CLI tool and library for generating a Software Bill of Materials from container images and filesystems
-
Updated
Aug 16, 2024 - Go
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
🔍 ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase, the Google Summer of Code, Azure credits, nexB and others generous sponsors!
A suite of tools to automate software compliance checks.
OpenSCA is an open source software supply chain security solution that supports the detection of open source dependencies, vulnerabilities and license compliance with a widely noticed accuracy by the community.
Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.
FOSSology is an open source license compliance software system and toolkit. As a toolkit you can run license, copyright and export control scans from the command line. As a system, a database and web ui are provided to give you a compliance workflow. License, copyright and export scanners are tools used in the workflow.
A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby
📜 Cargo plugin to generate list of all licenses for a crate 🦀
Scans Software Bill of Materials (SBOMs) for security vulnerabilities
🎁 wraps all package managers with a unifying CLI
OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and VEX
Chainloop is an Open Source evidence store for your Software Supply Chain attestations, SBOMs, VEX, SARIF, CSAF files, QA reports, and more.
CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.
Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects
The SPDX specification in MarkDown and HTML formats.
Reliable project licenses detector.
CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments
Add a description, image, and links to the spdx topic page so that developers can more easily learn about it.
To associate your repository with the spdx topic, visit your repo's landing page and select "manage topics."