OSS Review Toolkit – automate open source compliance

OSS Review Toolkit (ORT) is a policy automation and orchestration toolkit for managing open source dependencies.

Rather than being only an SBOM generator, it provides a pipeline for discovering dependencies, retrieving source, scanning licensing information, consulting vulnerability services and evaluating the collected information against organisation-defined policies. The individual stages can be combined according to the needs of a project, making ORT particularly suitable for larger software-compliance workflows.

Results can ultimately be transformed into Software Bills of Materials, attribution documents and other reports.

This is free and open source software.

Key Features

• Analyzer determines project dependencies and associated metadata.
• Abstracts differences between supported package managers and build systems.
• Downloader retrieves source code for projects and their dependencies.
• Scanner integrates source scanners for licence and copyright detection.
• Advisor retrieves vulnerability information from configured security advisory services.
• Evaluator applies organisation-defined Policy as Code rules.
• Supports licence, security, InnerSource and engineering-standard policies.
• Reporter produces CycloneDX and SPDX Software Bills of Materials.
• Generates open source notices and other attribution documentation.
• Can create archives containing project and dependency source code.
• Allows package metadata and licence findings to be corrected or curated.
• Notifier can deliver results through channels including email and JIRA.
• Can be used as a library, command-line application or through CI integrations.
• Supports Linux as a core development platform.
• Operates as a highly customisable multi-stage compliance pipeline.

Website: github.com/oss-review-toolkit/ort
Support:
Developer: OSS Review Toolkit
License: Apache License 2.0

OSS Review Toolkit is written in Kotlin. Learn Kotlin with our recommended free books and free tutorials.

Explore our carefully curated directory of recommended free and open source software, covering every major software category. The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form.