Gaurav Mishra

FOSSology is a open source license compliance software system and toolkit. As a toolkit you can run license, copyright and export control scans from the command line or from web UI. FOSSology can generate SPDX SBOM for source code in RDF and tag-value formats, including other reports, and is becoming more SPDX compliant. With the new license naming changes in FOSSology, users can provide more elaborate and correct SPDX License Identifiers for the licenses. The tool has also improved its reporting using SPDX version 2.3 with new fields.

FOSSology uses SPDX reporting formats to generate SBOM for source code. The project has recently improved the reporting by providing users and option to give SPDX License Identifier. This helps in maintaining the SPDX specified format for the reports in FOSSology. Apart from using SPDX reporting formats, FOSSology also supports following SBOM reports:

• DEP5 format, which is predominantly used within Debian community.
• CLIXML report, an in-house format, which reports about licensing and related information in XML.

Other people: Mohammed Shaheem Azmal Madanapalli

FOSSology focusses on license compliance analyses. Recently, a number of new features have been published by the community to integrate better with software composition analysis. The presentation shows an introduction of the main and relevant development here.

FOSSology is considered as one of the leading Open Source tools when it comes to license compliance. There are various ways with which someone can analyze a package in FOSSology. One can either do it manually or can do it programmatically. As the industry is heading towards automation, programmatic approach based on software composition analysis is more preferred and becomes more advantageous. Currently, FOSSology provides 3 different ways to integration with software composition approaches: utilizing FOSSology CLI tools, use one of the client libraries and from the REST API.

The presentation will help by providing different strategies which can be used to automate analysis of software components in an automated environment. We will see how one can use the CLI tools of FOSSology or other FOSS projects built on FOSSology's REST API to push packages for analysis. We will also see how the enhanced API can provide much more information about a package and how analysis can be triggered on-demand. Finally, we will touch upon how one can gather the package information in a neat report for auditing.

Other people: Anupam Ghosh shaheemazmalmmd

FOSSology is an open source license compliance software system and toolkit. As a toolkit, you can run automated license, copyright and export control scans from the command line. As a system, a Web interface provides you with a compliance workflow. License, copyright and export control scanners are tools used in the workflow. Analyzing open source license compliance requires expert knowledge. Consequently, the use of the tool requires an understanding of license analysis problems and how they are covered by FOSSology. This hands-on training session will provide this understanding. ### The following elements are covered: - Challenges in real-world examples at license analysis - Learning how to cope with license proliferation and custom license texts - Efficiently managing large open source components with heterogeneous licensing - Saving work with reusing license conclusions of open source packages when analyzing - How FOSSology works with the SPDX standard - Generating reports (DEP5, SPDX, Word doc, etc) - New features in the past year of FOSSology ### Audience This course will be valuable to anyone concerned with and involved in Open Source Management, including operational and legal executives, software development managers, open source program managers, and developers. Participants are encouraged to directly work on the given FOSSology software, in the best case on their own notebook computers for using FOSSology after the session as well. Assistance for installation will be provided, but it is advisable to have Docker setup.

Other people: shaheemazmalmmd