vscode-yaml 1.14.0, ms-python.python 2024.0.1) — 8.01× faster

• Files: 3,054
• Run context: 2026-07-08 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc
• Timing: Provenant 56.47s; ScanCode 452.20s
• Broader package and dependency visibility across an extracted VS Code extension tree (29 vs 3 packages, 487 vs 185 dependencies): dedicated pkg:vscode-extension/<publisher>/<id> identities for all three bundled extensions — carrying publisher, marketplace, source, and engine metadata from each extension.vsixmanifest — plus the npm and vendored-PyPI package metadata inside them that ScanCode's extension-tree model does not reach

Generated dependency lock manifests

Flask 3.1.0 pip-inspect.deplock @ sha256:2f30046 — 9.06× faster

• Files: 1
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc · generated via pip inspect (pip 26.1.2) over a venv with flask==3.1.0
• Timing: Provenant 4.46s; ScanCode 40.40s
• Matched pip-inspect deplock dependency extraction (8 vs 8 resolved dependencies) across the installed set, with PURL-identified flask and its transitive werkzeug, jinja2, click, itsdangerous, markupsafe, and blinker pins on a lockfile-style deplock package, structured author capture in the resolved package metadata, and cleaner BSD-3-Clause classification where ScanCode appends a top-level unknown-license reference; the exact deplock is archived as a fixture at testdata/python/benchmark-flask-pip-inspect/pip-inspect.deplock (see the co-located SOURCE.md)

swift-dependencies 1.9.4 swift-show-dependencies.deplock @ sha256:c03e7c7 — 9.05× faster

• Files: 1
• Run context: 2026-06-19 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc · generated via swift package show-dependencies --format json (Swift 6.3.2) on swift-dependencies@1.9.4
• Timing: Provenant 4.34s; ScanCode 39.29s
• Matched swift-show-dependencies deplock dependency extraction (17 vs 17 resolved dependencies) across the full transitive graph spanning combine-schedulers, swift-clocks, swift-concurrency-extras, swift-syntax, and sibling Point-Free packages, with safer root-package identity that leaves the local-path root PURL unset rather than minting ScanCode's namespace-less, spec-invalid pkg:swift/swift-dependencies; the exact deplock is archived as a fixture at testdata/swift/benchmark-swift-dependencies-1.9.4/swift-show-dependencies.deplock (see the co-located SOURCE.md)

Legacy NuGet manifest sets

Apress pro-html5-vs2015 legacy NuGet manifests @ 3599d94 — 8.64× faster

• Files: 22
• Run context: 2026-06-05 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc · curated set of the 11 project.json + 11 project.lock.json files from Apress/pro-html5-w-visual-studio-2015@3599d94
• Timing: Provenant 6.63s; ScanCode 57.29s
• Full legacy .NET dependency extraction (206 vs 0 dependencies across 22 vs 0 file-level package records) from DNX-era project.json manifests and resolved project.lock.json lockfiles that ScanCode leaves package-blind, including the BOM-prefixed project.json files that Visual Studio writes, with zero scan errors

Conan lockfiles

XRPLF/rippled conan.lock (v0.5) @ sha256:abec9c8 — 6.63× faster

• Files: 1
• Run context: 2026-06-05 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc · conan.lock from XRPLF/rippled@949887f
• Timing: Provenant 5.98s; ScanCode 39.67s
• Full resolved Conan 2.x lockfile extraction (35 vs 0 dependencies) from the format-0.5 requires, build_requires, and python_requires arrays that ScanCode leaves lockfile-blind, with build-time entries scoped build (non-runtime) and recipe-revision (#...) and lockfile-timestamp (%...) suffixes stripped to clean pinned versions; verified end-to-end on the full rippled repository (35 vs 0 on conan.lock)

jjbel/samarium conan.lock (v0.4) @ sha256:35e2ed9 — 6.72× faster

• Files: 1
• Run context: 2026-06-05 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc · conan.lock from jjbel/samarium@67b3c4e
• Timing: Provenant 5.96s; ScanCode 40.03s
• Resolved Conan 1.x lockfile extraction (15 vs 0 dependencies) from the legacy graph_lock.nodes graph (fmt, range-v3, stb, tl-expected, and siblings) that ScanCode leaves lockfile-blind, with recipe revisions stripped to clean versions; verified end-to-end on the full samarium repository (15 vs 0 on conan.lock)

Debian source packages

htop 3.5.1 Debian source package @ sha256:bd7b02b — 6.63× faster

• Files: 3
• Run context: 2026-06-05 · macOS 26.5.1 · Apple M5 Pro · 64 GB · arm64 · 4 proc · htop_3.5.1-3.dsc + htop_3.5.1.orig.tar.gz + htop_3.5.1-3.debian.tar.xz from the Debian archive
• Timing: Provenant 6.08s; ScanCode 40.34s
• Full Debian source-package recognition across .dsc, .orig.tar.gz, and .debian.tar.xz (3 vs 1 recognized source surfaces, each carrying the htop name and version) where ScanCode recognizes only the .dsc, plus clean structured maintainer and uploader parties where ScanCode collapses the entire control header into a single malformed author string

Benchmark conventions

Run identity and comparability

• Treat each row as a snapshot of one recorded compare-outputs run, not as a rolling claim about the current main branch.
• run-manifest.json is the source of truth for run identity: target/ref, scan profile/args, command invocations, Provenant version plus revision/dirty state/diff hash, and ScanCode runtime/cache metadata.
• Benchmark rows should record the benchmark date and the machine context. Keep the full compare-run run_id in run-manifest.json and the saved artifact path rather than surfacing it in the human-facing benchmark entry.

Timing methodology

• Use the repository-supported compare-outputs workflow with the profile that matches the recorded target: --profile common for repository-backed and ordinary artifact/rootfs targets, and --profile common-with-compiled for artifact targets where compiled-binary package extraction is part of the comparison.
• Record same-host wall-clock timings for Provenant and ScanCode, plus relative speedup.
• Record machine information per row. If run-manifest.json reports scancode.cache_hit: true, use the cached ScanCode raw timing for that target/ref/runtime. Otherwise treat both scanner timings as license-cache-cold because the maintained workflow disables persistent license-cache reuse during actual execution.

Comparison review discipline

• Treat benchmark verification as a full shared-scanner compare review, not a package-count-only check. Under --profile common, package extraction, license detection, copyright/holder/author extraction, email extraction, URL extraction, and other shared-scan behavior are all in scope.
• Treat any “more output” from either scanner as a claim to verify, not as proof by itself. Additional licenses, license-expression reshaping, copyrights, holders, authors, emails, or URLs only count as improvements when the scanned file text actually supports them.
• Fix issues where ScanCode is better than Provenant. Treat comparison_status: review_required as a triage-required signal, not an automatic failure or an automatic pass.
• When scanners disagree, inspect the underlying file text enough to decide whether the extra or missing finding is justified. Apply the same rigor to package, dependency, author, email, URL, copyright, holder, and license-expression deltas.
• Treat holders and authors as first-class verification signals, not cosmetic tail cleanup. Review repeated holder/author mismatches before calling a target complete, and treat obvious Provenant junk such as prose fragments, role labels, malformed metadata blobs, or contact-trailer pollution in holder/author fields as bugs to fix or filter generically.
• Do not count junky holder/author over-extraction as a win just because Provenant reports more names. More holder/author output is only better when the recovered identities are actually supported by the file text and are cleaner than ScanCode’s result.
• Treat top-level license-expression deltas and repeated file-level license-detection mismatches as blocking regression signals. Do not defer that review until after package or dependency counts look healthy.
• Do not treat normalization improvements as regressions when Provenant is more correct, for example preserving René instead of degrading to Rene. Parity is the bottom line, not the upper limit.
• Fixes found during compare work must be generic scanner improvements, not target-specific tuning for one benchmark repository or artifact.
• Any fixed regression or accepted behavior-shaping change should gain adequate automated coverage. Add focused parser tests, integration tests, and golden tests where those are the right durable fit.

Row ordering

• Order rows by target kind first, because that matches the maintained compare-outputs workflow split:
  1. repository-backed targets (--repo-url)
  2. artifact/rootfs-backed targets (--target-path)
• Within each target kind, use the example headings below as the canonical placement buckets—dominant ecosystem or repository shape for repository-backed targets, artifact shape for artifact/rootfs-backed targets—and sort rows alphabetically by target label within each bucket.
• If a benchmark plausibly fits several ecosystems, place it where a reader is most likely to look first based on the dominant end-state story in the final notes bullet.
• This keeps the document browsable for readers while still giving maintainers a stable, predictable placement rule for new rows.

Writing rules for the notes bullet

• Write the final notes bullet as a present-tense end-state comparison, not as implementation history.
• Lead with what Provenant does better today: broader coverage, richer identity, safer handling, cleaner normalization, more correct classification, or faster runtime.
• Do not describe the path taken to get there. Avoid process/history wording such as fixed, restored, aligned, added support, after, now that, triaged, reviewed tail, or remaining deltas.
• If a reviewed non-regression difference matters, either omit it from the final notes bullet or rewrite it as a user-visible advantage. Example: write safer URL credential stripping instead of credential deltas were triaged as acceptable.
• The bullet should still read correctly if the reader has never seen the PR, compare artifact, or debugging history.
• When a row claims much broader package or dependency counts, include a short causal explanation naming the main surfaces that drive the gap (for example uv.lock, pnpm-lock.yaml, go.work, provider pyproject.toml, or Dockerfiles). Keep it to one compact phrase, not a forensic breakdown.
• Preferred sentence shape: "Broader/richer/safer/more correct X ..., plus Y ..., with Z ...".
• Bad: Fixed nested requirements parsing and triaged the remaining tail.
• Good: Broader Python dependency extraction from uv.lock and nested requirements inputs, with safer URL credential stripping.

After adding or editing benchmark rows in this document, rerun cargo run --manifest-path xtask/Cargo.toml --bin generate-benchmark-chart so the checked-in headline stats and SVG stay in sync.