1:56 a.m.
On Wed, 4 Apr 2018 at 11:42, Niels van Dijk <niels.vandijk at surfnet.nl> wrote:
Hi all,
I would like to find out what the licenses of *all* components and
dependencies that make up SaToSa. Any suggestion to how to do that in an
automated fashion?
I could walk down the libraries manually in
virtualenv/lib/python3.5/site-packages, but that is rather tedious and
error prone. I also found some scripts to do this for me, however these
seem to just report what is in use at the os/system level, not
specifically for our virtualenv.
Any suggestions, or a solution you may have used previously?
Also, related to:
[Idpy-discuss] SaToSa (and dependencies) licenses and copyright
https://lists.sunet.se/pipermail/idpy-discuss/2018-May/000161.html
I have been looking for ways to automate dependency tracking and
license compliance. Bellow is a list of tools that do that. If anyone
has tried any of the tools, feedback would be appreciated.
- FOSSA
https://fossa.io/
Managed dependency tracking and license compliance as a (paid)
service. From the FAQ:
Do you offer discounts for non-commerical projects?
If you are a non-profit, educational institution or based in open source, we offer
special plans for your budget.
- Fossology
https://www.fossology.org
https://github.com/fossology/fossology
Self-hosted; PHP/C; Free and Open Source; Supported by the Linux Foundation.
- scancode-toolkit
https://github.com/nexB/scancode-toolkit/wiki
https://github.com/nexB/scancode-toolkit/
Self-hosted; Python; Free and Open Source
- Licensee
http://ben.balter.com/licensee/
https://github.com/benbalter/licensee
Self-hosted; Ruby; Free and Open Source
- Ninka
http://ninka.turingmachine.org/
https://github.com/dmgerman/ninka
Self-hosted; Perl; Free and Open Source
( compares to a big list of predefined licenses:
https://github.com/dmgerman/ninka/tree/master/t/data/licenses )
- Speedy LIcense Checker
https://github.com/gerv/slic
Self-hosted; C; Free and Open Source
And on a side note, dependency vulnerability checkers:
- snyk
https://snyk.io/
Managed vulnerability checker as a (paid) service.
Unlimited tests on open source projects
- Dependency Track
https://dependencytrack.org/
https://github.com/DependencyTrack/dependency-track
https://www.owasp.org/index.php/OWASP_Dependency_Track_Project
Self-hosted; Java; Free and Open Source; Supported by OWASP
Hopefully, these will prove helpful to the community,
Cheers,
--
Ivan c00kiemon5ter Kanakarakis >:3