The FOSSology Project: 10 Years Of License Scanning

Abstract

FOSSology is an open source project developing a Web server application and a toolkit for open source license compliance. As a toolkit it allows performing license copyright and export control scans from the command line. The FOSSology Web application provides a database and Web UI for implementing a compliance workfow. The FOSSology project published the frst version of its software in December 2007. Given this ten year anniversary of license scanning this article presents the motivation for building and using FOSSology its history and its status as of today. Because SPDX represents the de facto standard for exchanging license and copyright information about software packages an introduction to FOSSology's support for exporting and importing SPDX documents is also presented.

Efficient Prior Publication Identification for Open Source Code

“…Once the known ⊍ unknown is identified, computed SWHIDs can be used as unique keys to lookup additional information about scanned artifacts that can then be included in scanning results. Typical example of additional information returned by code scanners for open compliance are: licensing information (already available from SWH itself, detected using FOSSology [17]), software composition analysis [25] decomposition (which would need to be computed separately), software provenance [14] information (that can be tracked at the scale of SWH [28]), and known vulnerability information (available from public CVE databases, but currently lacking an open data CVE↔SWHID mapping). Once these information become available from third-party KBs, extending swh-scanner to look them up and join them with scanning results would be a simple matter of programming.…”

“…The tooling landscape 8 conducted by the Open Source Tooling Group and the OpenChain [5] curriculum 9 provide a good overview of existing tools to support automated governance of FOSS supply chains, including tools that adhere to the open compliance principle [8] (see Section 1). State-of-the-art license scanners in the field are FOSSology [17], and ScanCode (discussed in [25] together with other FOSS tools for Software Composition Analysis). Zooming out from license detection per se, several tools are used in the compliance landscape to manage the workflow of vetting open source component before production use, such as Eclipse SW360 10 as component inventory manager and the OSS Review Toolkit (ORT) 11 that provides a customizable pipeline for continuous compliance [26].…”