OpenSCA is an open source software supply chain security solution that supports the detection of open source dependencies, vulnerabilities and license compliance with a widely noticed accuracy by the community.

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

A suite of tools to automate software compliance checks.

The Continuous Clearing Tool scans and collects the 3rd party OSS components used in a NPM/NuGet/Debian/Maven/Python/Conan/Aipine project and uploads it to SW360 and Fossology by accepting respective project ID for license clearing.

Chainloop is an Open Source evidence store for your Software Supply Chain attestations, SBOMs, VEX, SARIF, CSAF files, QA reports, and more.

SBOM quality score - Quality metrics for your sboms

Public website cyclonedx.org

CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments

Modular framework for SBOM generation that gathers file information and analyzes dependencies

Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server. Slack: https://cyclonedx.slack.com/archives/C04NFFE1962

A vulnerability scanner for container images and filesystems

🔍 ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase, the Google Summer of Code, Azure credits, nexB and others generous sponsors!

Genealogos, a Nix sbom generator

Nix CycloneDX Software Bills of Materials (SBOMs)

Enrich SBOMs with data from third party services

Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

Your Comprehensive Vulnerability Management Tool

Library to ingest and generate SBOMs

nix2sbom extracts the SBOM (Software Bill of Materials) from a Nix derivation

Python implementation of OWASP CycloneDX