Sw360 | Haksunghttps://haksungjang.github.io/en/tags/sw360/Haksung Jang — Open Source Program Manager at SK telecomHugoen-USSun, 09 Aug 2026 17:03:59 +0900SW360https://haksungjang.github.io/en/docs/tools/2-sw360/Sun, 09 Aug 2026 17:03:59 +0900https://haksungjang.github.io/en/docs/tools/2-sw360/(Updated on August 29, 2023.) A company that develops and distributes products containing open source needs to collect and track information such as the version and license of the open source used, for each product and release version. This allows the company to carry out proper open source compliance activities. In particular, when a security vulnerability is reported for a specific open source version at NVD (https://nvd.nist.gov/vuln), a company that cannot trace which products use that version ends up unable to determine which products need the security patch applied, leaving its products exposed to the vulnerability.<![CDATA[

(Updated on August 29, 2023.)

A company that develops and distributes products containing open source needs to collect and track information such as the version and license of the open source used, for each product and release version. This allows the company to carry out proper open source compliance activities.

In particular, when a security vulnerability is reported for a specific open source version at NVD (https://nvd.nist.gov/vuln), a company that cannot trace which products use that version ends up unable to determine which products need the security patch applied, leaving its products exposed to the vulnerability.

This makes tracking open source information a necessity. Companies address this either by building their own system or by purchasing and using a commercial service. SW360 is open source software sponsored by the Eclipse Foundation, providing a web application and repository for collecting and tracking software Bill of Materials (BOM) information.

https://www.eclipse.org/sw360/

<https://www.eclipse.org/sw360/ >

Key Features

SW360 provides a web-based UI, and its key functions are as follows.

  • Tracking components used in a product
  • Security vulnerability assessment
  • License obligation management
  • Generating legal documents such as notices

https://www.eclipse.org/sw360/

Installation

SW360 is composed as follows.

  • Frontend : Liferay-(Tomcat-)based portal application
  • Backend : Tomcat-based thrift service
  • Database : CouchDB

For details on the project structure and the software required for installation, see the Required software section of the README. :https://github.com/eclipse-sw360/sw360

SW360 offers the following installation methods. Users can choose one of them for installation.

  1. Can be deployed via Docker. :https://github.com/eclipse-sw360/sw360/blob/main/README_DOCKER.md
  2. Can install SW360’s components individually. :https://github.com/eclipse/sw360
  3. Vagrant-based (https://www.vagrantup.com/) installation: Vagrant is a tool for managing virtualized instances, and sw360vagrant provides an environment for deploying SW360 all at once. :https://github.com/sw360/sw360vagrant
    • The Vagrant-based installation guide can be foundhere. (Note: because the code has changed since the guide was written, it may not work correctly.)

This guide introduces the method of deploying withDocker. For details, refer to the README. :https://github.com/eclipse-sw360/sw360/blob/main/README_DOCKER.md

1. Download the Code

Download the code to build the Docker image. The tested code can be obtained here. :https://github.com/haksungjang/sw360/tree/docker_build

git clone -b docker_build https://github.com/haksungjang/sw360.git

2. Build

First, installDocker. (Note that apaid purchase may be required for corporate developer use.)

Build by runningdocker_build.sh as shown below.

cd sw360./docker_build.sh

Once the build completes successfully, you can check the created images as shown below.

docker image lsREPOSITORY TAG IMAGE ID CREATED SIZEeclipse-sw360/sw360 18-development ab0fd848bf808 minutes ago 2.95GBeclipse-sw360/sw360 latest ab0fd848bf808 minutes ago 2.95GBghcr.io/eclipse-sw360/sw360 18-development ab0fd848bf808 minutes ago 2.95GBghcr.io/eclipse-sw360/sw360 latest ab0fd848bf808 minutes ago 2.95GBeclipse-sw360/binaries 18-development aa7debf0a1fc8 minutes ago 347MBeclipse-sw360/binaries latest aa7debf0a1fc8 minutes ago 347MBghcr.io/eclipse-sw360/binaries 18-development aa7debf0a1fc8 minutes ago 347MBghcr.io/eclipse-sw360/binaries latest aa7debf0a1fc8 minutes ago 347MBeclipse-sw360/base 18-development e5147733fc8837 minutes ago 1.52GBeclipse-sw360/base latest e5147733fc8837 minutes ago 1.52GBghcr.io/eclipse-sw360/base 18-development e5147733fc8837 minutes ago 1.52GBghcr.io/eclipse-sw360/base latest e5147733fc8837 minutes ago 1.52GBghcr.io/eclipse-sw360/thrift 0.18.1 0012d79980584 weeks ago 152MBghcr.io/eclipse-sw360/thrift latest 0012d79980584 weeks ago 152MBeclipse-sw360/thrift 0.18.1 0012d79980584 weeks ago 152MBeclipse-sw360/thrift latest 0012d79980584 weeks ago 152MB

3. Run

Run the created images with thedocker-compose up command.

docker-compose up

Once it runs successfully, you can see three containers running as shown below.

docker ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
4299fd39010c eclipse-sw360/sw360 "/app/entry_point.sh" 3 minutes ago Up 3 minutes 0.0.0.0:8080->8080/tcp, 0.0.0.0:11311->11311/tcp sw360
13fd5696b140 postgres:14 "docker-entrypoint.s…" 3 minutes ago Up 3 minutes (healthy) 0.0.0.0:5438->5432/tcp sw360-postgresdb-1
7bb70f2daaf4 couchdb "tini -- /docker-ent…" 3 minutes ago Up 3 minutes (healthy) 4369/tcp, 9100/tcp, 0.0.0.0:5984->5984/tcp sw360-couchdb-1

At this point, accessinghttp://localhost:8080/ takes you to the following screen.

Configuration

After installing SW360 successfully, you need to perform the initial configuration following the procedure below. For details, see:SW360 Initial Setup Configuration

1. User and Login Configuration

Log in with the following account to perform the configuration.

Once you log in, a Not Found message appears as shown below.

Click the item icon (cube shape) in the upper right of the screen and select theControl Panel tab.

EnableSECURITY >Password Policies >Default Password Policy >PASSWORD CHANGES >Change Requried.

Then, back in theControl Panel tab, selectCONFIGURATION >Instance Settings. This shows thePLATFORM menu.

There, selectUsers. Then go into theDefault User Associations menu, checkApply to Existing Users, andSave.

Now, underInstance Settings >PLATFORM, selectUser Authentication. Go intoGeneral and uncheck all items. (You can check and enable any items needed for administrative purposes.) ThenSave.

Finally, you need to enable jQuery and Font Awesome. To do this, go intoCONFIGURATION >System Settings in theControl Panel tab, where you can findThird Party underPLATFORM.

Go intoThird Party and enableJQuery andFont Awesome respectively.

Restart your browser for the changes to take effect.

2. Import LAR Files

To configure SW360, you need to import the*.lar files. To do this, you need to go into the menu, and the menu button is in the upper left of the screen.

In the menu, go intoPublishing >Import.

Click the+ button on the right to upload a LAR file. The LAR files are located under thefrontend/configuration folder in the SW360 source files. (e.g.,https://github.com/haksungjang/sw360/tree/docker_build/frontend/configuration)

First, upload thePublic_Pages_7_4_3_18_GA18.lar file and click theContinue button.

On the File Summary screen, you can see the details of the uploaded LAR file.

ChangeAUTHORSHIP OF THE CONTENT at the bottom toUse the Current User as Author and click theImport button.

You can then see that the import completed successfully.

Similarly, import thePrivate_Pages_7_4_3_18_GA18.lar file. On the File Summary screen, changePAGES >Private Pages as shown below.

Then select thePERMISSIONS,UPDATE DATA, andAUTHORSHIP OF THE CONTENT items as shown in the image below, and click theImport button to perform the import.

After completing this, click theHome button at the top of the menu.

This takes you to theWelcome to SW360! screen shown below.

Click theStart button to go into the SW360 main screen. (All items are empty at this point.)

3. User Account Configuration (for Testing)

In the SW360 menu, selectAdmin >User.

In theUPLOAD USERS menu at the bottom of the screen, upload the user list for testing. (The user list for testing can be downloaded here. :test_users_with_passwords_12345.csv )

You can then see that a list of 9 users has been uploaded, as shown below.

Try logging in again with theuser@@sw360.org account, one of the users shown in the list. The password is12345.

Basic Workflow

1. Registering Licenses

When you first install SW360, you need to first register the open source licenses you use frequently. A license includes the following information.

  • Full Name
  • Short Name
  • License Type
  • GPL-2.0 Compatibility (e.g., yes, no)
  • License Text

Selecting Menu > Licenses > Add License takes you to the Create License screen shown below.

Registering licenses one by one manually like this can be quite tedious, but fortunately SW360 provides a feature to import the SPDX License List all at once. Click Menu > Admin < Import SPDX Information.

The SPDX License List is then automatically registered shortly after. At Menu > Licenses, you can confirm that 338 licenses have been registered.

2. Registering Components and Releases

In SW360, a Component is a single unit of software. Various forms of software can fall into this category, for example:

  • Open source software
  • Libraries
  • Third-party software

A Component includes the following information.

  • Component Name
  • Main Licenses
  • Categories (e.g., Library, Cloud, Mobile, …)
  • Component Type (e.g., OSS, Internal, InnerSource, Service, Freeware)
  • Default Vendor
  • Homepage URL

A Release is the unit that refers to a single Version within a Component. Accordingly, one Component can have multiple Releases. A Release is created and managed under a single Component.

A Release includes the following information.

  • Component Name
  • Version
  • License
  • Download URL
  • CPE ID (e.g., cpe:2.3:a:apache:maven:3.0.4)

For example, if you need to register zlib-1.2.8, you first register zlib as a Component, then register zlib 1.2.8 as a Release. Selecting Menu > Components > Add Component takes you to the Create Component screen, where you can register information about zlib.

Once you create the Component, you can register information for the zlib-1.2.8 version at Components > Releases > Add Release.

When versions 1.2.8 and 1.2.11 are each registered as Releases under the single zlib Component, the Release Overview screen shows 2 Releases existing, as below.

SW360 provides a feature for importing information for multiple Components at once. At Menu > Admin > Import / Export, you can enter the Component information you want to register into the CSV template and then import it.

Note that, as of February 2020, this feature may not yet work reliably.

3. Creating a Project

A Project refers to a single product. Depending on the type of business, it may be a product, a service, or software. Under a Project, you register and manage the Components/Releases used in the product.

When creating a Project, you register the following information.

  • Project Name
  • Version
  • Project type (e.g., Product, Customer Project, Service, Internal Project, InnerSource)

You can create a Project via Menu > Projects > Add Project.

Once you create the Project, register the Releases or sub-Projects it includes. Selecting the Project at Menu > Projects lets you register Linked Projects and Linked Releases under “Linked Releases and Projects.”

The following is the screen after registering OpenSSL 1.0.1 and zlib 1.2.8 as Linked Releases in a Project named SuperCalc.

4. Security Vulnerability Management

SW360 can automatically check whether registered Releases have security vulnerabilities. To do this, SW360 provides a feature for scheduling periodic collection of CVE information. At Menu > Admin > Schedule, you can set a schedule to collect CVE SEARCH information every 24 hours.

Once this schedule is set, SW360 collects CVE information from the CVE Search site (https://cve.circl.lu/) at the scheduled time. The collected CVE information can be checked at Menu > Vulnerabilities.

Once the Vulnerabilities information has been collected, you can query whether a created Project has security vulnerabilities. In the SuperCalc Project created above, you can confirm that 85 security vulnerabilities were reported.

By registering and managing the software a company develops and distributes in SW360 this way, you can manage it in a form that minimizes risk not only for open source compliance but also for security vulnerabilities.

SW360 also offers most of its functionality via a REST API in addition to the Web Interface above, making integration with other tools such as FOSSology possible. :https://github.com/eclipse/sw360/wiki/Dev-REST-API

In other words, integrating this into DevOps by, for example, importing the analysis results of a source code scanning tool into SW360, and automating the registration of Projects and Releases, would greatly increase efficiency.

]]>