Freedom251 › Open Source License Compliance Software
SW360
What SW360 is
SW360 is an open-source software catalogue and repository for organizations managing information about software components used in projects and products. It records components, releases, and projects, and helps manage license details and obligations, including workflows for producing license-related documents. The project also lists Software Bill of Materials management as a use case. It collects vulnerability information and matches it to components in its component service. SW360 provides a REST API, with documented authentication choices including HTTP Basic, API tokens, OAuth2, and Keycloak. It can start a FOSSology clearing process and import its reports; FOSSology performs the license scanning, since scanning licenses and source code is outside SW360’s scope. The project is licensed under EPL-2.0 and its listed plan is free, with self-managed deployment. Recommended SW360 v20 deployment uses containers compatible with Docker or Podman and includes a frontend, Keycloak, CouchDB, and Spring Boot backend. The project identifies quality managers, developers, legal counsels, software architects, and R&D managers among the roles it serves. Its documentation lists a developer mailing list, public Slack channel, and open developer meetings.
Who it suits
SW360 is aimed at organizational teams that need to track software components, license obligations, vulnerabilities, or SBOM work. Its listed roles include quality managers, developers, legal counsels, software architects, and R&D managers.
What it does well
- Open source under EPL-2.0
- Tracks component, release, and project information
- REST API with several documented authentication options
- Supports SBOM management and vulnerability information
- Imports FOSSology reports for license-clearing workflows
What to know first
- Does not perform license or source code scanning
- Deployment is self-managed
Limits
SW360 does not scan licenses or source code itself. Those scans are delegated to specialized tools such as FOSSology, with results exchanged through integrations.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| SW360 | Open source · EPL-2.0 · Self-managed deployment | Free |
As eclipse.dev lists them, read 5 Oct 2026. The maker's own page has the final word.
Getting started
- Open the Eclipse SW360 website
- Prepare a Linux or self-hosted environment
- Deploy the recommended containers with Docker or Podman
- Set up the frontend, Keycloak, CouchDB and Spring Boot backend
- Configure TLS, trusted certificates and secret management
- Choose an API authentication method
- Import component or SBOM information and connect scanning tools
Verdict
SW360 brings component records, license workflows, vulnerability information, and SBOM use cases into an open-source repository. Organizations will need separate specialized tools for scanning and must manage deployment themselves.
Questions
Is SW360 free to use?
Yes. SW360 is open source under the EPL-2.0 license, with a listed price of $0.
Which platforms and deployment options are supported?
It supports Linux, web, API and self-hosted use, with both deployment options listed.
Can SW360 scan licenses or source code?
No. License and source-code scanning are outside its scope and are delegated to specialized tools.
Which SBOM formats can it import?
The listed formats are SPDX RDF/XML and CycloneDX.
What authentication does its API support?
Documentation lists HTTP Basic, API token, OAuth2 and Keycloak authentication.
Facts from SW360's own pages
- API and integrations
- SW360 exposes its functionality through a REST API and documents HTTP Basic, API token, OAuth2, and Keycloak authentication options. · eclipse.dev, 5 Oct 2026
- Component tracking
- SW360 tracks software components used in projects or products and maintains related component, release, and project information. · eclipse.dev, 5 Oct 2026
- Deployment
- The recommended SW360 v20 deployment uses containers compatible with Docker or Podman and includes the frontend, Keycloak, CouchDB, and Spring Boot backend. · eclipse.dev, 5 Oct 2026
- FOSSology integration
- SW360 can trigger a FOSSology clearing process and import its reports; FOSSology performs the license scanning. · eclipse.dev, 5 Oct 2026
- Founded
- 2016 · eclipse.dev, 28 Sept 2026
- Latest release shown
- The Eclipse project page lists version 20.1.0, dated July 29, 2026. · projects.eclipse.org, 5 Oct 2026
- License
- The project is open source and licensed under EPL-2.0. · eclipse.dev, 5 Oct 2026
- License compliance
- The application manages license information and obligations and supports workflows for producing license-related documents. · eclipse.dev, 5 Oct 2026
- Notable limitation
- License scanning and source code scanning are outside SW360’s scope; it delegates scanning to specialized tools and exchanges data with them. · projects.eclipse.org, 5 Oct 2026
- Purpose
- SW360 is a software catalogue and repository for collecting, organizing, and sharing information about software components used in an organization. · eclipse.dev, 5 Oct 2026
- SBOMs
- The user guide lists Software Bill of Materials management as a use case. · eclipse.dev, 5 Oct 2026
- Security configuration
- The security guide recommends TLS with trusted certificates, secret management, and restricting bearer-token validation to trusted issuers. · eclipse.dev, 5 Oct 2026
- Support and community
- The documentation lists a developer mailing list, a public Slack channel, and open developer meetings. · eclipse.dev, 5 Oct 2026
- Vulnerabilities
- SW360 collects vulnerability management information and matches it with components stored in its component service. · eclipse.dev, 5 Oct 2026
- Who it is for
- The project identifies quality managers, software developers, legal counsels, software architects, and R&D managers among the roles served. · eclipse.dev, 5 Oct 2026