FOSSLight Hub vs FOSSology
FOSSLight Hub
fosslight.org
FOSSology
fossology.orgSide by side
| Figure | FOSSLight Hub | FOSSology |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 2 |
| Spec score · Open Source License Compliance Software | 7.8 (#12) | 8.8 (#2) |
| Deployment | The maker documents Docker and Docker Compose installation, or a Java installation requiring Java 11 or higher, MariaDB 10.0 or higher or MySQL 5.6 or higher, and at least 8 GB memory. | The project describes installation using Docker, Vagrant with VirtualBox, or source installation. |
| Intended users | Project distribution types include general software distribution, internal transfer, B2B, internal-only software, self-check, and open source contribution. | The project says its community includes companies, individuals, and groups using the toolkit or system to improve their ability to comply with open-source licenses. |
| License | The Hub is released under the AGPL-3.0 open source license. | The main source is GPL-2.0; libfossdb and libfossrepo are exceptions licensed LGPL-2.1. |
| Purpose | FOSSLight Hub manages open source, licenses, vulnerabilities, project BOMs, and open source compliance workflows. | FOSSology is an open-source license-compliance system and toolkit for scanning software for license, copyright, and export-control information. |
Plans
In their own words
FOSSLight Hub
FOSSLight Hub has no write-up on Specifiction yet; its figures are above.
FOSSology
FOSSology is an open-source system for examining software for license, copyright, and export-control information. Upload individual files or packages, then unpack and scan them with selected agents. Nomos looks for license indicators through phrases, regular expressions, and heuristics; Monk checks text against stored license texts or phrases supplied by users. Its web interface supports review of findings, license-text management, bulk recognition, aggregated file views, and reusing reviews for files with matching hashes. It can identify copyright statements and presents keyword-based findings that users can review for possible export-control relevance. Reports include SPDX 2.0 exports, Debian copyright files, hierarchical file lists with license identifiers, and Readme files with identified license and copyright details. A REST API supports CI/CD use, uploads, and scan triggers from other applications; the command line can retrieve SPDX files. Deployment options include Docker, Vagrant with VirtualBox, or source installation. It is free, with on-premise deployment options. One stated limit: it cannot determine which libraries produced a binary; binary analysis tools are needed for that task.