Skip to content
SPECIFICTION
Get listed

SW360

eclipse.dev

Free plan WebLinuxAPISelf-hosted
Visit eclipse.dev
Spec score 7.4 #23 of 28 in Open Source License Compliance Software

What it is

SW360 is an open-source catalogue and repository for organizing software component information across an organization. It records components, releases, and projects, manages license information and obligations, and supports workflows that produce license-related documents. Software Bill of Materials management is listed as a use case, with SPDX RDF/XML and CycloneDX import formats. SW360 also collects vulnerability information and matches it with components in its component service. A REST API exposes its functions, with documented HTTP Basic, API token, OAuth2, and Keycloak authentication options. The recommended version 20 deployment uses Docker- or Podman-compatible containers for the frontend, Keycloak, CouchDB, and Spring Boot backend. SW360 can trigger FOSSology clearing and import its reports, while FOSSology performs license scanning. SW360 itself does not scan licenses or source code. The project is free, licensed under EPL-2.0, and designed for self-managed deployment. Version 20.1.0 is listed as dated July 29, 2026.

Spec sheet

Purpose
SW360 is a software catalogue and repository for collecting, organizing, and sharing information about software components used in an organization.Read 5 Oct 2026 · eclipse.dev
Deployment
The recommended SW360 v20 deployment uses containers compatible with Docker or Podman and includes the frontend, Keycloak, CouchDB, and Spring Boot backend.Read 5 Oct 2026 · eclipse.dev
License
The project is open source and licensed under EPL-2.0.Read 5 Oct 2026 · eclipse.dev
Founded
2016Read 28 Sep 2026 · eclipse.dev
API and integrations
SW360 exposes its functionality through a REST API and documents HTTP Basic, API token, OAuth2, and Keycloak authentication options.Read 5 Oct 2026 · eclipse.dev
Component tracking
SW360 tracks software components used in projects or products and maintains related component, release, and project information.Read 5 Oct 2026 · eclipse.dev
FOSSology integration
SW360 can trigger a FOSSology clearing process and import its reports; FOSSology performs the license scanning.Read 5 Oct 2026 · eclipse.dev
Latest release shown
The Eclipse project page lists version 20.1.0, dated July 29, 2026.Read 5 Oct 2026 · projects.eclipse.org
License compliance
The application manages license information and obligations and supports workflows for producing license-related documents.Read 5 Oct 2026 · eclipse.dev
Notable limitation
License scanning and source code scanning are outside SW360’s scope; it delegates scanning to specialized tools and exchanges data with them.Read 5 Oct 2026 · projects.eclipse.org
SBOMs
The user guide lists Software Bill of Materials management as a use case.Read 5 Oct 2026 · eclipse.dev
Security configuration
The security guide recommends TLS with trusted certificates, secret management, and restricting bearer-token validation to trusted issuers.Read 5 Oct 2026 · eclipse.dev
Support and community
The documentation lists a developer mailing list, a public Slack channel, and open developer meetings.Read 5 Oct 2026 · eclipse.dev
Vulnerabilities
SW360 collects vulnerability management information and matches it with components stored in its component service.Read 5 Oct 2026 · eclipse.dev
Who it is for
The project identifies quality managers, software developers, legal counsels, software architects, and R&D managers among the roles served.Read 5 Oct 2026 · eclipse.dev

Plans and prices

SW360 Free Open source · EPL-2.0 · Self-managed deployment Read 5 Oct 2026 · eclipse.dev

Every SW360 plan and price →

Strong points and limits

Strong points

  • Tracks components, releases, and project records
  • Supports license obligations and attribution reports
  • Imports SPDX RDF/XML and CycloneDX SBOMs
  • Provides REST API authentication choices
  • Offers Docker or Podman-compatible deployment

Limits

  • License and source scanning are outside scope
  • Scanning depends on specialized external tools
  • Deployment is self-managed
  • Security requires configuring TLS and trusted issuers

Who it suits

SW360 is aimed at quality managers, software developers, legal counsels, software architects, and R&D managers handling component, license, vulnerability, or SBOM information.

Verdict

SW360 provides a free, open-source system for component records, compliance workflows, SBOM handling, and vulnerability information. Organizations must supply separate scanning tools and manage the deployment and security configuration themselves.

Where Specifiction places it

Alternatives to SW360All alternatives →