FOSSA vs REUSE Tool

FOSSA scans software projects for dependencies, vulnerabilities, and license issues across the development lifecycle. Its open-source dependency analysis covers more than 30 languages, and its policy engine can enforce organization-wide license, security, and quality requirements, including build-blocking rules. Teams can generate, import, export, and manage software bills of materials (SBOMs). Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. Quick Import scans source without running the build, so its results are less complete than a CLI scan. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. FOSSA offers web, Linux, API, and self-hosted options; customers can operate its on-premises deployment using Kubernetes and Helm. Free includes five projects, 10 contributing developers, and five imported SBOMs. Business is listed at $2,020,710 a year; Enterprise pricing is custom and not listed.

REUSE Tool helps software projects keep their own Free Software licensing information complete and machine-readable. Its command-line tools can download full license texts, add copyright and license details to file headers, and lint projects for problems. It can generate a software bill of materials with a command, while the REUSE API displays ongoing compliance status and can provide a badge and JSON output. Teams can run checks in CI/CD workflows such as Drone, Woodpecker CI, Forgejo Actions, GitHub Actions and Docker-based setups. A pre-commit hook can run linting at each Git commit and stop the commit if it reports an error. Installation options include Debian and Fedora packages, pipx, pip and source; Python 3.10 or newer is required. The tool is free, needs no registration and can be used offline. Its scope does not include checking whether a project complies with the licenses of its dependencies. The source code is GPL-3.0-or-later, documentation is CC-BY-SA-4.0, and some configuration and data files are CC0-1.0.