[opensourcedex]

fossology is a free, open source compliance & risk management project written in HTML and released under GPL-2.0. It has 1,044 GitHub stars, 675 forks and 290 open issues, and was last pushed 9 hours ago. On this registry it ranks #45 of 56 tracked projects in Compliance & Risk Management, with 5 head-to-head comparisons available. It gained 12 stars over the last 30 tracked days.

What is fossology?

FOSSology is a GPL-2.0 licensed open source license compliance system and toolkit that scans source code for licences, copyrights and export control obligations, and is built for developers, release engineers and compliance teams who must document the open source content they ship.

What it is

FOSSology exists in two shapes at once, and the README is explicit about both. As a toolkit, it runs license, copyright and export control scans from the command line, so a single tree or a single file can be interrogated without any server running. As a system, it adds a PostgreSQL database and a web UI that together provide a compliance workflow, giving a team a shared place to review findings, assign conclusions and keep a record of what was decided about each file.

The concrete problem it solves is the bookkeeping that follows from shipping open source. A project that embeds third-party code has to know which licences are present, which copyright holders must be credited, and whether any file carries export control restrictions. FOSSology replaces the manual pass of grepping headers, opening files one at a time, and hand-assembling a notice file. It is the same job that scattered scripts and spreadsheet inventories attempt, but with a scanner, a database-backed workflow and a generated output behind it.

Key capabilities

  • Command line scans for license, copyright and export control across a source tree, without requiring the server components.
  • A web UI backed by PostgreSQL that turns scan results into a reviewable compliance workflow rather than a one-off report.
  • One-click generation of an SPDX file, and of a ReadMe containing all the copyright notices found in the software.
  • Deduplication that allows an entire distribution to be scanned once and a new version rescanned with only the changed files reprocessed, which the README calls out as a large time saver on big projects.
  • A Dockerfile supporting both single-instance execution and an external PostgreSQL database.
  • A provided docker-compose.yml defining three services: scheduler for analysis tasks, web for the interface, and db for PostgreSQL.
  • Database connection configuration through environment variables including FOSSOLOGY_DB_HOST, defined under the environment key of the compose file.
  • SPDX and SPDX licence handling are treated as first-class concerns, reflected in the project topics spdx and spdx-licenses.

Who uses it and how

  • Distribution and large project maintainers who scan a whole release, then rescan the next version and rely on deduplication to re-examine only what changed.
  • Compliance and legal-adjacent teams that need a review workflow with a persisted record, using the web UI and database rather than reading raw scanner output.
  • Release engineers who need a generated SPDX file or copyright ReadMe as a deliverable alongside a build.
  • Teams running the containerised deployment who pair the fossology/fossology image with a separate PostgreSQL container so data survives restarts.
  • Developers who only want the toolkit and run license, copyright and export control scans straight from the command line.

Getting started

The fastest path is the pre-built image: docker run -p 8081:80 fossology/fossology, reachable at http://IP_OF_DOCKER_HOST:8081/repo with user fossy and password fossy. To run with an external database, use the provided compose file via docker-compose up; source installations install dependencies with utils/fo-installdeps and install/fo-install-pythondeps.

How it compares

This registry supplies no list of paid products that FOSSology replaces, and the facts name no directly comparable tool. On the evidence available it stands alone here: a GPL-2.0 compliance scanner and workflow system with no commercial counterpart recorded alongside it.

When to use it — and when not to

A self-hoster must operate real infrastructure: PostgreSQL as the database server and Apache HTTP Server 2.4 or later as the web server, plus PHP 7.3 or later, with the README warning that the standalone image does not handle data persistence and that an external database is strongly recommended for production. Anyone expecting the tool to settle legal questions should look elsewhere, since FOSSology states plainly that it does not give legal advice. The project also carries a substantial open issue count, so teams needing rapid turnaround on scanner defects should weigh that before committing to the workflow.

project readme (upstream, from github) — read inline

FOSSology

Gitpod ready-to-code GPL-2.0 CII Best Practices Coverage Status Slack Channel GitHub release (latest by date) YouTube Channel REUSE status

About

FOSSology is an open source license compliance software system and toolkit. As a toolkit, you can run license, copyright, and export control scans from the command line. As a system, a database and web UI are provided to give you a compliance workflow. In one click you can generate an SPDX file or a ReadMe with all the copyrights notices from your software. FOSSology deduplication means that you can scan an entire distro, rescan a new version, and only the changed files will get rescanned. This is a big time saver for large projects.

Check out Who Uses FOSSology!

FOSSology does not give legal advice. https://fossology.org/

Requirements

The PHP versions 7.3 and later are supported to work for FOSSology. FOSSology requires PostgreSQL as the database server and Apache HTTP Server 2.4+ as the web server. These and more dependencies are installed by utils/fo-installdeps.

To install Python dependencies, run install/fo-install-pythondeps.

Installation

FOSSology should work with many Linux distributions.

See https://github.com/fossology/fossology/releases for source code download of the releases.

For installation instructions see Install from Source page in GitHub Wiki

Docker

FOSSology comes with a Dockerfile allowing the containerized execution both as a single instance or in combination with an external PostgreSQL database. Note: It is strongly recommended to use an external database for production use since the standalone image does not take care of data persistence.

A pre-built Docker image is available from Docker Hub and can be run using the following command:

docker run -p 8081:80 fossology/fossology

The docker image can then be used using http://IP_OF_DOCKER_HOST:8081/repo user fossy password fossy.

If you want to run Fossology with an external database container, you can use Docker Compose, via the following command: 

docker-compose up

Docker Compose is a tool that allows you to define and run multi-container applications using a YAML file. FOSSology provides a docker-compose.yml file that defines three services: scheduler, web, and db.

The scheduler service runs the FOSSology scheduler daemon, which handles the analysis tasks. The web service runs the FOSSology web server, which provides the web interface. The db service runs a PostgreSQL database server, which stores the FOSSology data.

The docker-compose up command starts all the three services at once.

The FOSSology web service allows you to configure its database connection using some environment variables. These variables are defined in the docker-compose.yml file under the environment key.

  • FOSSOLOGY_DB_HOST: Hostname of the PostgreSQL database server. An integrated PostgreSQL instance is used if not defined or set to localhost.
  • FOSSOLOGY_DB_NAME: Name of the PostgreSQL database. Defaults to fossology.
  • FOSSOLOGY_DB_USER: User to be used for PostgreSQL connection. Defaults to fossy.
  • FOSSOLOGY_DB_PASSWORD: Password to be used for PostgreSQL connection. Defaults to fossy.

You can change them if you want to use a different database server or credentials.

Notes on PostgreSQL volume mounts (Docker)

When running FOSSology using Docker, the PostgreSQL data directory should follow the mount path recommended by the official Postgres container documentation:

https://hub.docker.com/_/postgres

Avoid using version-specific internal paths such as:

/var/lib/postgresql/16/data

These directories may not be persisted as expected when containers are recreated. Always rely on the directory structure defined by the Postgres image.

Vagrant

FOSSology comes with a Vagrantfile that can be used to create an isolated environment for FOSSology and its dependencies.

Pre-requisites: Vagrant >= 2.x and VirtualBox >= 5.2.x

Steps:

git clone https://github.com/fossology/fossology
cd fossology/
vagrant up

The server must be ready at http://localhost:8081/repo/. The login credentials are:

user: fossy
pass: fossy

Test Instance

For trying out FOSSology quickly, a test instance is also available at https://fossology.osuosl.org/. This instance can be deleted or reinstalled at any time, thus it is not suitable for production use. The login credentials are as follows:

Username: fossy
Password: fossy

Note: The test instance is not up to date with the latest release. The instance will reset every night at 2 am UTC and all the user uploaded data will be lost.

Quick dev prototype with GitPod.io

FOSSology is ready to be coded on GitPod.io. To use it, you would need to setup an account. You can directly use the following button to launch the project on GitPod.io: Link to Gitpod

Once in, you should see 2 terminals, one running FOSSology scheduler and one running the installation.

Handy scripts/aliases

For the ease of usability, following aliases/scripts have been defined and can be used:

  • conffoss: This will reconfigure cmake with all variables
  • buildfoss: This will build the FOSSology using cmake
  • installfoss: This will install FOSSology
  • fossrun: Run the FOSSology scheduler
  • pg_stop: Stop PostgreSQL server
  • pg_start: Start PostgreSQL server

Documentation

We are currently migrating our documentation to GitHub. At this stage, you can find general documentation at: https://www.fossology.org/get-started/basic-workflow/ and developer docs on GitHub Wiki and https://fossology.github.io/

Support

Mailing lists, FAQs, Release Notes, and other useful info are available by clicking the documentation tab on the project website. We encourage all users to join the mailing list and participate in discussions. You can also join FOSSology's official space on Slack: Join Slack

If you'd like to talk to other FOSSology users and developers. See Contact Us

Contributing

We really like contributions in several forms, see CONTRIBUTING.md

Licensing

The original FOSSology source code and associated documentation including these web pages are Copyright (C) 2007-2012 HP Development Company, L.P. In the past years, other contributors added source code and documentation to the project, see the NOTICES file or the referring files for more information.

Any modifications or additions to source code or documentation contributed to the FOSSology project are Copyright (C) the contributor, and should be noted as such in the comments section of the modified file(s).

FOSSology is licensed under GPL-2.0

This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; version 2 of the License

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License along
with this program; if not, write to the Free Software Foundation, Inc.,
51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

Exception:

All of the FOSSology source code is licensed under the terms of the GNU General Public License version 2, with the following exceptions:

libfossdb and libfossrepo libraries are licensed under the terms of the GNU Lesser General Public License version 2.1, LGPL-2.1.

This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License.

This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
Lesser General Public License for more details.

You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
02110-1301  USA

Please see the LICENSE file included with this software for the full texts of these licenses.

Note: Regardless of the installation type, ensure you increase upload_max_filesize and memory_limit in your php.ini configuration to handle large uploads. See Configuring PHP in the wiki for details.

Frequently asked questions

Is fossology free to use?

fossology is open source under the GPL-2.0 licence. There is no licence fee and no seat count — you can self-host it or, where the project offers one, pay a vendor for a managed version instead.

What does fossology do?

FOSSology is an open source license compliance software system and toolkit. As a toolkit you can run license, copyright and export control scans from the comma

What is fossology written in?

fossology is primarily written in HTML. Its source is publicly available at https://github.com/fossology/fossology, and it has 1,044 GitHub stars.