Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/aboutcode-org/scancode-toolkit

:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase, the Google Summer of Code, Azure credits, nexB and others generous sponsors!
https://github.com/aboutcode-org/scancode-toolkit

copyright copyright-scan cyclonedx dependencies dependency-graph license license-checking license-scan licensing open-source-licensing oss-compliance package-url packages provenance purl sbom sca software-composition-analysis spdx spdx-licenses

Last synced: 2 days ago
JSON representation

Host: GitHub
URL: https://github.com/aboutcode-org/scancode-toolkit
Owner: aboutcode-org
Created: 2015-07-01T13:43:06.000Z (over 9 years ago)
Default Branch: develop
Last Pushed: 2024-10-29T11:19:22.000Z (about 2 months ago)
Last Synced: 2024-10-29T13:18:53.975Z (about 2 months ago)
Topics: copyright, copyright-scan, cyclonedx, dependencies, dependency-graph, license, license-checking, license-scan, licensing, open-source-licensing, oss-compliance, package-url, packages, provenance, purl, sbom, sca, software-composition-analysis, spdx, spdx-licenses
Language: Python
Homepage: https://github.com/aboutcode-org/scancode-toolkit/releases/
Size: 664 MB
Stars: 2,109
Watchers: 72
Forks: 546
Open Issues: 1,098
Metadata Files:
- Readme: README.rst
- Changelog: CHANGELOG.rst
- Contributing: CONTRIBUTING.rst
- Funding: .github/FUNDING.yml
- Code of conduct: CODE_OF_CONDUCT.rst
- Roadmap: ROADMAP-ABOUTCODE.rst
- Authors: AUTHORS.rst

Awesome Lists containing this project

README

================
ScanCode toolkit
================

A typical software project often reuses hundreds of third-party packages.
License and packages, dependencies and origin information is not always easy to
find and not normalized: ScanCode discovers and normalizes this data for you.

Read more about ScanCode here: https://scancode-toolkit.readthedocs.io/.

Check out the code at https://github.com/nexB/scancode-toolkit

Discover also:

- The ScanCode.io server project here: https://scancodeio.readthedocs.io
- The ScanCode Workbench project for visualization of scancode results data:
https://github.com/nexB/scancode-workbench
- Other companion SCA projects for code origin, license and security analysis
here: https://aboutcode.org

Build and tests status
======================

We run 30,000+ tests on each commit on multiple CIs to ensure a good platform
compabitility with multiple versions of Windows, Linux and macOS.

Why use ScanCode?
=================

- As a **standalone command-line tool**, ScanCode is **easy to install**, run,
and embed in your CI/CD processing pipeline.
It runs on **Windows, macOS, and Linux**.

- ScanCode is **used by several projects and organizations** such as
the `Eclipse Foundation `_,
`OpenEmbedded.org `_,
the `FSFE `_,
the `FSF `_,
`OSS Review Toolkit `_,
`ClearlyDefined.io `_,
`RedHat Fabric8 analytics `_,
and many more.

- ScanCode detects licenses, copyrights, package manifests, direct dependencies,
and more both in **source code** and **binary** files and is considered as the
best-in-class and reference tool in this domain, re-used as the core tools for
software composition data collection by several open source tools.

- ScanCode provides the **most accurate license detection engine** and does a
full comparison (also known as diff or red line comparison) between a database
of license texts and your code instead of relying only on approximate regex
patterns or probabilistic search, edit distance or machine learning.

- Written in Python, ScanCode is **easy to extend with plugins** to contribute
new and improved scanners, data summarization, package manifest parsers, and
new outputs.

- You can save your scan results as **JSON, YAML, HTML, CycloneDX or SPDX** or
even create your own format with Jinja templates.

- You can also organize and run ScanCode server-side with the
companion `ScanCode.io web app `_
to organize and store multiple scan projects including scripted scanning pipelines.

- ScanCode output data can be easily visualized and analysed using the
`ScanCode Workbench `_ desktop app.

- ScanCode is **actively maintained**, has a **growing users and contributors
community**.

- ScanCode is heavily **tested** with an automated test suite of over **20,000 tests**.

- ScanCode has an extensive and growing documentation.

- ScanCode can process packages, build manifest and lockfile formats to collect
Package URLs and extract metadata: Alpine packages, BUCK files, ABOUT files,
Android apps, Autotools, Bazel, JavaScript Bower, Java Axis, MS Cab,
Rust Cargo, Cocoapods, Chef Chrome apps, PHP Composer and composer.lock,
Conda, CPAN, Debian, Apple dmg, Java EAR, WAR, JAR, FreeBSD packages,
Rubygems gemspec, Gemfile and Gemfile.lock, Go modules, Haxe packages,
InstallShield installers, iOS apps, ISO images, Apache IVY, JBoss Sar,
R CRAN, Apache Maven, Meteor, Mozilla extensions, MSI installers,
JavaScript npm packages, package-lock.json, yarn.lock, NSIS Installers,
NuGet, OPam, Cocoapods, Python PyPI setup.py, setup.cfg, and
several related lockfile formats, semi structured README
files such as README.android, README.chromium, README.facebook, README.google,
README.thirdparty, RPMs, Shell Archives, Squashfs images, Java WAR, Windows
executables and the Windows registry
and a few more. See `all available package parsers `_
for the exhaustive list.

See our `roadmap `_
for upcoming features.

Documentation
=============

The ScanCode documentation is hosted at
`scancode-toolkit.readthedocs.io `_.

If you are new to visualization of scancode results data, start with our
`newcomer `_ page.

If you want to compare output changes between different versions of ScanCode,
or want to look at scans generated by ScanCode, review our
`reference scans `_.