Apache RAT vs FOSSA

Apache RAT is a free, open-source release-audit tool for checking software distributions, with particular attention to license headers. Version 0.18 provides a command-line client, an Ant task library, and a Maven plugin. You can include or exclude files using patterns, collections, pattern files, and file-size limits; apply approved-license lists; and produce plain, XML, missing-header, or unapproved-license reports. The Maven plugin can write target/rat.txt or add a report to a generated site. RAT can add Apache-2.0 headers and copyright notices to files allowed by configuration. XML license definitions are supported, and experienced users can extend matchers, formats, reports, and interfaces. It runs on Linux and is intended for self-hosted, on-premise use. Building requires Java 17, with Maven 3.9.13 or later recommended. Reports need interpretation and project-specific tuning, and heuristics can miss issues.

FOSSA scans software projects for dependencies, vulnerabilities, and license issues across the development lifecycle. Its open-source dependency analysis covers more than 30 languages, and its policy engine can enforce organization-wide license, security, and quality requirements, including build-blocking rules. Teams can generate, import, export, and manage software bills of materials (SBOMs). Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. Quick Import scans source without running the build, so its results are less complete than a CLI scan. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. FOSSA offers web, Linux, API, and self-hosted options; customers can operate its on-premises deployment using Kubernetes and Helm. Free includes five projects, 10 contributing developers, and five imported SBOMs. Business is listed at $2,020,710 a year; Enterprise pricing is custom and not listed.