REUSE Tool vs ScanCode.io

REUSE Tool helps software projects keep their own Free Software licensing information complete and machine-readable. Its command-line tools can download full license texts, add copyright and license details to file headers, and lint projects for problems. It can generate a software bill of materials with a command, while the REUSE API displays ongoing compliance status and can provide a badge and JSON output. Teams can run checks in CI/CD workflows such as Drone, Woodpecker CI, Forgejo Actions, GitHub Actions and Docker-based setups. A pre-commit hook can run linting at each Git commit and stop the commit if it reports an error. Installation options include Debian and Fedora packages, pipx, pip and source; Python 3.10 or newer is required. The tool is free, needs no registration and can be used offline. Its scope does not include checking whether a project complies with the licenses of its dependencies. The source code is GPL-3.0-or-later, documentation is CC-BY-SA-4.0, and some configuration and data files are CC0-1.0.

ScanCode.io provides a web interface and API for running software composition analysis scans in scripted pipelines. It scans containers, Docker images, package archives, and manifests for license, copyright, source, and vulnerability information, and can generate or consume CycloneDX and SPDX SBOMs. The same capabilities are available through its command-line interface and REST API. Documented pipeline integrations include GitHub Actions, Jenkins, GitLab, and Azure Pipelines; other CI/CD systems that support Docker can run it too. It can fetch packages using Package URLs and retrieve artifacts from JFrog Artifactory and Sonatype Nexus. Installation is preferably through Docker, including for Windows; Linux server installation is also supported, and an offline Docker package can be transferred to an isolated server. The software is open source under Apache License 2.0 and is free. Authentication for the web interface and API is disabled by default, but can be enabled. Its default setup starts one worker, so it runs one pipeline at a time.