AboutCode is a family of FOSS projects to uncover metadata about software:
- where does the code come from? which software package?
- what is its license? copyright?
- is the code vulnerable, maintained, well coded?
- what are its dependencies, are there vulnerabilities/licensing issues?
All these are questions that are important to answer: there are millions of free and open source software components available on the web for reuse.
Knowing where a software package comes from, what its license is and whether it is vulnerable should be a problem of the past such that everyone can safely consume more free and open source software. We support not only open source software, but also open data, generated and curated by our applications.
Note
This is a repository with information on aboutcode open source activities and not the actual code repository. See the projects section below for links to all the code repositories of our projects with a brief overview and our wiki if you are looking to participate.
- Homepage: http://aboutcode.org
- Documentation: https://aboutcode.readthedocs.io/en/latest/
- Chat: Gitter | Slack
- Weekly Meetings: Meeting Minutes
- GSoC: Wiki
- Documentation Build:
Tip
To manually build the documentation, run make docs from the root of this repo.
We welcome contributions! Whether you're fixing bugs, adding features, or improving documentation, we'd love your help.
Get started:
- Read our CONTRIBUTING.md guide
- Look for good first issues
- Join our community chat
| Project | Description | Maintainer |
|---|---|---|
| ScanCode Toolkit | Detect origin, license, and vulnerabilities in code, packages, and dependencies | @AyanSinhaMahapatra |
| ScanCode.io | Web UI and API for running complex scans in pipelines with CycloneDX and SPDX support | @tdruez |
| ScanCode LicenseDB | Free database of 2400+ software licenses with metadata and detection rules (public instance) | @AyanSinhaMahapatra, @DennisClark |
| ScanCode Workbench | Desktop application to visualize and review ScanCode Toolkit scan results | @AyanSinhaMahapatra, @mjherzog |
| DejaCode | Enterprise application for open source license compliance and supply chain integrity | @tdruez, @DennisClark |
| VulnerableCode | Database of software package vulnerabilities with Web UI and API (public instance) | @TG1999, @keshav-space |
| PURLDB | Database of package metadata keyed by PURL with API access | @JonoYang |
Special-purpose analysis tools that run as ScanCode Toolkit plugins, ScanCode.io pipeline steps, or from the command line.
| Project | Description | Maintainer |
|---|---|---|
| binary-inspector | Extract symbols from ELF, Mach-O, WinPE and other binary formats | @AyanSinhaMahapatra |
| container-inspector | Analyze structure and provenance of Docker image layers | @JonoYang, @chinyeungli |
| source-inspector | Inspect source code to collect symbols, strings, and comments | @JonoYang |
| nuget-inspector | Resolve dependencies for .NET/NuGet projects without requiring dotnet SDK | @JonoYang |
| python-inspector | Analyze PyPI packages and resolve Python dependencies | @TG1999, @chinyeungli |
| debian-inspector | Parse and inspect Debian control files and codebases | @JonoYang, @AyanSinhaMahapatra |
| elf-inspector | Inspect binary ELF files and collect metadata | @AyanSinhaMahapatra |
| go-inspector | Extract dependencies and symbols from Go binaries | @JonoYang |
| rust-inspector | Extract dependencies and symbols from Rust binaries | @AyanSinhaMahapatra |
| Project | Description | Maintainer |
|---|---|---|
| license-expression | Parse, analyze, and normalize SPDX license expressions | @AyanSinhaMahapatra |
| commoncode | Common utilities for paths, dates, files, and hashes | @AyanSinhaMahapatra |
| extractcode | Universal archive extraction library and CLI tool | @JonoYang |
| fetchcode | Reliably fetch code via HTTP, FTP, and version control systems | @JonoYang |
| Project | Description | Maintainer |
|---|---|---|
| aboutcode-toolkit | Document code provenance and generate attribution notices using ABOUT files | @chinyeungli |
| univers | Parse and compare package versions across all ecosystems | @TG1999 |
| federatedcode | Decentralized, federated metadata system for open source software | @keshav-space |
AboutCode Data is a set of conventions for data structures that all AboutCode tools can use to exchange data. ABOUT files and ScanCode Toolkit data are examples of this approach, supporting projects like libraries.io and OSS Review Toolkit.
AboutCode is based on key industry standards and works closely with other FOSS organizations:
PURL is a URL string used to identify and locate software packages universally across programming languages, package managers, and tools. It originated from ScanCode and is in process to become an Ecma standard.
Maintainer: @johnmhoran
VERS is an emerging specification for resolving dependency and vulnerable version ranges. It originated as part of the PURL project and is in process to become an Ecma standard.
Specification: VERSION-RANGE-SPEC.rst
Package URL: A widely used standard to identify software packages with simple, readable URLs. See the PURL discussions for Ecma standardization details.
SPDX: System Package Data Exchange, a specification to document the origin and licensing of packages.
CycloneDX: OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard for supply chain security.
ClearlyDefined: A project to help FOSS projects improve their licensing and documentation clarity (incubating with opensource.org).
License: Apache License 2.0 | Code of Conduct: CODE_OF_CONDUCT.rst