Apache RAT vs DejaCode

Apache RAT is a free, open-source release-audit tool for checking software distributions, with particular attention to license headers. Version 0.18 provides a command-line client, an Ant task library, and a Maven plugin. You can include or exclude files using patterns, collections, pattern files, and file-size limits; apply approved-license lists; and produce plain, XML, missing-header, or unapproved-license reports. The Maven plugin can write target/rat.txt or add a report to a generated site. RAT can add Apache-2.0 headers and copyright notices to files allowed by configuration. XML license definitions are supported, and experienced users can extend matchers, formats, reports, and interfaces. It runs on Linux and is intended for self-hosted, on-premise use. Building requires Java 17, with Maven 3.9.13 or later recommended. Reports need interpretation and project-specific tuning, and heuristics can miss issues.

DejaCode is an enterprise application for managing open-source license compliance and software supply-chain integrity across products and teams. It tracks open-source and third-party components, with unlimited products, components, and packages in each plan. Teams can store and manage SBOMs, retain historical records for audits, and import CycloneDX, SPDX, or AboutFile formats. Usage policies can be set at license or package level and linked with ScanCode; enforcement is advisory. Integrations include GitHub, GitLab, Jira Cloud, SourceHut, and Forgejo, with REST API and webhook options for other services. AboutCode connections include ScanCode.io for package scanning, PurlDB, and VulnerableCode for vulnerability data. Deployment documentation covers Docker, enterprise, and local development setups. For enterprise deployments, the guidance recommends running your own related service instances to avoid sending sensitive or private data to public endpoints. Team starts at $500 a month and Business at $1,500 a month, each billed annually at the start of the subscription period. Enterprise pricing is custom and not listed. A private evaluation instance with all features and support is available for 30 days.