How I reproduced FFXVI's OSS License File
Tags: opensource, gaming, finalfantasy, fossa
Published: 2023-09-13 20:23:45

If you're playing Final Fantasy 16 or have finished playing it, have you noticed [its license file](https://www.youtube.com/shorts/upOlWzI2jlQ) in the settings? What if you can reproduce the notice file automatically? Here's how I did it by using FOSSA, which is an open source management product that can actually generate copyright notices files and SBOMs.

### How did I start

I scraped the list of open source packages by hand:

- [Fast C++ CSV Parser](https://github.com/ben-strasser/fast-cpp-csv-parser)
- [Flatbuffers](https://github.com/google/flatbuffers)
- [Harfbuzz](https://github.com/harfbuzz/harfbuzz)
- [DirectXTex](https://github.com/microsoft/Directxtex)
- [Vulkan Headers](https://github.com/khronosgroup/vulkan-headers)
- [Eigen](https://github.com/libigl/eigen)

As mentioned, I used [FOSSA](https://fossa.com/), which is a SCA scanning tool that can basically scan for open source dependencies for compliance and security. FOSSA has a way to map open source packages to a [custom dependencies file](https://github.com/fossas/fossa-cli/blob/master/docs/references/files/fossa-deps.md) called `fossa-deps`, which can either be a `yaml` or `json`. In a `fossa-deps` file, dependencies can be specified as a `referenced-dependency`, among other formats. Since these open source packages were scraped and not necessarily parsed by [FOSSA's strategies](https://github.com/fossas/fossa-cli/tree/master/docs/references/strategies), I've setup a `fossa-deps.json` to map these out! This is what it looks like:

```
{
  "referenced-dependencies": [
    {
      "type": "git",
      "name": "https://github.com/ben-strasser/fast-cpp-csv-parser"
    },
    {
      "type": "git",
      "name": "https://github.com/google/flatbuffers"
    },
    {
      "type": "git",
      "name": "https://github.com/harfbuzz/harfbuzz"
    },
    {
      "type": "git",
      "name": "https://github.com/microsoft/Directxtex"
    },
    {
      "type": "git",
      "name": "https://github.com/khronosgroup/vulkan-headers"
    },
    {
      "type": "git",
      "name": "https://github.com/libigl/eigen"
    }
  ]
}
```

### How to run a FOSSA scan
To run a FOSSA scan, you'll need to sign up for a free acount and generate an access token via your [account settings](https://docs.fossa.com/docs/api-reference). From there, I followed these steps:
- Export FOSSA access token in shell environment.
- `cd` to root of project, where `fossa-deps.json` should be.
- Run `fossa analyze`.
- Wait for a FOSSA report link to appear in the output.
- Access the report link and review the results.

This is what the dependencies list looks like in FOSSA. Do note that vulnerability results come with a premium subscription to FOSSA.


![Dependencies tab in FOSSA](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/66l0jcg7jpj68k72m0ej.png)



### Generating a FOSSA attribution report
In order to generate a FOSSA attribution report, click on the  Reports tab and pick your export format. Here's what that would look like in the UI:


![Reports tab in FOSSA](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vhjhg8ngafzgaugrpqvg.png)

You can actually customise the information in the report. If the report looks good to you (after any customisations), you can generate a report by clicking on the `Download Report` button.

Here's a live compliance report that can be generated from the Summary tab: 
https://app.fossa.com/reports/cf26a84d-fd9a-41ed-8f7f-1728a97b92e3


![Summary tab in FOSSA](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/q082qzgjtmbzkweyafb3.png)

### Thoughts

This was a pretty cool side project to do, where the OSS License file can be regenerated by using FOSSA. The FOSSA report actually has some similarities to Square Enix's version (obivously!), but there are some discovered licenses that are interesting to look into, provided that FOSSA did a thorough license detection on the supplied packages.  The GitHub repository linked below displays the exact reproduction steps in a playful way, for those that want a fun way to delve into the FFXVI world again while we wait for paid DLCs and extra content from Square Enix's Creative Business Unit III! 

Feel free to comment below on any questions/feedback!

### Reference

Here's the [GitHub repository](https://github.com/cmboling/final-fantasy-xvi-fossafied-notice) where you can try it out yourself!