spdx

anchore/syft

+71

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

guacsec/guac

+13

GUAC aggregates software security metadata into a high fidelity graph database.

cdxgen/cdxgen

+6

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server

ort

+3

A suite of tools to automate software compliance checks.

scancode-toolkit

+3

:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!

purl-spec

+2

A minimal specification for purl aka. a package "mostly universal" URL, join the discussion at https://gitter.im/package-url/Lobby

fossology

+2

FOSSology is an open source license compliance software system and toolkit. As a toolkit you can run license, copyright and export control scans from the command line. As a system, a database and web ui are provided to give you a compliance workflow. License, copyright and export scanners are tools used in the workflow.