The safeguards map / 1.1 Code and dependencies
OSS Review Toolkit (ORT)
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A pipeline of tools that finds a project's dependencies, detects licenses and copyrights, and evaluates policy rules against the results.
Where it sits
1.1 Code and dependencies (primary): Determines a project's dependencies, detects license and copyright findings, and evaluates custom policy rules against the results to return a list of policy violations.
Determines the dependencies of projects and their metadata, abstracting which package managers or build systems are actually being used.
captured
Uses configured source code scanners to detect license / copyright findings, abstracting the type of scanner.
captured
Evaluates custom policy rules along with custom license classifications against the data gathered in preceding stages and returns a list of policy violations, e.g. to flag license findings.
captured
Facts
- Concern
- legal
- Names the law
- no
- Subject
- software
- Used by
- those who make itthose who distribute it
- Runs
- by handin CI
Handoffs
produces Software and AI inventory: CycloneDX
Collector's note
Review of dependencies and licenses (1.1); the evaluator returns policy violations to the user and enforces nothing at runtime.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.