spdx

There are 4 repositories under spdx topic.

syft
anchore / syft
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
containers cyclonedx docker go golang hacktoberfest oci sbom spdx static-analysis tool
Language:Go 5437
nexB / scancode-toolkit
:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase, the Google Summer of Code, Azure credits, nexB and others generous sponsors!
license copyright packages dependencies spdx provenance license-scan copyright-scan licensing spdx-licenses open-source-licensing oss-compliance license-checking software-composition-analysis purl package-url sbom sca cyclonedx dependency-graph
Language:Python 1969
ort
oss-review-toolkit / ort
A suite of tools to automate software compliance checks.
license-scan package-scan package-manager dependencies dependency-graph license copyright spdx copyright-scan compliance license-checking oss-compliance license-management sbom sbom-generator open-source-licensing ospo cyclonedx sca hacktoberfest
Language:Kotlin 1473
XmirrorSecurity / OpenSCA-cli
OpenSCA is an open source software supply chain security solution that supports the detection of open source dependencies, vulnerabilities and license compliance with a widely noticed accuracy by the community.
sca devsecops security sbom software-bill-of-materials software-composition-analysis software-supply-chain software-supply-chain-security static-analysis vulnerabilities license-compliance cyclonedx spdx swid
Language:Go 997
tern-tools / tern
Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.
compliance containers dependencies docker metadata-extraction open-source oss-compliance python risk-management sbom software-composition-analysis spdx supply-chain-security tool
Language:Python 930
fossology / fossology
FOSSology is an open source license compliance software system and toolkit. As a toolkit you can run license, copyright and export control scans from the command line. As a system, a database and web ui are provided to give you a compliance workflow. License, copyright and export scanners are tools used in the workflow.
fossology spdx license-management license compliance oss license-checking license-scan compliance-check compliance-automation spdx-licenses
Language:PHP 749
package-url / purl-spec
A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby
purl package-url package url cyclonedx dependencies package-management sbom spdx
609
EmbarkStudios / cargo-about
📜 Cargo plugin to generate list of all licenses for a crate 🦀
cargo cargo-plugin hacktoberfest license-checking licensing rust rust-lang spdx
Language:Rust 479
spdx / license-list-data
Various data formats for the SPDX License List including RDFa, HTML, Text, and JSON
spdx rdfa html-format json licenses licensing
Language:HTML 468
bomber
devops-kung-fu / bomber
Scans Software Bill of Materials (SBOMs) for security vulnerabilities
cyclonedx devsecops golang gomodule oss sbom security security-automation security-tools spdx supply-chain supplychain syft vulnerability-scanners
Language:Go 449
fsfe / reuse-tool
reuse is a tool for compliance with the REUSE recommendations.
python copyright licensing linter reuse analyzer fsfe spdx free-software sbom
Language:Python 342
specification
CycloneDX / specification
OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and VEX
bill-of-materials bom software spdx cpe software-security license software-bill-of-materials sbom cyclonedx swid owasp supply-chain standard specification saasbom vex mbom machine-learning cbom
Language:XSLT 324
bom
kubernetes-sigs / bom
A utility to generate SPDX-compliant Bill of Materials manifests
bom go golang kubernetes sbom spdx
Language:Go 294
chainloop-dev / chainloop
Chainloop is an Open Source Metadata Vault for your Software Supply Chain metadata, SBOMs, VEX, SARIF files, QA reports, and more.
compliance cyclonedx devsecops sbom sbom-distribution security spdx supply-chain-security metadata-platform sbom-discovery license open-source-licensing ospo oss-compliance regulated-industry attestation in-toto slsa slsa-provenance
Language:Go 292
cyclonedx-maven-plugin
CycloneDX / cyclonedx-maven-plugin
Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects
bom spdx maven maven-plugin bill-of-materials software-bill-of-materials package-url purl sbom cyclonedx owasp sbom-generator obom mbom saasbom vex
Language:Java 270
spdx / spdx-spec
The SPDX specification in MarkDown and HTML formats.
spdx specification software-package-data-exchange licenses linux-foundation
Language:HTML 266
cyclonedx-cli
CycloneDX / cyclonedx-cli
CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.
bom bill-of-materials software-bill-of-materials purl package-url sbom cyclonedx spdx owasp sbom-generator obom mbom saasbom vex hacktoberfest
Language:C# 249
src-d / go-license-detector
Reliable project licenses detector.
spdx-license spdx-licenses spdx license-scan license-management
Language:Go 234
cyclonedx-python
CycloneDX / cyclonedx-python
CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments
python pip bom sbom spdx bill-of-materials software-bill-of-materials package-url purl cyclonedx owasp sbom-generator python3 poetry conda requirements environment sbom-tool
Language:Python 203
raftario / licensor
write licenses to stdout
spdx license licensing cli
Language:Rust 189
spdx / tools-python
A Python library to parse, validate and create SPDX documents.
licensing parsing python rdf spdx
Language:Python 159
cyclonedx-dotnet
CycloneDX / cyclonedx-dotnet
Creates CycloneDX Software Bill of Materials (SBOM) from .NET Projects
bom spdx dotnet dotnet-core bill-of-materials software-bill-of-materials package-url purl sbom cyclonedx owasp sbom-generator hacktoberfest obom mbom saasbom vex
Language:C# 158
cyclonedx-gradle-plugin
CycloneDX / cyclonedx-gradle-plugin
Creates CycloneDX Software Bill of Materials (SBOM) from Gradle projects
bom spdx gradle gradle-plugin bill-of-materials software-bill-of-materials package-url purl sbom cyclonedx owasp sbom-generator
Language:Java 136
interlynk-io / sbomqs
SBOM quality score - Quality metrics for your sboms
golang cyclonedx spdx sbom sbom-examples sbom-tool go sbom-quality sbom-score sbom-samples devsecops-pipeline security-tools supply-chain-security
Language:Go 130
spdx / tools
SPDX Tools
spdx license-management
Language:Java 120
boyter / lc
licensechecker (lc) a command line application which scans directories and identifies what software license things are under producing reports as either SPDX, CSV, JSON, XLSX or CLI Tabular output. Dual-licensed under MIT or the UNLICENSE.
golang go license spdx command-line-tool commandline cli licensechecker license-management classifier open-source-licensing
Language:Go 117
nexB / scancode.io
ScanCode.io is a server to script and automate software composition analysis pipelines with ScanPipe pipelines. This project is sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ Google Summer of Code, nexB and others generous sponsors!
sca software-composition-analysis open-source license scancode docker virtual-machine cyclonedx package-url purl spdx vulnerabilities foss-compliance
Language:Python 88
sindresorhus / spdx-license-list
List of SPDX licenses
spdx spdx-licenses javascript json list nodejs
Language:JavaScript 88
yohangz / packer-cli
:boom: Full-fledged CLI tool to generate and package node modules compliant with Browser and NodeJS. Packer CLI support all modern style, unit test and script transpiler tools
babel build-tool eslint gulp handlebars istambul jasmine jest jsdom less mocha nodejs reactjs rollupjs sass spdx stylelint stylus tslint typescript
Language:HTML 87
cyclonedx-rust-cargo
CycloneDX / cyclonedx-rust-cargo
Creates CycloneDX Software Bill of Materials (SBOM) from Rust (Cargo) projects
bom spdx rust cargo cargo-plugin bill-of-materials software-bill-of-materials package-url purl sbom cyclonedx owasp sbom-generator obom mbom saasbom vex
Language:Rust 74
cyclonedx-core-java
CycloneDX / cyclonedx-core-java
CycloneDX SBOM Model and Utils for Creating and Validating BOMs
bom spdx bill-of-materials software-bill-of-materials package-url purl sbom cyclonedx owasp obom mbom saasbom vex
Language:Java 68
hashicorp / copywrite
Automate copyright headers and license files at scale
compliance copyright licensing oss spdx
Language:Go 64
CycloneDX / sbom-utility
Utility that provides an API platform for validating, querying and managing BOM data
sbom bom cyclonedx sbom-tool spdx spdx-sbom vex spdx-license bill-of-materials hacktoberfest mbom obom owasp package-url purl saasbom software-bill-of-materials vdr sbom-quality
Language:Go 61
opensource-jp / licenses
Japanese reference translations of the OSI approved open source licenses
opensource license japanese-translations japanese spdx licenses opensource-jp
Language:HTML 56
cyclonedx-python-lib
CycloneDX / cyclonedx-python-lib
Python implementation of OWASP CycloneDX
python owasp bom spdx bill-of-materials software-bill-of-materials purl package-url sbom cyclonedx python-library obom mbom saasbom vex software-library attestation cbom
Language:Python 55
opossum-tool / OpossumUI
A light-weight app to audit and inventory large codebases for open source license compliance.
codescan copyright-scan license-scan oss-compliance package-dependency remediation software-bill-of-materials software-composition-analysis spdx
Language:TypeScript 55

spdx

anchore / syft

nexB / scancode-toolkit

oss-review-toolkit / ort

XmirrorSecurity / OpenSCA-cli

tern-tools / tern

fossology / fossology

package-url / purl-spec

EmbarkStudios / cargo-about

spdx / license-list-data

devops-kung-fu / bomber

fsfe / reuse-tool

CycloneDX / specification

kubernetes-sigs / bom

chainloop-dev / chainloop

CycloneDX / cyclonedx-maven-plugin

spdx / spdx-spec

CycloneDX / cyclonedx-cli

src-d / go-license-detector

CycloneDX / cyclonedx-python

raftario / licensor

spdx / tools-python

CycloneDX / cyclonedx-dotnet

CycloneDX / cyclonedx-gradle-plugin

interlynk-io / sbomqs

spdx / tools

boyter / lc

nexB / scancode.io

sindresorhus / spdx-license-list

yohangz / packer-cli

CycloneDX / cyclonedx-rust-cargo

CycloneDX / cyclonedx-core-java

hashicorp / copywrite

CycloneDX / sbom-utility

opensource-jp / licenses

CycloneDX / cyclonedx-python-lib

opossum-tool / OpossumUI