|
4 | 4 |
|
5 | 5 | AboutCode is a family of FOSS projects to uncover data ... about software:
|
6 | 6 |
|
7 |
| -- where does the code come from? which software package? |
8 |
| -- what is its license? copyright? |
9 |
| -- is the code vulnerable, maintained, well coded? |
10 |
| -- what are its dependencies, are there vulneribilities/licensing issues? |
11 |
| - |
12 |
| -All these are questions that are important to answer: there are millions |
13 |
| -of free and open source software components available on the web for reuse. |
14 |
| - |
15 |
| -Knowing where a software package comes from, what its license is and whether it is |
16 |
| -vulnerable should be a problem of the past such that everyone can safely consume |
17 |
| -more free and open source software. We support not only open source software, but |
18 |
| -also open data, generated and curated by our applications. |
19 |
| - |
20 |
| -> **_NOTE:_** This is a repository with information on aboutcode open source activities and not |
21 |
| - the actual code repository. See the [projects section](https://github.com/nexB/aboutcode#projects) |
22 |
| - below for links to all the code repositories of our projects with a brief overview and our |
23 |
| - [wiki](https://github.com/nexB/aboutcode/wiki) if you are looking to participate. |
| 7 | +- where does the code come from? which software package? |
| 8 | +- what is its license? copyright? |
| 9 | +- is the code vulnerable, maintained, well coded? |
| 10 | +- what are its dependencies, are there vulneribilities/licensing issues? |
| 11 | + |
| 12 | +All these are questions that are important to answer: there are millions of free |
| 13 | +and open source software components available on the web for reuse. |
| 14 | + |
| 15 | +Knowing where a software package comes from, what its license is and whether it |
| 16 | +is vulnerable should be a problem of the past such that everyone can safely |
| 17 | +consume more free and open source software. We support not only open source |
| 18 | +software, but also open data, generated and curated by our applications. |
| 19 | + |
| 20 | +> **_NOTE:_** This is a repository with information on aboutcode open source |
| 21 | +> activities and not the actual code repository. See the |
| 22 | +> [projects section](https://github.com/aboutcode-org/aboutcode#projects) below |
| 23 | +> for links to all the code repositories of our projects with a brief overview |
| 24 | +> and our [wiki](https://github.com/aboutcode-org/aboutcode/wiki) if you are |
| 25 | +> looking to participate. |
24 | 26 |
|
25 | 27 | ### Documentation Build Status
|
26 | 28 |
|
27 |
| - |
| 29 | + |
28 | 30 |
|
29 |
| -### Important Links |
| 31 | +### Important Links |
30 | 32 |
|
31 | 33 | Our homepage is at http://aboutcode.org
|
32 | 34 |
|
33 |
| -Our documentation (in progress) is at https://aboutcode.readthedocs.io/en/latest/ |
| 35 | +Our documentation (in progress) is at |
| 36 | +https://aboutcode.readthedocs.io/en/latest/ |
34 | 37 |
|
35 |
| -Join the chat online at [app.gitter.im : aboutcode-org#discuss](https://app.gitter.im/#/room/#aboutcode-org_discuss:gitter.im) |
36 |
| -or if you're using the element app set the homeserver to `gitter.im` and then join the [aboutcode-org#discuss](https://matrix.to/#/#aboutcode-org_discuss:gitter.im) |
| 38 | +Join the chat online at |
| 39 | +[app.gitter.im : aboutcode-org#discuss](https://app.gitter.im/#/room/#aboutcode-org_discuss:gitter.im) |
| 40 | +or if you're using the element app set the homeserver to `gitter.im` and then |
| 41 | +join the |
| 42 | +[aboutcode-org#discuss](https://matrix.to/#/#aboutcode-org_discuss:gitter.im) |
37 | 43 | chatroom. Introduce yourself and start the discussion!
|
38 | 44 |
|
39 |
| -Look at our [wiki](https://github.com/nexB/aboutcode/wiki) for information about our participation |
40 |
| -in the GSoC and GSoD programs. |
| 45 | +Look at our [wiki](https://github.com/aboutcode-org/aboutcode/wiki) for |
| 46 | +information about our participation in the GSoC and GSoD programs. |
41 | 47 |
|
42 |
| -We have a weekly meeting, see more details [here](https://github.com/nexB/aboutcode/wiki/MeetingMinutes). |
| 48 | +We have a weekly meeting, see more details |
| 49 | +[here](https://github.com/aboutcode-org/aboutcode/wiki/MeetingMinutes). |
43 | 50 |
|
44 | 51 | ### Projects
|
45 | 52 |
|
46 | 53 | Each AboutCode project has its own repository:
|
47 | 54 |
|
48 |
| -- **[ScanCode Toolkit](https://github.com/nexB/scancode-toolkit)**: a set of code scanning tools to detect |
49 |
| - the origin and license of code and dependencies. ScanCode now uses a plug-in architecture to run a series |
50 |
| - of scan-related tools in one process flow. This is the most popular project and is used by 100's of software |
51 |
| - teams . The lead maintainer is @pombredanne |
52 |
| - |
53 |
| -- **[Scancode.io](https://github.com/nexB/scancode.io)**: is a web-based and API to run and review scans in |
54 |
| - rich scripted pipelines, on different kinds of containers, docker images, package archives, manifests etc, |
55 |
| - to get information on licenses, copyrights, source, vulneribilities. The lead maintainer is @tdruez |
56 |
| - |
57 |
| -- **[VulnerableCode](https://github.com/nexB/vulnerablecode)**: is a web-based API and |
58 |
| - database to collect and track all the known software package vulnerabilities, with |
59 |
| - affected and fixed packages, references and a standalone tool Vulntotal to compare |
60 |
| - this vulneribility information across similar tools. This is maintained by @tg1999 and @pombredanne |
61 |
| - |
62 |
| -- **[univers](https://github.com/nexB/univers)** is a package to parse and compare |
63 |
| - all the package versions and all the ranges. |
64 |
| - |
65 |
| -- **[purlDB](https://github.com/nexB/purldb)** consists of tools to create and expose |
66 |
| - a database of purls (Package URLs) and also has package data for all of these |
67 |
| - packages created from scans. This is maintained by @jyang |
68 |
| - |
69 |
| -- **[FetchCode](https://github.com/nexB/fetchcode)** is a library |
70 |
| - to reliably fetch any code via HTTP, FTP and version control systems such as git. |
71 |
| - |
72 |
| -- **[Scancode Workbench](https://github.com/nexB/scancode-workbench)**: a desktop application |
73 |
| - based on typescript and react to visualize and review scan results from scancode scans. |
74 |
| - |
75 |
| -- **[AboutCode Toolkit](https://github.com/nexB/aboutcode-toolkit)**: a set of command line tools to document |
76 |
| - the provenance of your code and generate attribution notices. AboutCode Toolkit uses small yaml files to |
77 |
| - document code provenance inside a codebase. The lead maintainer is @chinyeungli |
78 |
| - |
79 |
| -- **[container-inspector](https://github.com/nexB/container-inspector)**: a tool to analyze the structure |
80 |
| - and provenance of software components in Docker images using static analysis. Maintained by @pombredanne |
81 |
| - |
82 |
| -- **[python-inspector](https://github.com/nexB/python-inspector)** and **[nuget inspector](https://github.com/nexB/nuget-inspector/)** |
83 |
| - inspects manifests and code to resolve dependencies (vulnerable and non-vulnerable) for |
84 |
| - python and nuget packages respectively. |
85 |
| - |
86 |
| -- **[license-expression](https://github.com/nexB/license-expression/)**: a library to parse, analyze, compare |
87 |
| - and normalize SPDX and SPDX-like license expressions using a boolean logic expression engine. |
88 |
| - See https://spdx.org/spdx-specification-21-web-version#h.jxpfx0ykyb60 to understand what an expression is. |
89 |
| - See https://github.com/nexB/license-expression for the code. The underlying boolean engine is live at |
90 |
| - https://github.com/bastikr/boolean.py . Both are co-maintained by @pombredanne |
91 |
| - |
92 |
| -- **ABCD aka AboutCode Data**: a simple set of conventions to define data structures that all the |
93 |
| - AboutCode tools can understand and use to exchange data. The details are at |
94 |
| - [AboutCode Data](https://aboutcode.readthedocs.io/en/latest/aboutcode-data/abcd.html). |
95 |
| - ABOUT files and ScanCode Toolkit data are examples of this approach. Other projects such as |
96 |
| - https://libraries.io and and [OSS Review Toolkit](https://github.com/heremaps/oss-review-toolkit) |
97 |
| - are also using these conventions. |
98 |
| - |
99 |
| -- **[TraceCode Toolkit](https://github.com/nexB/tracecode-toolkit)**: a set of tools to trace files from your |
100 |
| - deployment or distribution packages back to their origin in a development codebase or repository. |
101 |
| - The primary tool uses strace https://github.com/strace/strace/ to trace system calls on Linux and construct |
102 |
| - a build graph from syscalls to show which files are used to build a binary. We are contributors to strace. |
103 |
| - Maintained by @pombredanne |
| 55 | +- **[ScanCode Toolkit](https://github.com/aboutcode-org/scancode-toolkit)**: a |
| 56 | + set of code scanning tools to detect the origin and license of code and |
| 57 | + dependencies. ScanCode now uses a plug-in architecture to run a series of |
| 58 | + scan-related tools in one process flow. This is the most popular project and |
| 59 | + is used by 100's of software teams . The lead maintainer is @pombredanne |
| 60 | + |
| 61 | +- **[Scancode.io](https://github.com/aboutcode-org/scancode.io)**: is a |
| 62 | + web-based and API to run and review scans in rich scripted pipelines, on |
| 63 | + different kinds of containers, docker images, package archives, manifests |
| 64 | + etc, to get information on licenses, copyrights, source, vulneribilities. |
| 65 | + The lead maintainer is @tdruez |
| 66 | + |
| 67 | +- **[VulnerableCode](https://github.com/aboutcode-org/vulnerablecode)**: is a |
| 68 | + web-based API and database to collect and track all the known software |
| 69 | + package vulnerabilities, with affected and fixed packages, references and a |
| 70 | + standalone tool Vulntotal to compare this vulneribility information across |
| 71 | + similar tools. This is maintained by @tg1999 and @pombredanne |
| 72 | + |
| 73 | +- **[univers](https://github.com/aboutcode-org/univers)** is a package to |
| 74 | + parse and compare all the package versions and all the ranges. |
| 75 | + |
| 76 | +- **[purlDB](https://github.com/aboutcode-org/purldb)** consists of tools to |
| 77 | + create and expose a database of purls (Package URLs) and also has package |
| 78 | + data for all of these packages created from scans. This is maintained by |
| 79 | + @jyang |
| 80 | + |
| 81 | +- **[FetchCode](https://github.com/aboutcode-org/fetchcode)** is a library to |
| 82 | + reliably fetch any code via HTTP, FTP and version control systems such as |
| 83 | + git. |
| 84 | + |
| 85 | +- **[Scancode Workbench](https://github.com/aboutcode-org/scancode-workbench)**: |
| 86 | + a desktop application based on typescript and react to visualize and review |
| 87 | + scan results from scancode scans. |
| 88 | + |
| 89 | +- **[AboutCode Toolkit](https://github.com/aboutcode-org/aboutcode-toolkit)**: |
| 90 | + a set of command line tools to document the provenance of your code and |
| 91 | + generate attribution notices. AboutCode Toolkit uses small yaml files to |
| 92 | + document code provenance inside a codebase. The lead maintainer is |
| 93 | + @chinyeungli |
| 94 | + |
| 95 | +- **[container-inspector](https://github.com/aboutcode-org/container-inspector)**: |
| 96 | + a tool to analyze the structure and provenance of software components in |
| 97 | + Docker images using static analysis. Maintained by @pombredanne |
| 98 | + |
| 99 | +- **[python-inspector](https://github.com/aboutcode-org/python-inspector)** |
| 100 | + and **[nuget inspector](https://github.com/aboutcode-org/nuget-inspector/)** |
| 101 | + inspects manifests and code to resolve dependencies (vulnerable and |
| 102 | + non-vulnerable) for python and nuget packages respectively. |
| 103 | + |
| 104 | +- **[license-expression](https://github.com/aboutcode-org/license-expression/)**: |
| 105 | + a library to parse, analyze, compare and normalize SPDX and SPDX-like |
| 106 | + license expressions using a boolean logic expression engine. See |
| 107 | + https://spdx.org/spdx-specification-21-web-version#h.jxpfx0ykyb60 to |
| 108 | + understand what an expression is. See |
| 109 | + https://github.com/aboutcode-org/license-expression for the code. The |
| 110 | + underlying boolean engine is live at https://github.com/bastikr/boolean.py . |
| 111 | + Both are co-maintained by @pombredanne |
| 112 | + |
| 113 | +- **ABCD aka AboutCode Data**: a simple set of conventions to define data |
| 114 | + structures that all the AboutCode tools can understand and use to exchange |
| 115 | + data. The details are at |
| 116 | + [AboutCode Data](https://aboutcode.readthedocs.io/en/latest/aboutcode-data/abcd.html). |
| 117 | + ABOUT files and ScanCode Toolkit data are examples of this approach. Other |
| 118 | + projects such as https://libraries.io and and |
| 119 | + [OSS Review Toolkit](https://github.com/heremaps/oss-review-toolkit) are |
| 120 | + also using these conventions. |
| 121 | + |
| 122 | +- **[TraceCode Toolkit](https://github.com/aboutcode-org/tracecode-toolkit)**: |
| 123 | + a set of tools to trace files from your deployment or distribution packages |
| 124 | + back to their origin in a development codebase or repository. The primary |
| 125 | + tool uses strace https://github.com/strace/strace/ to trace system calls on |
| 126 | + Linux and construct a build graph from syscalls to show which files are used |
| 127 | + to build a binary. We are contributors to strace. Maintained by @pombredanne |
104 | 128 |
|
105 | 129 | We also co-started and worked closely with other FOSS orgs and projects:
|
106 | 130 |
|
107 |
| -- [Package URL](https://github.com/package-url): a widely used standard to reference software packages of all types with simple, |
108 |
| - readable and concise URLs. |
| 131 | +- [Package URL](https://github.com/package-url): a widely used standard to |
| 132 | + reference software packages of all types with simple, readable and concise |
| 133 | + URLs. |
109 | 134 |
|
110 |
| -- [SPDX](http://SPDX.org): aka. Software Package Data Exchange, a spec to document the origin and licensing of packages. |
| 135 | +- [SPDX](http://SPDX.org): aka. Software Package Data Exchange, a spec to |
| 136 | + document the origin and licensing of packages. |
111 | 137 |
|
112 |
| -- [CycloneDX](https://cyclonedx.org) aka. OWASP CycloneDX is a full-stack |
113 |
| - Bill of Materials (BOM) standard that provides advanced supply chain |
114 |
| - capabilities for cyber risk reduction |
| 138 | +- [CycloneDX](https://cyclonedx.org) aka. OWASP CycloneDX is a full-stack Bill |
| 139 | + of Materials (BOM) standard that provides advanced supply chain capabilities |
| 140 | + for cyber risk reduction |
115 | 141 |
|
116 |
| -- [ClearlyDefined](https://ClearlyDefined.io): a project to review and help FOSS projects improve their licensing |
117 |
| - and documentation clarity. This project is incubating with https://opensource.org |
| 142 | +- [ClearlyDefined](https://ClearlyDefined.io): a project to review and help |
| 143 | + FOSS projects improve their licensing and documentation clarity. This |
| 144 | + project is incubating with https://opensource.org |
0 commit comments