Apache RAT vs SW360

Apache RAT is a free, open-source release-audit tool for checking software distributions, with particular attention to license headers. Version 0.18 provides a command-line client, an Ant task library, and a Maven plugin. You can include or exclude files using patterns, collections, pattern files, and file-size limits; apply approved-license lists; and produce plain, XML, missing-header, or unapproved-license reports. The Maven plugin can write target/rat.txt or add a report to a generated site. RAT can add Apache-2.0 headers and copyright notices to files allowed by configuration. XML license definitions are supported, and experienced users can extend matchers, formats, reports, and interfaces. It runs on Linux and is intended for self-hosted, on-premise use. Building requires Java 17, with Maven 3.9.13 or later recommended. Reports need interpretation and project-specific tuning, and heuristics can miss issues.

SW360 is an open-source catalogue and repository for organizing software component information across an organization. It records components, releases, and projects, manages license information and obligations, and supports workflows that produce license-related documents. Software Bill of Materials management is listed as a use case, with SPDX RDF/XML and CycloneDX import formats. SW360 also collects vulnerability information and matches it with components in its component service. A REST API exposes its functions, with documented HTTP Basic, API token, OAuth2, and Keycloak authentication options. The recommended version 20 deployment uses Docker- or Podman-compatible containers for the frontend, Keycloak, CouchDB, and Spring Boot backend. SW360 can trigger FOSSology clearing and import its reports, while FOSSology performs license scanning. SW360 itself does not scan licenses or source code. The project is free, licensed under EPL-2.0, and designed for self-managed deployment. Version 20.1.0 is listed as dated July 29, 2026.