FossID Workbench vs REUSE Tool

FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. It analyzes direct and transitive dependencies, scans unmanaged source code across programming languages, and detects embedded open-source snippets, including modified code. ID Assist proposes component identifications, while License Extractor extracts file-level license text. Vulnerable Snippet Finder locates code blocks linked to CVEs, with VEX data adding exploitability context. Workbench creates, imports, consolidates, and exports software bills of materials with component, license, vulnerability, and usage information in SPDX or CycloneDX formats. Policy Management can enforce license, security, and usage rules across projects. GitHub, GitLab, and Bitbucket imports are supported, alongside CI/CD scanning, gating, pull-request notifications, and API workflows. Deployment options include cloud, hybrid, on-premises, and offline air-gapped setups. It supports many ecosystems, including JavaScript, Java/Kotlin, Python, Rust, Go, C/C++, .NET, and others. Pricing is available on request.

REUSE Tool helps software projects keep their own Free Software licensing information complete and machine-readable. Its command-line tools can download full license texts, add copyright and license details to file headers, and lint projects for problems. It can generate a software bill of materials with a command, while the REUSE API displays ongoing compliance status and can provide a badge and JSON output. Teams can run checks in CI/CD workflows such as Drone, Woodpecker CI, Forgejo Actions, GitHub Actions and Docker-based setups. A pre-commit hook can run linting at each Git commit and stop the commit if it reports an error. Installation options include Debian and Fedora packages, pipx, pip and source; Python 3.10 or newer is required. The tool is free, needs no registration and can be used offline. Its scope does not include checking whether a project complies with the licenses of its dependencies. The source code is GPL-3.0-or-later, documentation is CC-BY-SA-4.0, and some configuration and data files are CC0-1.0.