spdx 开源项目推荐（512 个）

anchore /syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

aboutcode-org /scancode-toolkit

🔍 ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!

oss-review-toolkit /ort

A suite of tools to automate software compliance checks.

guacsec /guac

GUAC aggregates software security metadata into a high fidelity graph database.

XmirrorSecurity /OpenSCA-cli

OpenSCA is an open source software supply chain security solution that supports the detection of open source dependencies, vulnerabilities and license compliance with a widely noticed accuracy by the community.

package-url /purl-spec

A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby

cdxgen /cdxgen

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server

fossology /fossology

FOSSology is an open source license compliance software system and toolkit. As a toolkit you can run license, copyright and export control scans from the command line. As a system, a database and web ui are provided to give you a compliance workflow. License, copyright and export scanners are tools used in the workflow.

tern-tools /tern

Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.

licensee /licensee

用于检测项目以何种许可证分发的 Ruby Gem。

EmbarkStudios /cargo-about

📜 Cargo plugin to generate list of all licenses for a crate 🦀

spdx /license-list-data

Various data formats for the SPDX License List including RDFa, HTML, Text, and JSON

kdeldycke /meta-package-manager

🎁 snapshot every package on your machine to one file, restore it on a new one

devops-kung-fu /bomber

Scans Software Bill of Materials (SBOMs) for security vulnerabilities

chainloop-dev /chainloop

Agentic SDLC infrastructure. Define guardrails. Collect signals. Enforce continuously. Signed records of what your AI coding agents and CI/CD pipelines did, checked against policies as code, with the loop closed in CI/CD. AI sessions, SBOMs, VEX, SARIF and SLSA provenance, built on Sigstore and in-toto. Apache 2.0.

fsfe /reuse-tool

This is a mirror of https://codeberg.org/fsfe/reuse-tool

CycloneDX /specification

OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and VEX

CycloneDX /cyclonedx-cli

CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.

kubernetes-sigs /bom

A utility to generate SPDX-compliant Bill of Materials manifests

CycloneDX /cyclonedx-python

CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments