🔍 ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase, the Google Summer of Code, Azure credits, nexB and others generous sponsors!

Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.

🎁 wraps all package managers with a unifying CLI

reuse is a tool for compliance with the REUSE recommendations.

The SPDX specification in Markdown and HTML formats.

CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments

A Python library to parse, validate and create SPDX documents.

ScanCode.io is a server to script and automate software composition analysis pipelines with ScanPipe pipelines. This project is sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ Google Summer of Code, nexB and others generous sponsors!

Python implementation of OWASP CycloneDX

Utility library to parse, normalize and compare License expressions for Python using a boolean logic engine. For expressions using SPDX or any other license id scheme.

Check SPDX SBOM for NTIA minimum elements

See who wrote each line of code in your git repository with interactive reports.

A tool to match license text with SPDX license list using a an algorithm with finds close matches. It follows SPDX Matching guidelines to keep the substantial text as well as ignore the replaceable text for matching purposes.

A tool to generate a SBOM (Software Bill of Materials) for an installed Python module

This tool compares two Software Bill of Materials (SBOMs) and reports the differences.

Creates CycloneDX Software Bill of Materials (SBOM) documents for C/C++ projects using Conan

Automate open source license compliance and ensure software supply chain integrity

Modular framework for file information extraction and dependency analysis to generate accurate SBOMs

Generates SBOM files from system packaging information

Library to ingest and generate SBOMs