3. Tools (FOSSology, SW360)

Open source compliance activities require not only policies, processes, and training materials, but also a variety of tools and systems for source code scanning, dependency analysis, and open source Bill of Materials management. As a result, many companies are investing significant resources in adopting and operating these tools and systems. Companies that are just starting open source compliance face difficulties not only with process but also with cost.

To address these difficulties, in June 2019, the OpenChain Tooling Work Group was launched, led by open source compliance tool experts from companies participating in the OpenChain project, including Siemens, Bosch, Toshiba, Fujitsu, and Hitachi.

The OpenChain Tooling Work Group was formed so that open source experts from various companies could work together to solve issues and share results, reducing open source compliance costs and producing high-quality compliance outcomes.

Specifically, it aims to build a turn-key open source tool chain by leveraging existing open source projects such as FOSSology, SW360, Software Heritage, ClearlyDefined, and SPDX, and to make this freely available to all companies. (https://groups.io/g/oss-based-compliance-tooling)

This section introduces FOSSology and SW360 and provides a brief guide on how to use them.