CLI tool and library for generating a Software Bill of Materials from container images and filesystems

GUAC aggregates software security metadata into a high fidelity graph database.

OpenSCA is an open source software supply chain security solution that supports the detection of open source dependencies, vulnerabilities and license compliance with a widely noticed accuracy by the community.

Scans Software Bill of Materials (SBOMs) for security vulnerabilities

Evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more

A utility to generate SPDX-compliant Bill of Materials manifests

sbomqs: The Comprehensive SBOM Quality & Compliance Tool

Reliable project licenses detector.

licensechecker (lc) a command line application which scans directories and identifies what software license things are under producing reports as either SPDX, CSV, JSON, XLSX or CLI Tabular output. Dual-licensed under MIT or the UNLICENSE.

Utility that provides an API platform for validating, querying and managing BOM data

Format agnostic SBOM tooling

Automate copyright headers and license files at scale

sbomasm: The Complete SBOM Management Toolkit

SBOM Search - Context aware search in SBOM repositories

Golang library for listing and looking up licenses using SPDX IDs.

Automate vulnerability triage which prioritizes remediation over discovery

Tool to inspect and push and SPDX document as an OCI artifact

CLI tool to generate SBOMs and upload them to SBOM Observer.

A lightweight Go library for validating Software Bill of Materials (SBOM) against industry-standard specifications

Inspect and push SBOMs (such as SPDX documents) to an OCI registry as an OCI artifact