spdx

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

🔍 ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase, the Google Summer of Code, Azure credits, nexB and others generous sponsors!

A suite of tools to automate software compliance checks.

GUAC aggregates software security metadata into a high fidelity graph database.

OpenSCA is an open source software supply chain security solution that supports the detection of open source dependencies, vulnerabilities and license compliance with a widely noticed accuracy by the community.

Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.

FOSSology is an open source license compliance software system and toolkit. As a toolkit you can run license, copyright and export control scans from the command line. As a system, a database and web ui are provided to give you a compliance workflow. License, copyright and export scanners are tools used in the workflow.

A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby

📜 Cargo plugin to generate list of all licenses for a crate 🦀

Various data formats for the SPDX License List including RDFa, HTML, Text, and JSON

Scans Software Bill of Materials (SBOMs) for security vulnerabilities

🎁 wraps all package managers with a unifying CLI

reuse is a tool for compliance with the REUSE recommendations.

Evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and VEX

A utility to generate SPDX-compliant Bill of Materials manifests

CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.

The System Package Data Exchange (SPDX) specification in Markdown and HTML formats.

Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects

CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments