From a399c03722157213f6a95c53c8c7659ed5ea1d08 Mon Sep 17 00:00:00 2001 From: Dennis Clark Date: Mon, 9 Jun 2025 16:35:40 -0700 Subject: [PATCH 1/6] Update README.md testing markdown editing --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 15940c8..d48eba3 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# AboutCode +# AboutCode Revisited ### What is AboutCode? From 077168614829a18b8fe2069be57f65dced12bb48 Mon Sep 17 00:00:00 2001 From: Dennis Clark Date: Tue, 10 Jun 2025 09:24:20 -0700 Subject: [PATCH 2/6] Update README.md minor text edit --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index d48eba3..94a5840 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,7 @@ ### What is AboutCode? -AboutCode is a family of FOSS projects to uncover data ... about software: +AboutCode is a family of FOSS projects to uncover metadata about software: - where does the code come from? which software package? - what is its license? copyright? From db0171d01effe9f72929b4112868531f2bf3a426 Mon Sep 17 00:00:00 2001 From: Dennis Clark Date: Tue, 10 Jun 2025 09:30:16 -0700 Subject: [PATCH 3/6] Update README.md Add DejaCode to list of projects. --- README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 94a5840..ae0cc2f 100644 --- a/README.md +++ b/README.md @@ -70,6 +70,10 @@ Each AboutCode project has its own repository: standalone tool Vulntotal to compare this vulneribility information across similar tools. This is maintained by @tg1999 and @pombredanne +- **[DejaCode](https://github.com/aboutcode-org/dejacode)**: is a + complete enterprise-level application to automate open source license + compliance and ensure software supply chain integrity. + - **[univers](https://github.com/aboutcode-org/univers)** is a package to parse and compare all the package versions and all the ranges. @@ -126,7 +130,7 @@ Each AboutCode project has its own repository: Linux and construct a build graph from syscalls to show which files are used to build a binary. We are contributors to strace. Maintained by @pombredanne -We also co-started and worked closely with other FOSS orgs and projects: +We have also co-started and worked closely with other FOSS orgs and projects: - [Package URL](https://github.com/package-url): a widely used standard to reference software packages of all types with simple, readable and concise From f0183bab0e5b409f70b6ec3ef418e98c8d3371ba Mon Sep 17 00:00:00 2001 From: Dennis Clark Date: Mon, 16 Jun 2025 10:34:59 -0700 Subject: [PATCH 4/6] Update README.md Edited project list to use consistent language style. --- README.md | 34 ++++++++++++++++++---------------- 1 file changed, 18 insertions(+), 16 deletions(-) diff --git a/README.md b/README.md index ae0cc2f..e8eff06 100644 --- a/README.md +++ b/README.md @@ -58,31 +58,32 @@ Each AboutCode project has its own repository: scan-related tools in one process flow. This is the most popular project and is used by 100's of software teams . The lead maintainer is @pombredanne -- **[Scancode.io](https://github.com/aboutcode-org/scancode.io)**: is a +- **[Scancode.io](https://github.com/aboutcode-org/scancode.io)**: a web-based and API to run and review scans in rich scripted pipelines, on different kinds of containers, docker images, package archives, manifests etc, to get information on licenses, copyrights, source, vulneribilities. The lead maintainer is @tdruez -- **[VulnerableCode](https://github.com/aboutcode-org/vulnerablecode)**: is a +- **[VulnerableCode](https://github.com/aboutcode-org/vulnerablecode)**: a web-based API and database to collect and track all the known software package vulnerabilities, with affected and fixed packages, references and a standalone tool Vulntotal to compare this vulneribility information across similar tools. This is maintained by @tg1999 and @pombredanne -- **[DejaCode](https://github.com/aboutcode-org/dejacode)**: is a - complete enterprise-level application to automate open source license - compliance and ensure software supply chain integrity. - -- **[univers](https://github.com/aboutcode-org/univers)** is a package to +- **[univers](https://github.com/aboutcode-org/univers)**: a package to parse and compare all the package versions and all the ranges. -- **[purlDB](https://github.com/aboutcode-org/purldb)** consists of tools to - create and expose a database of purls (Package URLs) and also has package +- **[purlDB](https://github.com/aboutcode-org/purldb)**: tools to + create and expose a database of purls (Package URLs) along with package data for all of these packages created from scans. This is maintained by @jyang -- **[FetchCode](https://github.com/aboutcode-org/fetchcode)** is a library to +- **[DejaCode](https://github.com/aboutcode-org/dejacode)**: a + complete enterprise-level application, powered by ScanCode, + VulnerableCode and purlDB, to automate open source license + compliance and ensure software supply chain integrity. + +- **[FetchCode](https://github.com/aboutcode-org/fetchcode)**: a library to reliably fetch any code via HTTP, FTP and version control systems such as git. @@ -101,8 +102,8 @@ Each AboutCode project has its own repository: Docker images using static analysis. Maintained by @pombredanne - **[python-inspector](https://github.com/aboutcode-org/python-inspector)** - and **[nuget inspector](https://github.com/aboutcode-org/nuget-inspector/)** - inspects manifests and code to resolve dependencies (vulnerable and + and **[nuget inspector](https://github.com/aboutcode-org/nuget-inspector/)**: + tools to inpsect manifests and code to resolve dependencies (vulnerable and non-vulnerable) for python and nuget packages respectively. - **[license-expression](https://github.com/aboutcode-org/license-expression/)**: @@ -132,11 +133,12 @@ Each AboutCode project has its own repository: We have also co-started and worked closely with other FOSS orgs and projects: -- [Package URL](https://github.com/package-url): a widely used standard to - reference software packages of all types with simple, readable and concise - URLs. +- [Package URL](https://github.com/package-url): a widely used standard to identify + precisely software packages of all types with simple, readable and concise URLs. + The PURL standard is currently being prepared for Ecma standardization. + See https://github.com/package-url/purl-spec/discussions for more details. -- [SPDX](http://SPDX.org): aka. Software Package Data Exchange, a spec to +- [SPDX](http://SPDX.org): aka System Package Data Exchange, a spec to document the origin and licensing of packages. - [CycloneDX](https://cyclonedx.org) aka. OWASP CycloneDX is a full-stack Bill From 06092182701ee88627e7f28ee71864ba35b3b65e Mon Sep 17 00:00:00 2001 From: Dennis Clark Date: Thu, 4 Dec 2025 12:34:06 -0800 Subject: [PATCH 5/6] Update README.md Project LIst --- README.md | 515 +++++++++++++++++++++++++++++++++++++++++++++--------- 1 file changed, 433 insertions(+), 82 deletions(-) diff --git a/README.md b/README.md index e8eff06..f7d8ca3 100644 --- a/README.md +++ b/README.md @@ -50,88 +50,439 @@ We have a weekly meeting, see more details ### Projects -Each AboutCode project has its own repository: - -- **[ScanCode Toolkit](https://github.com/aboutcode-org/scancode-toolkit)**: a - set of code scanning tools to detect the origin and license of code and - dependencies. ScanCode now uses a plug-in architecture to run a series of - scan-related tools in one process flow. This is the most popular project and - is used by 100's of software teams . The lead maintainer is @pombredanne - -- **[Scancode.io](https://github.com/aboutcode-org/scancode.io)**: a - web-based and API to run and review scans in rich scripted pipelines, on - different kinds of containers, docker images, package archives, manifests - etc, to get information on licenses, copyrights, source, vulneribilities. - The lead maintainer is @tdruez - -- **[VulnerableCode](https://github.com/aboutcode-org/vulnerablecode)**: a - web-based API and database to collect and track all the known software - package vulnerabilities, with affected and fixed packages, references and a - standalone tool Vulntotal to compare this vulneribility information across - similar tools. This is maintained by @tg1999 and @pombredanne - -- **[univers](https://github.com/aboutcode-org/univers)**: a package to - parse and compare all the package versions and all the ranges. - -- **[purlDB](https://github.com/aboutcode-org/purldb)**: tools to - create and expose a database of purls (Package URLs) along with package - data for all of these packages created from scans. This is maintained by - @jyang - -- **[DejaCode](https://github.com/aboutcode-org/dejacode)**: a - complete enterprise-level application, powered by ScanCode, - VulnerableCode and purlDB, to automate open source license - compliance and ensure software supply chain integrity. - -- **[FetchCode](https://github.com/aboutcode-org/fetchcode)**: a library to - reliably fetch any code via HTTP, FTP and version control systems such as - git. - -- **[Scancode Workbench](https://github.com/aboutcode-org/scancode-workbench)**: - a desktop application based on typescript and react to visualize and review - scan results from scancode scans. - -- **[AboutCode Toolkit](https://github.com/aboutcode-org/aboutcode-toolkit)**: - a set of command line tools to document the provenance of your code and - generate attribution notices. AboutCode Toolkit uses small yaml files to - document code provenance inside a codebase. The lead maintainer is - @chinyeungli - -- **[container-inspector](https://github.com/aboutcode-org/container-inspector)**: - a tool to analyze the structure and provenance of software components in - Docker images using static analysis. Maintained by @pombredanne - -- **[python-inspector](https://github.com/aboutcode-org/python-inspector)** - and **[nuget inspector](https://github.com/aboutcode-org/nuget-inspector/)**: - tools to inpsect manifests and code to resolve dependencies (vulnerable and - non-vulnerable) for python and nuget packages respectively. - -- **[license-expression](https://github.com/aboutcode-org/license-expression/)**: - a library to parse, analyze, compare and normalize SPDX and SPDX-like - license expressions using a boolean logic expression engine. See - https://spdx.org/spdx-specification-21-web-version#h.jxpfx0ykyb60 to - understand what an expression is. See - https://github.com/aboutcode-org/license-expression for the code. The - underlying boolean engine is live at https://github.com/bastikr/boolean.py . - Both are co-maintained by @pombredanne - -- **ABCD aka AboutCode Data**: a simple set of conventions to define data - structures that all the AboutCode tools can understand and use to exchange - data. The details are at - [AboutCode Data](https://aboutcode.readthedocs.io/en/latest/aboutcode-data/abcd.html). - ABOUT files and ScanCode Toolkit data are examples of this approach. Other - projects such as https://libraries.io and and - [OSS Review Toolkit](https://github.com/heremaps/oss-review-toolkit) are - also using these conventions. - -- **[TraceCode Toolkit](https://github.com/aboutcode-org/tracecode-toolkit)**: - a set of tools to trace files from your deployment or distribution packages - back to their origin in a development codebase or repository. The primary - tool uses strace https://github.com/strace/strace/ to trace system calls on - Linux and construct a build graph from syscalls to show which files are used - to build a binary. We are contributors to strace. Maintained by @pombredanne - -We have also co-started and worked closely with other FOSS orgs and projects: +## **ScanCode Toolkit** + +[https://github.com/aboutcode-org/scancode-toolkit](https://github.com/aboutcode-org/scancode-toolkit) + +### **What** + +ScanCode Toolkit is a set of code scanning tools that detect the origin (copyrights), license and vulnerabilities of code, packages and dependencies in a codebase. + +### **Why** + +ScanCode Toolkit is the leading tool in scanning depth and accuracy, used by hundreds of software teams. You can use ScanCode Toolkit as a command line tool or as a library. + +### **Custodian** + +The primary ScanCode Toolkit custodian is [https://github.com/AyanSinhaMahapatra](https://github.com/AyanSinhaMahapatra) + + +## [**ScanCode.io**](http://ScanCode.io) + +[https://github.com/aboutcode-org/scancode.io](https://github.com/aboutcode-org/scancode.io) + +### **What** + +ScanCode.io provides a Web UI and API to run and review complex scans in rich scripted pipelines, on different kinds of containers, docker images, package archives, manifests etc, to get information on licenses, copyrights, sources, and vulnerabilities. + +### **Why** + +ScanCode.io provides an easy-to-use front-end to ScanCode Toolkit and other AboutCode projects.The flexible pipeline technology supports advanced scanning tasks such as container scanning and deploy-to-develop analysis. You can run ScanCode.io in a Docker container or install it on a Linux server. It provides full support for generating and consuming CycloneDX and SPDX SBOMs. + +### **Custodian** + +The primary ScanCode.io custodian is [https://github.com/tdruez](https://github.com/tdruez) + +## **ScanCode LicenseDB** + +[https://github.com/aboutcode-org/scancode-licensedb](https://github.com/aboutcode-org/scancode-licensedb) + +### **What** + +ScanCode LIcenseDB is a free and open database of software and related licenses with over 2400 curated license texts, their metadata and ScanCode license detection rules. There is a public database available at: [https://scancode-licensedb.aboutcode.org/](https://scancode-licensedb.aboutcode.org/) + +### **Why** + +ScanCode LIcenseDB provides the most comprehensive list of software license identifiers, supporting SPDX-compliant license expressions. API access is available to the public database. + +### **Custodian** + +The primary ScanCode LIcenseDB custodians are [https://github.com/AyanSinhaMahapatra](https://github.com/AyanSinhaMahapatra) and [https://github.com/DennisClark](https://github.com/DennisClark) + + +## **ScanCode Workbench** + +[https://github.com/aboutcode-org/scancode-workbench](https://github.com/aboutcode-org/scancode-workbench) + +### **What** + +ScanCode Workbench is an application to visualize and review scan results from ScanCode Toolkit scans. You can install and use the Workbench on a Linux, MacOS or Windows desktop. + +### **Why** + +ScanCode Workbench provides an easy-to-use tool to review and edit ScanCode Toolkit results. + +### **Custodian** + +The primary ScanCode Workbench custodians are [https://github.com/AyanSinhaMahapatra](https://github.com/AyanSinhaMahapatra) and [https://github.com/mjherzog](https://github.com/mjherzog) + +## **DejaCode** + +[https://github.com/aboutcode-org/dejacode](https://github.com/aboutcode-org/dejacode) + +### **What** + +DejaCode provides an enterprise-level application to automate open source license compliance and ensure software supply chain integrity, powered by ScanCode. + +### **Why** + +DejaCode is your system of record as a single source of truth with quality data for licenses, vulnerabilities, and package provenance and metadata, enabling you to ensure FOSS compliance with enterprise-grade features and integrations for DevOps and software systems. + +### **Custodian** + +The primary DejaCode custodians are [https://github.com/tdruez](https://github.com/tdruez) and [https://github.com/DennisClark](https://github.com/DennisClark) + +## **VulnerableCode** + +[https://github.com/aboutcode-org/vulnerablecode](https://github.com/aboutcode-org/vulnerablecode) + +### **What** + +VulnerableCode provides a Web UI and API to access a database of known software package vulnerabilities with comprehensive information from upstream and downstream public sources including packages affected by a vulnerability and packages that fix a vulnerability. There is a public VulnerableCode database at: [https://public.vulnerablecode.io/](https://public.vulnerablecode.io/) and the project also provides the tools to build your own instance of the database. + +### **Why** + +Known software package vulnerabilities are aggregated in a single database to query a richer graph of relations between multiple versions of a package identified by Package-URL (PURL). + +### **Custodian** + +The primary VulnerableCode custodians are [https://github.com/TG1999](https://github.com/TG1999) and [https://github.com/keshav-space](https://github.com/keshav-space) + +## **PURLDB** + +[https://github.com/aboutcode-org/purldb](https://github.com/aboutcode-org/purldb) + +### **What** + +PURLDB provides tools to create and update a database of package metadata keyed by PURL (Package URL) and an API for the PURL data. + +### **Why** + +Take advantage of the PURLDB to get fast pre-scanned metadata for popular software packages, integrated with other AboutCode projects. + +### **Custodian** + +The primary PURLDB custodian is [https://github.com/JonoYang](https://github.com/JonoYang) + +# **AboutCode Inspectors** + +Inspectors are special-purpose analysis tools. You can run them as a ScanCode Toolkit plugin, or steps in a [ScanCode.io](http://scancode.io) pipeline or from the command line. + +## **binary-inspector** + +[https://github.com/aboutcode-org/binary-inspector](https://github.com/aboutcode-org/binary-inspector) + +### **What** + +binary-inspector is a utility to extract symbols from various kinds of binaries, i.e. ELF, Mach-O, WinPE and other binary formats. + +### **Why** + +binary-inspector supports the analysis intended to determine the code sources of a binary object and is designed to be used as a ScanCode Toolkit plugin or integrated in ScanCode.io pipelines. + +### **Custodian** + +The primary binary-inspector custodian is [https://github.com/AyanSinhaMahapatra](https://github.com/AyanSinhaMahapatra) + +## **container-inspector** + +[https://github.com/aboutcode-org/container-inspector](https://github.com/aboutcode-org/container-inspector) + +### **What** + +container-inspector is a tool to analyze the structure and provenance of software components in Docker images using static analysis. + +### **Why** + +container-inspector supports the analysis of the contents of the various layers of a container and is designed to be integrated in ScanCode.io pipelines. + +### **Custodian** + +The primary container-inspector custodians are [https://github.com/JonoYang](https://github.com/JonoYang) and [https://github.com/chinyeungli](https://github.com/chinyeungli) + +## **source-inspector** + +[https://github.com/aboutcode-org/source-inspector](https://github.com/aboutcode-org/source-inspector) + +### **What** + +source-inspector is a set of utilities to inspect and analyze source code and collect interesting data such as code symbols, strings and comments. + +### **Why** + +source-inspector supports the analysis of source code and is designed to be used as a ScanCode Toolkit plugin + +### **Custodian** + +The primary source-inspector custodian is [https://github.com/JonoYang](https://github.com/JonoYang) + +## **nuget-inspector** + +[https://github.com/aboutcode-org/nuget-inspector](https://github.com/aboutcode-org/nuget-inspector) + +### **What** + +nuget-inspector is a tool to inspect manifests and code to resolve dependencies (vulnerable and non-vulnerable) for nuget packages. + +### **Why** + +Nuget-inspector provides a reliable way to analyze .NET code projects and their dependencies independently of the availability of a dotnet SDK installed on the machine that runs this analysis. It is a comprehensive tool that can handle every style of .NET and NuGet projects and package layouts, manifests and lockfiles. + +### **Custodian** + +The primary nuget-inspector custodian is [https://github.com/JonoYang](https://github.com/JonoYang) + +## **python-inspector** + +[https://github.com/aboutcode-org/python-inspector](https://github.com/aboutcode-org/python-inspector) + +### **What** + +python-inspector is a tool to inspect manifests and code to resolve dependencies (vulnerable and non-vulnerable) for python packages. + +### **Why** + +python-inspector supports ScanCode to find and analyze PyPI archives and installed Python packages and their files. It is a comprehensive library that can handle every style of Python package layouts, manifests and lockfiles. + +### **Custodian** + +The primary python-inspector custodians are [https://github.com/TG1999](https://github.com/TG1999) and [https://github.com/chinyeungli](https://github.com/chinyeungli) + +## **debian-inspector** + +[https://github.com/aboutcode-org/debian-inspector](https://github.com/aboutcode-org/debian-inspector) + +### **What** + +debian-inspector is a tool to inspect debian codebases. + +### **Why** + +debian-inspector is more flexible than other libraries, capable of parsing and inspecting almost correct control files that are not fully machine readable. + +### **Custodian** + +The primary debian-inspector custodians are [https://github.com/JonoYang](https://github.com/JonoYang) and [https://github.com/AyanSinhaMahapatra](https://github.com/AyanSinhaMahapatra) + +## **elf-inspector** + +[https://github.com/aboutcode-org/elf-inspector](https://github.com/aboutcode-org/elf-inspector) + +### **What** + +elf-inspector is a set of utilities to inspect binary ELF files and collect interesting data from them. + +### **Why** + +elf-inspector is designed to be used as a ScanCode Toolkit plugin as well as integrated in ScanCode.io pipelines. + +### **Custodian** + +The primary elf-inspector custodian is [https://github.com/AyanSinhaMahapatra](https://github.com/AyanSinhaMahapatra) + +## **go-inspector** + +[https://github.com/aboutcode-org/go-inspector](https://github.com/aboutcode-org/go-inspector) + +### **What** + +go-inspector is a utility to extract dependencies and symbols from Go binaries. + +### **Why** + +go-inspector is designed to be used as a ScanCode Toolkit plugin as well as integrated in ScanCode.io pipelines. + +### **Custodian** + +The primary go-inspector custodian is [https://github.com/JonoYang](https://github.com/JonoYang) + + +## **rust-inspector** + +[https://github.com/aboutcode-org/rust-inspector](https://github.com/aboutcode-org/rust-inspector) + +### **What** + +rust-inspector is a utility to extract dependencies and symbols from Rust binaries. + +### **Why** + +rust-inspector is designed to be used as a ScanCode Toolkit plugin as well as integrated in ScanCode.io pipelines. + +### **Custodian** + +The primary rust-inspector custodian is [https://github.com/AyanSinhaMahapatra](https://github.com/AyanSinhaMahapatra) + + +# **AboutCode Libraries** + +## **license-expression** + +[https://github.com/aboutcode-org/license-expression](https://github.com/aboutcode-org/license-expression) + +### **What** + +license-expression is a library to parse, analyze, compare and normalize SPDX and SPDX-like license expressions using a boolean logic expression engine. The underlying boolean engine is at: [https://github.com/bastikr/boolean.py](https://github.com/bastikr/boolean.py) . + +### **Why** + +license-expression is designed to be used as a ScanCode Toolkit plugin as well as integrated in ScanCode.io pipelines. + +### **Custodian** + +The primary license-expression custodian is [https://github.com/AyanSinhaMahapatra](https://github.com/AyanSinhaMahapatra) + +## **commoncode** + +[https://github.com/aboutcode-org/commoncode](https://github.com/aboutcode-org/commoncode) + +### **What** + +commoncode provides a set of common functions and utilities for handling various things like paths, dates, files and hashes. + +### **Why** + +commoncode is shared by multiple AboutCode projects. + +### **Custodian** + +The primary commoncode custodian is [https://github.com/AyanSinhaMahapatra](https://github.com/AyanSinhaMahapatra) + + +## **extractcode** + +[https://github.com/aboutcode-org/extractcode](https://github.com/aboutcode-org/extractcode) + +### **What** + +extractcode is a mostly universal file extraction library and CLI tool to extract almost any archive in a reasonably safe way on Linux, macOS and Windows. + +### **Why** + +extractcode supports one of the largest number of archive formats and will extract things where other archive and compressed file extractors may fail. + +### **Custodian** + +The primary extractcode custodian is [https://github.com/JonoYang](https://github.com/JonoYang) + + +## **fetchcode** + +[https://github.com/aboutcode-org/fetchcode](https://github.com/aboutcode-org/fetchcode) + +### **What** + +fetchcode is a utility to reliably fetch any code via HTTP, FTP and version control systems such as git. + +### **Why** + +It is surprisingly difficult to have a simple API to consistently fetch code from package repositories, version control repositories and APIs: each site and each package manager has its own unique and peculiar ways. FetchCode goal is to abstract all these details and make it easy to fetch things reliably. + +### **Custodian** + +The primary fetchcode custodian is [https://github.com/JonoYang](https://github.com/JonoYang) + + +# **Other AboutCode Tools** + +## **aboutcode-toolkit** + +[https://github.com/aboutcode-org/aboutcode-toolkit](https://github.com/aboutcode-org/aboutcode-toolkit) + +### **What** + +aboutcode-toolkit is a set of command line tools to document the provenance of your code and generate attribution notices. aboutcode-toolkit uses small yaml files to document code provenance inside a codebase. + +### **Why** + +The aboutcode-toolkit and ABOUT files provide a simple way to document the origin, license, usage and other important or interesting information about third-party software components that you use in your project. + +### **Custodian** + +The primary aboutcode-toolkit custodian is [https://github.com/chinyeungli](https://github.com/chinyeungli) + + +## **univers** + +[https://github.com/aboutcode-org/univers](https://github.com/aboutcode-org/univers) + +### **What** + +univers is a Python package to parse and compare all package versions and package version ranges. Parse and compare all the package versions and all the ranges. From debian, npm, pypi, ruby and more. Process all the version range specs and expressions. + +### **Why** + +univers provides a mostly universal way to store version ranges and to compare two software package versions in VulnerableCode. + +### **Custodian** + +The primary univers custodian is [https://github.com/TG1999](https://github.com/TG1999) + + +## **federatedcode** + +[https://github.com/aboutcode-org/federatedcode](https://github.com/aboutcode-org/federatedcode) + +### **What** + +federatedcode is a decentralized, federated metadata system for open source software code and security information. + +### **Why** + +federatedcode is funded, supported and sponsored by multiple global organizations. + +### **Custodian** + +The primary federatedcode custodian is [https://github.com/keshav-space](https://github.com/keshav-space) + + +## **AboutCode Data** + +### **What** + +AboutCode Data is a simple set of conventions to define data structures that all the AboutCode tools can understand and use to exchange data. ABOUT files and ScanCode Toolkit data are examples of this approach. + +### **Why** + +AboutCode Data supports other projects such as [https://libraries.io](https://libraries.io/) and and [OSS Review Toolkit](https://github.com/heremaps/oss-review-toolkit) + +# **AboutCode Standards and Related Projects** + +AboutCode is based on key industry standards. + +## **PURL** + +[https://github.com/package-url/purl-spec](https://github.com/package-url/purl-spec) + +### **What** + +A purl is a URL string used to identify and locate a software package in a mostly universal and uniform way across programming languages, package managers, packaging conventions, tools, APIs and databases. + +### **Why** + +PURL supports accuracy of software identification in SBOMs. PURL originated from ScanCode and is in process to become an Ecma standard. + +### **Custodian** + +The primary PURL custodian is [https://github.com/johnmhoran](https://github.com/johnmhoran) + +## **VERS** + +### **What** + +VERS is an emerging specification for the resolution of dependency and vulnerable version ranges. + +### **Why** + +VERS originated as part of the PURL project and is in process to become an Ecma standard. + +### **Specification** + +See [https://github.com/package-url/purl-spec/blob/c29b870ab33382309eefee2a0975ef7f71fdb742/VERSION-RANGE-SPEC.rst](https://github.com/package-url/purl-spec/blob/c29b870ab33382309eefee2a0975ef7f71fdb742/VERSION-RANGE-SPEC.rst) + +## **Related FOSS orgs and projects** + +We also co-started and work closely with other FOSS orgs and projects: - [Package URL](https://github.com/package-url): a widely used standard to identify precisely software packages of all types with simple, readable and concise URLs. From 63f3e00dd137409bf1f2c4eeb5f492c2596e885a Mon Sep 17 00:00:00 2001 From: Dennis Clark Date: Thu, 4 Dec 2025 12:35:13 -0800 Subject: [PATCH 6/6] Update README.md title --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index f7d8ca3..96de568 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -# AboutCode Revisited +# AboutCode ### What is AboutCode?