Skip to content
SPECIFICTION
Get listed

Apache RAT

creadur.apache.org

Free plan LinuxSelf-hosted
Visit creadur.apache.org
Spec score 8.5 #3 of 28 in Open Source License Compliance Software

What it is

Apache RAT is a free, open-source release-audit tool for checking software distributions, with particular attention to license headers. Version 0.18 provides a command-line client, an Ant task library, and a Maven plugin. You can include or exclude files using patterns, collections, pattern files, and file-size limits; apply approved-license lists; and produce plain, XML, missing-header, or unapproved-license reports. The Maven plugin can write target/rat.txt or add a report to a generated site. RAT can add Apache-2.0 headers and copyright notices to files allowed by configuration. XML license definitions are supported, and experienced users can extend matchers, formats, reports, and interfaces. It runs on Linux and is intended for self-hosted, on-premise use. Building requires Java 17, with Maven 3.9.13 or later recommended. Reports need interpretation and project-specific tuning, and heuristics can miss issues.

Spec sheet

Purpose
Apache RAT audits software distributions, with a focus on license headers.Read 8 Oct 2026 · creadur.apache.org
Support
The project invites users to contribute patches, report bugs, and talk to the community.Read 8 Oct 2026 · creadur.apache.org
License
Apache Creadur licenses its software to the public under the Apache License, Version 2.0.Read 8 Oct 2026 · creadur.apache.org
Caveat
RAT relies on heuristics that may miss issues, and its reports require interpretation and may need project-specific tuning.Read 8 Oct 2026 · creadur.apache.org
Configuration
Command-line options support file inclusion and exclusion, license approval lists, and report output styles including missing-header and unapproved-license reports.Read 8 Oct 2026 · creadur.apache.org
Download integrity
The project recommends verifying downloaded release files with signatures from its main distribution directories and provides PGP signatures and SHA512 checksums.Read 8 Oct 2026 · creadur.apache.org
Extensibility
Users can add license definitions through XML, and can extend matchers, definition formats, reports, and user interfaces with the relevant expertise.Read 8 Oct 2026 · creadur.apache.org
File selection
RAT supports including and excluding files with patterns, standard collections, files of patterns, and file-size exclusions.Read 8 Oct 2026 · creadur.apache.org
Header editing
The command-line tool can add Apache-2.0 license headers and copyright notices to files that are not excluded by its configuration.Read 8 Oct 2026 · creadur.apache.org
Integrity checks
The project recommends verifying downloaded releases with signatures from its main distribution directories; it also provides PGP signatures and SHA-512 checksums.Read 8 Oct 2026 · creadur.apache.org
Interfaces
RAT 0.18 ships with a command-line client, an Ant task library, and a Maven plugin.Read 8 Oct 2026 · creadur.apache.org
License review
RAT is a release audit tool focused on licenses and is intended to improve the accuracy and efficiency of checking releases for licenses.Read 8 Oct 2026 · creadur.apache.org
Limitations
RAT highlights possible issues, its reports require interpretation, it may need tuning, and its heuristics may miss issues.Read 8 Oct 2026 · creadur.apache.org
Maven reports
The Maven plugin can write a text report to target/rat.txt or add a report to the generated site.Read 8 Oct 2026 · creadur.apache.org
Output formats
The package includes stylesheets for missing-header reports, unapproved-license reports, plain output, and pretty-printed XML.Read 8 Oct 2026 · creadur.apache.org
Primary use
RAT is intended to improve the accuracy and efficiency of checking software releases for licenses.Read 8 Oct 2026 · creadur.apache.org
Release
The downloads page lists Apache Creadur RAT 0.18 as the latest release and offers binary and source archives.Read 8 Oct 2026 · creadur.apache.org
Runtime
RAT requires Java 17; its documentation recommends Java 21 for generating Javadocs due to an existing JDK error.Read 8 Oct 2026 · creadur.apache.org
Runtime requirements
Building RAT requires Java 17, and the project recommends Apache Maven 3.9.13 or later.Read 8 Oct 2026 · creadur.apache.org
Security reporting
The Apache Security Team asks that potential vulnerabilities be reported first to a private Apache security mailing list.Read 8 Oct 2026 · apache.org

Plans and prices

Apache RAT Free Open-source release audit tool · latest release 0.18 Read 8 Oct 2026 · creadur.apache.org

Every Apache RAT plan and price →

Strong points and limits

Strong points

  • Free plan with no stated charge
  • Command line, Ant, and Maven interfaces
  • Configurable file inclusion and exclusion
  • Can add Apache-2.0 headers
  • Binary and source archives available

Limits

  • Reports require interpretation
  • Heuristics may miss issues
  • Project-specific tuning may be needed
  • Building requires Java 17

Who it suits

RAT suits release teams that need license-focused audits on Linux or self-hosted infrastructure. It is also aimed at projects able to interpret reports and tune heuristic checks.

Verdict

Apache RAT provides several integration points and detailed license-report configuration for release audits. Its findings are advisory, so teams must review results and adjust settings.

Where Specifiction places it

Alternatives to Apache RATAll alternatives →