CLI tool and library for generating a Software Bill of Materials from container images and filesystems

GUAC aggregates software security metadata into a high fidelity graph database.

OpenSCA is an open source software supply chain security solution that supports the detection of open source dependencies, vulnerabilities and license compliance with a widely noticed accuracy by the community.

Scans Software Bill of Materials (SBOMs) for security vulnerabilities

Evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

A utility to generate SPDX-compliant Bill of Materials manifests

Reliable project licenses detector.

SBOM quality score - Quality metrics for your sboms

licensechecker (lc) a command line application which scans directories and identifies what software license things are under producing reports as either SPDX, CSV, JSON, XLSX or CLI Tabular output. Dual-licensed under MIT or the UNLICENSE.

Utility that provides an API platform for validating, querying and managing BOM data

Format agnostic SBOM tooling

Automate copyright headers and license files at scale

SBOM Assembler - A tool to edit SBOM or assemble multiple sboms into a single sbom.

Golang library for listing and looking up licenses using SPDX IDs.

SBOM Grep - search through SBOMs

Tool to inspect and push and SPDX document as an OCI artifact

Inspect and push SBOMs (such as SPDX documents) to an OCI registry as an OCI artifact

The package parses SPDX license expression strings describing license terms.

A simple Golang library that contains license information from SPDX.

DEPRECATED; use spdx/tools-golang