FOSSology vs SourceTrust

FOSSology is an open-source system for examining software for license, copyright, and export-control information. Upload individual files or packages, then unpack and scan them with selected agents. Nomos looks for license indicators through phrases, regular expressions, and heuristics; Monk checks text against stored license texts or phrases supplied by users. Its web interface supports review of findings, license-text management, bulk recognition, aggregated file views, and reusing reviews for files with matching hashes. It can identify copyright statements and presents keyword-based findings that users can review for possible export-control relevance. Reports include SPDX 2.0 exports, Debian copyright files, hierarchical file lists with license identifiers, and Readme files with identified license and copyright details. A REST API supports CI/CD use, uploads, and scan triggers from other applications; the command line can retrieve SPDX files. Deployment options include Docker, Vagrant with VirtualBox, or source installation. It is free, with on-premise deployment options. One stated limit: it cannot determine which libraries produced a binary; binary analysis tools are needed for that task.

SourceTrust helps teams review third-party software licenses and publish shareable compliance pages for shipped products. It collects direct and transitive dependencies from repositories, lockfiles, and SBOMs into one inventory. The service retrieves each shipped package, compares it with the registry digest, and reads the license text inside. Nothing is published until a team reviews and confirms the record, while packages needing a decision are flagged. Connections include GitHub, GitLab, and Azure DevOps, with lockfile and SBOM imports across 14 formats and 9 ecosystems. Outputs include a hosted attestation page, THIRD_PARTY_LICENSES.md, NOTICE, CycloneDX, SPDX, JSON, CSV, plist, and branded PDF. Repository synchronization and publish-drift checks identify changes from the published snapshot. Pages can be password-protected or excluded from search engines. Eligible public GitHub projects can publish for $0 under fair use and attribution. Yearly project billing is $299.00 per year.