Go
anchore/syft
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Apache-2.0Aug 28, 2026 · metrics 2.10.0
All tags
Catalogue tag
#spdx
Every repository in the public record carrying this tag — from its GitHub topics or the keywords its package registries publish. Health is measured under the same versioned methodology as the rest of the record.
36 records
Go
chainloop-dev/chainloop
SDLC evidence store and policy engine for your Software Supply Chain attestations, SBOMs, VEX, SARIF, QA reports, and more
Apache-2.0Jul 16, 2026 · metrics 2.10.0
PyPI
CycloneDX/cyclonedx-python
CycloneDX Software Bill of Materials (SBOM) generator for Python projects and environments
Apache-2.0Aug 27, 2026 · metrics 2.10.0
Maven · npm
oss-review-toolkit/ort
A suite of tools to automate software compliance checks.
Apache-2.0Jul 17, 2026 · metrics 2.10.0
npm · Maven · NuGet +1
cdxgen/cdxgen
Creates CycloneDX Bill of Materials (BOM) for your projects from source and container images. Supports many languages and package managers. Integrate in your CI/CD pipeline with automatic submission to Dependency Track server
Apache-2.0Jul 28, 2026 · metrics 2.10.0
Packagist
CycloneDX/cyclonedx-php-composer
Create CycloneDX Software Bill of Materials (SBOM) from PHP Composer projects
Apache-2.0Jul 29, 2026 · metrics 2.10.0
PyPI
CycloneDX/cyclonedx-python-lib
Functionality and DataModels of OWASP CycloneDX for Python
Apache-2.0Jul 17, 2026 · metrics 2.10.0
PyPI
fsfe/reuse-tool
This is a mirror of https://codeberg.org/fsfe/reuse-tool
Custom licenseJul 21, 2026 · metrics 2.10.0
npm
janbiasi/rollup-plugin-sbom
Create SBOMs in CycloneDX format for your Vite, Rollup or Rolldown projects with ease
MITJul 17, 2026 · metrics 2.10.0
PyPI
kdeldycke/meta-package-manager
🎁 wraps all package managers with a unifying CLI
GPL-2.0Jul 20, 2026 · metrics 2.10.0
crates.io
EmbarkStudios/cargo-deny
❌ Cargo plugin for linting your dependencies 🦀
Apache-2.0Aug 22, 2026 · metrics 2.10.0
crates.io
EmbarkStudios/cargo-about
📜 Cargo plugin to generate list of all licenses for a crate 🦀
Apache-2.0Aug 23, 2026 · metrics 2.10.0
PyPI
aboutcode-org/scancode-toolkit
:mag: ScanCode detects licenses, copyrights, dependencies by "scanning code" ... to discover and inventory open source and third-party packages used in your code. Sponsored by NLnet, the Google Summer of Code, Azure credits, nexB and other generous sponsors!
Custom licenseJul 21, 2026 · metrics 2.10.0
Go · PyPI
bomly-dev/bomly-cli
Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.
Apache-2.0Jul 17, 2026 · metrics 2.10.0
Maven · npm
eclipse-apoapsis/ort-server
A scalable server implementation of the OSS Review Toolkit.
Apache-2.0Jul 15, 2026 · metrics 2.10.0
—
CycloneDX/cyclonedx-cli
CycloneDX CLI tool for SBOM analysis, merging, diffs and format conversions.
Apache-2.0Aug 21, 2026 · metrics 2.10.0
Maven
CycloneDX/cyclonedx-maven-plugin
Creates CycloneDX Software Bill of Materials (SBOM) from Maven projects
Apache-2.0Jul 30, 2026 · metrics 2.10.0
Go
CycloneDX/sbom-utility
Utility that provides an API platform for validating, querying and managing BOM data
Apache-2.0Sep 3, 2026 · metrics 2.10.0
crates.io
EmbarkStudios/spdx
🆔 Helper crate for SPDX expressions. 🦀
Apache-2.0Aug 9, 2026 · metrics 2.10.0
Go
rezmoss/sbomlyze
git diff for your SBOM ,compare CycloneDX/SPDX/Syft bills of materials, detect tampering, and gate CI
Apache-2.0Jul 20, 2026 · metrics 2.10.0
PyPI
spdx/tools-python
A Python library to parse, validate and create SPDX documents.
Apache-2.0Jul 21, 2026 · metrics 2.10.0
PyPI
aboutcode-org/license-expression
Utility library to parse, normalize and compare License expressions for Python using a boolean logic engine. For expressions using SPDX or any other license id scheme.
Custom licenseJul 17, 2026 · metrics 2.10.0
Go · npm · PyPI
KKloudTarus/synapse-ce
Synapse - a governed control plane for software composition analysis, recon, evidence, and reporting. Verify Everything. Trust Nothing.
Apache-2.0Aug 6, 2026 · metrics 2.10.0
PyPI
espressif/esp-idf-sbom
ESP-IDF Software Bill of Materials Generation Tool
Apache-2.0Jul 28, 2026 · metrics 2.10.0
PyPI · npm
aiexponenthq/license-compliance-checker
License Compliance Checker — Multi-ecosystem license + AI model scanner for EU AI Act Article 53 GPAI compliance. SBOM, SARIF, training-data risk. Apache 2.0.
Apache-2.0Jul 27, 2026 · metrics 2.10.0
Packagist
composer/spdx-licenses
Tools for working with the SPDX license list and validating licenses.
MITAug 27, 2026 · metrics 2.10.0
PyPI
spdx/spdx-tools-python
A Python library to parse, validate and create SPDX documents.
Apache-2.0Jul 15, 2026 · metrics 2.10.0
Go
Vulnetix/cli
Automate vulnerability triage which prioritizes remediation over discovery
Custom licenseSep 5, 2026 · metrics 2.10.0
PyPI
bact/licenseid
A Python CLI and library to get the SPDX License ID from license text
Apache-2.0Aug 19, 2026 · metrics 2.10.0
PyPI
dgeragh/license-audit
Analyze dependency licenses and get actionable licensing guidance for Python projects.
MITJul 17, 2026 · metrics 2.10.0