Tool name: REUSE-tool

[nicorikken]

homepage_url

https://reuse.readthedocs.io/

contact_email

reuse@lists.fsfe.org

code_view_url

https://codeberg.org/fsfe/reuse-tool

spdx_license_expression

GPL-3.0-or-later

description

Copyright and licensing is difficult, especially when reusing software from different projects that are released under various different licenses. REUSE was started by the Free Software Foundation Europe (FSFE) to provide a set of recommendations to make licensing your Free Software projects easier. Not only do these recommendations make it easier for you to declare the licenses under which your works are released, but they also make it easier for a computer to understand how your project is licensed.

As a short summary, the recommendations are threefold:

• Choose and provide licenses
• Add copyright and licensing information to each file
• Confirm REUSE compliance

This tool exists to facilitate the developer in complying with the above recommendations.

There are other tools that have a lot more features and functionality surrounding the analysis and inspection of copyright and licenses in software projects. The REUSE helper tool, on the other hand, is solely designed to be a simple tool to assist in compliance with the REUSE recommendations.

primary_languages

Python

short_term_roadmap

Continuous efforts:

• Extend syntax support
• Usability improvements
• Performance and code quality improvements

long_term_roadmap

proprietary_data

• Yes, the tool depends on proprietary data sources

commercial_features

• Yes, the tool has a commercial version with different/additional features

capabilities

• Identifiers - Use Package-URL (PURL) identifiers
• Identifiers - Use SPDX license expressions
• Scanning - Analyze package manifests and lockfiles
• Scanning - Analyze package files
• Scanning - Scan for copyright
• Scanning - Scan for license
• Scanning - Analyze source code
• Scanning - Analyze containers
• Scanning - Analyze installed system packages (linux distros)
• Scanning - Analyze installed application packages
• Scanning - Other analysis
• Packages - Inventory packages
• Packages - Inventory packages dependencies
• Packages - Resolve dependencies
• Packages - Navigate or display dependency graph
• Compliance - Generate CycloneDX SBOMs
• Compliance - Generate SPDX SBOMs
• Compliance - Validate CycloneDX SBOM
• Compliance - Validate SPDX SBOMs
• Compliance - Generate CycloneDX VEX
• Compliance - Generate CSAF VEX
• Compliance - Generate OpenVex
• Compliance - Generate other compliance documents
• Policies - Define and check license policies
• Policies - Define and check security policies
• Policies - Define and check other policies
• Data - Database of Package metadata
• Data - Database of Package dependency relationships
• Data - Database of License obligations
• Data - Database of Licenses
• Data - Database of Vulnerabilities
• License - Help triage license issues
• License - Generate license credit and attribution notices
• License - Generate source code redistribution lists
• Vulnerabilities - Detect vulnerable code in packages
• Vulnerabilities - Find known vulnerabilities for package
• Vulnerabilities - Determine reachable vulnerabilities
• Vulnerabilities - Help triage vulnerabilities
• Binaries - Analyze binaries
• Binaries - Analyze ELF binaries
• Binaries - Analyze Windows binaries
• Binaries - Analyze firmware binaries
• Binaries - Analyze Other binaries
• Matching - Match source code
• Matching - Match binary code
• Tracing - Trace code execution
• Tracing - Trace build
• Code Security - Analyze code statically (SAST/linting)
• Code Security - Analyze code dynamically (DAST)
• Download - Source package
• Download - Source repositories
• Download - Binary package
• Deployment - Deployable as containers (Docker/OCI/k8s/etc)
• Deployment - Deployable in CI/CD pipelines
• Deployment - Deployable as a library
• Run - Run as a command line tool
• Run - Run as a web application
• Run - Run as an API service

other_capabilities

• License - Add license texts