Best practices for homepage_url in rules

[armijnhemel]

Currently the homepage_url attribute in scancode rules can point to an arbitrary URL, but typically is pointing to some Git URL. This Git URL often points to the main or master branch, which is a moving target, as it can change. I would suggest to instead require that homepage_url points to a specific commit to prevent things no longer being in sync.

An example:

https://scancode-licensedb.aboutcode.org/bear-blog-2.0.html

homepage_url points to https://github.com/HermanMartinus/bearblog/blob/master/LICENSE.md but could also have pointed to: https://github.com/HermanMartinus/bearblog/blob/998e87263248d21c8c5b967de0047b0cdf4dc11c/LICENSE.md

This URL, unless the commit is deleted, would never change, whereas the current one (pointing to master) actually can change. To remedy URLs being deleted I would recommend making a copy in the Internet Archive, or to use some sort of identifier from Software Heritage (and these are not mutually exclusive).

[dikshaa2909]

Hi, I’d like to work on this. My plan is to replace homepage_url references that point to moving branches (master/main) with commit-specific URLs to ensure reproducibility.