Apache RAT vs SBOM Workbench
Apache RAT
creadur.apache.orgSBOM Workbench
scanoss.readthedocs.ioSide by side
| Figure | Apache RAT | SBOM Workbench |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Open Source License Compliance Software | 8.5 (#3) | 7.5 (#22) |
| Purpose | Apache RAT audits software distributions, with a focus on license headers. | SBOM Workbench is a graphical interface for scanning and auditing source code using the SCANOSS API. |
| Support | The project invites users to contribute patches, report bugs, and talk to the community. | SCANOSS directs users to contact its support team by email at [email protected]. |
Plans
In their own words
Apache RAT
Apache RAT is a free, open-source release-audit tool for checking software distributions, with particular attention to license headers. Version 0.18 provides a command-line client, an Ant task library, and a Maven plugin. You can include or exclude files using patterns, collections, pattern files, and file-size limits; apply approved-license lists; and produce plain, XML, missing-header, or unapproved-license reports. The Maven plugin can write target/rat.txt or add a report to a generated site. RAT can add Apache-2.0 headers and copyright notices to files allowed by configuration. XML license definitions are supported, and experienced users can extend matchers, formats, reports, and interfaces. It runs on Linux and is intended for self-hosted, on-premise use. Building requires Java 17, with Maven 3.9.13 or later recommended. Reports need interpretation and project-specific tuning, and heuristics can miss issues.
SBOM Workbench
SBOM Workbench is a graphical tool for scanning and auditing source code through the SCANOSS API. It identifies open-source components, including undeclared code that may not appear in dependency manifests, and the free version identifies licenses and security vulnerabilities. It generates SPDX-Lite software bills of materials; release notes also list CycloneDX, SPDX Lite, CSV, and HTML exports. The tool is aimed at developers and runs on Linux, macOS, and Windows. Its CLI can use multiple SCANOSS API endpoints, including custom servers. Listed integrations include pre-commit hooks, Actions, pipelines, and webhooks, while Bitbucket is marked as coming soon. Repository documentation describes a collaborative workspace. The distributed software is described by SCANOSS as open source, and the Workbench has a public GitHub repository. Cryptographic algorithm identification is a premium feature, not included in the free Workbench. It is free to download, and SCANOSS directs support requests to email. Paid SCANOSS subscription prices listed for other offerings are not Workbench prices.