ProvenantComparison · reproducible
Speed is easy to show. We measured quality too.
A faster scanner is only useful if it's still right. So we ran Provenant and ScanCode on the same well-known repositories, reduced both outputs to their actual findings, and compared them line by line — then annotated every difference that matters.
19.7×
median & geometric-mean speedup (254 / 254 runs)
9→37×
grows with size (sub-100 → 10k+ files)
70.7×
fastest measured (CPython)
How this was measured. Both scanners run on identical checkouts at pinned commits, with the same scan profile, through Provenant's
compare-outputs tool. It reduces each scan to normalized per-file findings, diffs them, and classifies every difference by direction. Speed figures are from docs/BENCHMARKS.md. The quality figures below come from a run on the current build (Provenant 0.2.8) at the commit noted, refreshed on each stable release.curl github.com/curl/curl
The reference and Provenant agree on nearly every license conclusion. Where they diverge on copyright, Provenant is the more faithful of the two.
4,266
files compared
99.9%
identical license detection (trust baseline)
526
files where PV keeps the full copyright line
verbatim
non-ASCII names & punctuation preserved
Copyright fidelity
Keeps the whole copyright line
ScanCodeCopyright (c) Daniel Stenberg, <daniel@haxx.se>×800 files
ProvenantCopyright (c) Daniel Stenberg, <daniel@haxx.se>, et al. SPDX-License-Identifier: curl×526 files
lib/url.c * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al. * * SPDX-License-Identifier: curl
ScanCode drops the “, et al.” — which signals that other copyright holders exist — and the trailing SPDX identifier. Provenant reports the header line as written.
Copyright fidelity
Preserves non-ASCII names
ScanCodeCopyright (c) Bjorn Stenberg, <bjorn@haxx.se>“Bjorn”
ProvenantCopyright (c) Björn Stenberg, <bjorn@haxx.se>“Björn”
lib/mqtt.c:9 * Copyright (C) Björn Stenberg, <bjorn@haxx.se>
The source spells the author Björn. ScanCode ASCII-folds it to Bjorn; Provenant keeps the name exactly as written — the difference between attributing a person correctly or not.
repo curl/curl @ 2bb5c9b · profile -clupe --system-package --strip-root · provenant 0.2.8 · reference ScanCode Toolkit · refreshed at each stable release
Redis github.com/redis/redis
The two agree on Redis's licenses overall. Where they differ, it's Provenant reporting the license a file actually carries — and not the ones it doesn't.
1,801
files compared
0
real licenses Provenant fails to report (verified)
16
BSD files ScanCode also tags AGPL/SSPL/…
26
files where PV drops an unresolved “unknown license”
Reports the actual license
A BSD file, read as BSD
ScanCodebsd-new AND agpl-3.0 AND mongodb-sspl-1.0 AND rsalv2 AND gpl-1.0-plus AND (agpl-3.0-plus OR apache-2.0) … (12 licenses)×16 files
Provenantbsd-new×16 files
deps/jemalloc/test/include/test/SFMT.h * Copyright (c) 2006,2007 Mutsuo Saito, Makoto Matsumoto and Hiroshima University. * Redistribution and use in source and binary forms … are permitted provided that * the following conditions are met … [standard 3-clause BSD]
The vendored jemalloc SFMT files are BSD-3-Clause (Saito & Matsumoto, Hiroshima University). ScanCode's expression also pulls in AGPL, SSPL, RSALv2, Apache and GPL — none of which apply; Provenant reports the license the file actually carries.
Drops unresolved noise
No “unknown license reference” cruft
ScanCodeBSD-3-Clause AND LicenseRef-scancode-unknown-license-reference×26 files
ProvenantBSD-3-Clause×26 files
deps/tre/lib/regcomp.c This software is released under a BSD-style license. See the file LICENSE for details and copyright.
The TRE regex files point to a sibling
LICENSE file. ScanCode records that pointer as an unresolved unknown-license-reference and ANDs it onto the real license; Provenant resolves the file to BSD-3-Clause and leaves it clean.No duplicate detections
Says AGPL once, not many times
ScanCodea separate agpl-3.0 detection for every prose mentionREADME, CONTRIBUTING…
Provenantagpl-3.0 once per file (same conclusion)1× / file
README.md … Version 8.0.x and subsequent releases are subject to the tri-license RSALv2/SSPLv1/AGPLv3 at your option as referenced in the LICENSE.txt file.
Redis's docs name the “RSALv2/SSPLv1/AGPLv3” tri-license as prose several times. ScanCode emits a detection for each mention; Provenant reports AGPL once — the file's license conclusion is identical, with less repetition to review.
repo redis/redis @ 5b5c326 · profile -clupe --system-package --strip-root · provenant 0.2.8 · reference ScanCode Toolkit · refreshed at each stable release
tokio github.com/tokio-rs/tokio
Both scanners find the same packages. Only Provenant knows which of the workspace's crates owns each file.
862
files compared
10
workspace crates resolved (identical both sides)
50
files PV attributes to an owning crate; ScanCode leaves unowned
0
package or dependency identities missed
Monorepo-aware inventory
Which crate owns this file?
ScanCodebenches/copy.rs → (no package owner)unowned
Provenantbenches/copy.rs → pkg:cargo/benchesowned
Cargo.toml (workspace root)[workspace] members = ["tokio", "tokio-util", "tokio-stream", "tokio-macros", "tokio-test", "benches", "examples", "stress-test", …]
tokio is a Cargo workspace of 10 crates sharing one lockfile. Provenant resolves the workspace and attributes each nested source to the crate that owns it (here
benches/ → the benches member); across the workspace it links 50 files ScanCode leaves with no package owner. That file→package graph is what turns a flat list of detections into a per-component inventory — which package each finding actually belongs to.repo tokio-rs/tokio @ f2189d3 · profile -clupe --system-package --strip-root · provenant 0.2.8 · reference ScanCode Toolkit · refreshed at each stable release
These are three worked examples from a much larger benchmark set. The full timing table across 254 recorded runs — with every commit pinned — lives in docs/BENCHMARKS.md, and every comparison here can be reproduced with the compare-outputs tool in the repository.
Provenant is an independent project, not affiliated with or endorsed by nexB Inc. or the AboutCode project. ScanCode is a trademark of nexB Inc. Comparative figures are drawn from reproducible scans on the commits noted above, for factual comparison.