Software license list

AboutLibraries is an open-source license compliance tool designed to collect, validate, and display third-party library licenses within software projects. It functions as a system for gathering dependency metadata at compile time and validating those libraries against a list of approved licenses to ensure legal compliance. The project provides a license validation engine that can enforce compliance by halting the build process when unauthorized licenses are detected. It also includes a set of visual components for rendering dependency and funding information within a user interface for third-

This project provides a set of reference tools and guides designed to help developers select and compare legal licenses for software and content. It includes an open source license selector and a compliance guide that explains copyright and the legal implications of publishing code without a license. The resource includes a legal license comparison tool for evaluating permissions, conditions, and limitations, as well as a directory for non-software licenses applicable to datasets, media, fonts, and hardware designs. It also provides a multi-license compatibility reference to manage mixed lice

ScanCode Toolkit is a software composition analysis tool and scanning framework designed to identify open-source licenses and copyright statements in source code and binary files. It functions as an open-source license detector, a dependency vulnerability scanner, and a generator for standardized software bills of materials in SPDX and CycloneDX formats. The project is built as a plugin-based scanning framework, allowing the integration of custom detection logic, specialized analyzers, and modified scanning behaviors at runtime. It distinguishes itself through the ability to produce formal le

osv-scanner is a software composition analysis tool and vulnerability scanner that checks project dependencies and container images against the Open Source Vulnerabilities database. It functions as a dependency remediation tool and can be integrated into custom Go applications as a programmable security library. The project distinguishes itself through a remediation workflow that includes an interactive terminal user interface and automated scripting for upgrading vulnerable packages in lockfiles and manifests. It employs call-graph reachability analysis to determine if vulnerable code is act

Snipe-IT is an open-source, web-based inventory management system designed to track organizational assets and digital resources. It functions as a centralized platform for maintaining detailed records of hardware, software licenses, and equipment assignments, providing a structured environment for managing company resources. The system specializes in hardware lifecycle tracking, covering the entire journey of physical equipment from initial procurement and deployment to maintenance, repairs, and eventual retirement. It also includes dedicated functionality for software license compliance, all

Dependency-Track is a software composition analysis tool and vulnerability management system designed to track dependencies and supply chain risk. It functions as a platform for ingesting and analyzing CycloneDX software bills of materials to identify known vulnerabilities and license compliance issues within third-party software components. The system distinguishes itself by mirroring external vulnerability databases locally to enable fast offline analysis and using VEX documents to differentiate between technical vulnerabilities and actual contextual risks. It also integrates with identity

Licensed is a command-line utility for auditing open-source dependencies and validating compliance policies across multi-language packages. Written in Ruby, the tool scans project dependencies to identify external libraries, discovers associated license files and legal notices across directory hierarchies, and caches metadata directly within the repository for historical review. The tool evaluates detected dependencies against defined compliance rules that handle accepted licenses, ignored lists, and configuration settings specified in YAML or JSON formats. It supports custom dependency sour

govendor is a toolset for Go dependency management that enables the replication of external packages into a local directory to ensure reproducible builds without requiring active network access. It functions as a dependency vendor tool and version manager, fetching specific git revisions, tags, or branches of remote packages. The project includes a dependency auditor to identify missing, modified, or outdated packages compared to their remote sources. It also provides a license extraction utility that discovers and lists the legal licenses associated with project import paths and dependencies