OpenChain Webinar: AboutCode and Beyond - End-to-End SCA

OpenChain Webinar: AboutCode and Beyond - End-to-End SCA

1. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
AboutCode and beyond:
End-to-end SCA with open
source code and open data
Philippe Ombredanne,
Lead maintainer of AboutCode and CTO of nexB, Inc.

2. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
Agenda
2
●About AboutCode & nexB
●Software Composition
Analysis
○Vulnerabilities AND licensing
○Proprietary problems
●The AboutCode stack
●New projects
●Roadmap
●Questions?

3. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
About me
●On a mission to enable easier and safer to reuse FOSS code with
best-in-class open source Software Composition Analysis (SCA)
tools, data, and standards for open source discovery, license & security
compliance
●Lead maintainer of AboutCode projects (ScanCode, DejaCode,
VulnerableCode and others)
●Factoids
○In 2010, I said that Docker technology would never succeed
○Signed off on the largest deletion of code in the Linux kernel
(but these were only license comments)
●CTO and co-founder of nexB, Inc.
○[email protected]
○GitHub: https://github.com/pombredanne
○LinkedIn: https://www.linkedin.com/in/philippeombredanne
○Often assisted by Chihuahua Technical Advisor
3

4. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
AboutCode and nexB
●AboutCode's FOSS-first mission: FOSS for FOSS
○Open source tools and open knowledge base (AboutCode stack)
○Simple and practical standards (Package-URL)
○Applications for Legal & Business users (DejaCode) with APIs for everything
●Trusted experts in Software Composition Analysis (SCA) since 2007
○Creator of Package-URL: https://github.com/package-url
○Co-founders of SPDX: https://spdx.org
○Contributors to CycloneDX: https://cyclonedx.org
○Co-founders of ClearlyDefined: https://clearlydefined.io
●nexB provides professional services and support for SCA
○800+ SCA projects completed to-date with 100% customer satisfaction
○Sponsored development for AboutCode projects
○Technical support and advisory for SCA tools implementations and deployments
4

5. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
Software Composition Analysis

6. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Identification – Identify distinct “units” of third-party software used in a product or project
and their provenance
●Licensing – Determine the licensing for each software unit
●Security – Identify known security vulnerabilities for each software unit
●Quality – Evaluate the quality of a software unit based on software development data, such
as number of bugs, fixes, etc. - this is the domain of the CHAOSS project
●Read "SCA the FOSS Way" for more information:
https://www.nexb.com/software-composition-analysis/
Software Composition Analysis needs to be a core competency for any
software development organization.
●Embed in the software development workflow from design through release - as it is in
manufacturing
●The choice of SCA tools will depend on your platform, stack and product
Software Composition Analysis (SCA)
6

7. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Most SCA tools focus on either vulnerabilities OR licensing
○Current focus is on security vulnerabilities because of perceived higher risk
●The communities of interest are separate - security vs legal - but converging
●License data may be complex, yet mostly stable over time
○But very few tools get it right. Accuracy is still a major, unsolved problem
●Dependency graphs are highly dynamic and demand constant care
○They impact the stability of licensing and vulnerability information
●Vulnerability data is complex, but extremely dynamic - if included directly in
an SBOM, it may be wrong by the time you receive an SBOM
●Most SCA security tools are lightweight with respect to both provenance and
licensing, and focus on the easy things
You need SCA coverage for vulnerabilities AND licensing - plus quality.
SCA: Vulnerabilities AND licensing
7

8. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
SCA: Proprietary tools and data
8
●Increasingly expensive with the surge of interest in SBOMs and pricing
based on number of developers
●Large companies may be able to “afford” proprietary SCA scanning tools,
but they do not scale across the FOSS supply chain
○The cost of scan curation is prohibitive with high false positive rates and poor license detection
accuracy
●Most current data about FOSS packages and vulnerabilities is proprietary
○Vendors may offer some free or open source tools but you must pay for access to their data
○Barrier to community access and analysis
●Many vendors use some open source for marketing only - “fauxpen source”
○Complex and restrictive licenses
○No contributions back to the community

9. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
SCA: Open source tools and data
9
●There are many open source SCA tools and some databases:
○License compliance focus: ORT, Fossology, SW360
○Vulnerability SBOM focus: CycloneDX, Dependency Check, Syft/Grype (Anchore) , Trivy (Aqua
Security)

●So, why did we develop AboutCode?

10. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Free and open source software AND free and open data
○FOSS for FOSS
○Open knowledge base with open data for licenses, packages and vulnerabilities
●Modular and integrated best-in-class SCA tools for developers
○Tackling the harder code analysis problems so you do not have to
○PURL-based for easier integration in/out
●Bespoke pipelines enable true end-to-end automation
○Working towards management by exception to focus on the complex cases of origin and license
○Decentralized analysis, close to the developers
●Management web app for centralized policies, curations and compliance
workflows and data
○Supports engineering, business and legal stakeholders with features tailored for each using
common/shared information
Why AboutCode? [1]

11. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●The state of SCA tooling accuracy is not great
●Recently, made a large scale comparison of many container scanners
○Both FOSS and commercial
○Using SBOMs as a way to compare scans of the same container images
●Commercial tools are making up packages, "hallucinating" PURLs
●Most look only skin deep, only looking at package manifests and DB
●Beyond package origin, the quality of report licenses is plain bad and
misleading
○In most case this is a grep on the declared license of package manifests
●Several tools created invalid SBOMs
●We can do better!
Why AboutCode? [2]

12. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
Introducing the
AboutCode stack

13. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
AboutCode: Who is using it?
Many organizations and most SCA providers use AboutCode tools,
libraries or standards:
○Most free software and open source foundations
○Five of the top big tech companies
○A leading database company and a leading Linux company
○European and US government agencies
○All major European car manufacturers and most of their vendors
○Major US chip and microprocessor providers
○Four leading European industrial companies
○All SBOM and VEX standards
○All open source SCA and SBOM tools
○Most proprietary SCA, SBOM or code hosting tools
13
SCA Tools
Management
Apps
Open
Knowledge
Base

14. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
SCA Tools Management Apps
Open Knowledge Base

15. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
SCA Tools Management Apps
Open Knowledge Base
ScanCode DejaCode
Licenses Packages Vulnerabilities
Scan Match Analysis pipelines PoliciesCurationsSoftware inventory
Workflows SBOMs Custom reportsBinary analysis Dependency analysis

16. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Supports safe and compliant use of FOSS, with FOSS
○Recognized worldwide as best-in-class tools
○Modular design for adaptation to development team processes, tools and environment
○Coverage for all languages and frameworks
○Package URL (PURL) used throughout as the package identifier
○Code AND data licensed under open source licenses, no gimmicks
●Reduce licensing and vulnerability risks from using FOSS or other
third-party software components
○Share risk management responsibilities among business, legal, engineering and security teams
○Provide a comprehensive view of open source and other third-party components used in your
software
●Active community of contributors and users, including many FOSS tools
●Technical support, implementation, advisory services available from nexB
Benefits of the AboutCode stack
16

17. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Contribute to an AboutCode project with code,
documentation, use cases, bug reports
■https://github.com/nexB
●Sponsor AboutCode project maintainers
○Accelerate development of new features and fund contributors
■https://github.com/sponsors/nexB
●Buy support, implementation, and advisory services
from nexB to pay the maintainers
■https://nexb.com
●Join the community:
■https://www.aboutcode.org/
■https://gitter.im/aboutcode-org/discuss
AboutCode also needs your help!
17
"Dependency" by xkcd, used under CC BY-NC 2.5 /
Modified text from original

18. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
AboutCode:
New Projects

19. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Pipeline Input: sources and binaries
●Collect symbols and identifiers from source and binaries
○Parse Java bytecode, ELF, DWARF, WinPE, Mach-O, JS mapfiles, collect literals,
source symbols
●Map and match these symbols from binaries back to source
●If not mapped, fall back to code matching the PurlDB
●Report discrepancies
○Code that is found in binaries and NOT in the source
●WIP BUT the code from before xz has been able to detect
xz-utils problems and tagged the problematic, malicious build
script as "require review"! yeah!
Binary, deployment analysis: back2source
19
SCA Tools

20. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
New project: CRAVEX [1]
20
●Goal is to automate App vulnerabilities management
●.... AND compliance regulatory reporting

●Built for open source projects and small businesses as a free and open
solution to comply with the emerging regulatory mandates (SBOMs,
CRA) with minimal friction and costs

●Package- and software product-centric management of vulnerabilities

●Web-based, database-backed application to collect, track, and triage
FOSS package vulnerabilities and determine their exploitability
○Rank based on urgency, assess remediation
○Create VEX reports

21. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
New project: CRAVEX [2]
●Import SBOM and scans for one or more apps, products & components
●Schedule vulnerability lookups and store the results in the database

●Web UI to rank and prioritize package vulnerabilities based on
○Multiple scores
○Rule-based automation
○Vulnerable code reachability and exploitability
○Usage context
●Export the results of the vulnerabilities triage and processing as VEX
documents and attestations

21

22. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
New project: Code reachability
●Upcoming companion to CRAVEX
●Goal: help prioritize vulnerabilities based on actual local exploitability
●Use multiple factors to help better qualify the urgency
●Symbols-based reachability of the vulnerable code
●Call graph-based reachability of the vulnerable code
●Integrate local context to assign exploitability priorities
○Development or internal tool vs. production software or consumer device
●Integrate existing excellent FOSS efforts in the space
○Eclipse steady, JORN, Chen

22

23. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
Question: How to reuse safely AI-Generated code?
●AI-Generated code is a wonderful productivity booster

●Thought experiment
○Build a small LM from only GPL-licensed code from the GNU project.
○Add Gen-AI on top. Is the generated code derived from the GPL-licensed code?
●AI-Generated code may violate licenses and copyrights
●AI-Generated code may copy vulnerable code sections
●Some large businesses and open source foundations have defined
policies wrt. AI-generated code, in some cases prohibiting its use.
New project: GenAI Code Search [1]
23

24. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Fight fire with fire
○An approach we considered is to use GenAI to regenerate code under analysis and compute
similarity between regenerated and original code
○Impractical as too expensive and too slow
●Find similar code fragments
○The focus of this project
●Traditional code fragments matching does not work for AI
○The code is broken in chunks using a content-defined heuristic
○Chunks are matched exactly using a checksum
○BUT, AI-generated code is seldom exactly the same as indexed FOSS code
○Existing solutions have ever growing indexes with more fragments to avoid false negative
○Furthermore, precision and recall are frozen in the choice of parameters for the index
New project: GenAI Code Search [2]
24

25. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●A new approach to approximate code fragment matching
●Fingerprint-based
○Helps scale the index, but also scale the query as a whole codebase (Gigabyte size) is the query
○Traditional Information retrieval with inverted indexes does not work for queries this large
●Approximate, fuzzy fingerprinting
○Using new algorithm that enables matching code that was never indexed
●Furthermore, tunable fingerprint
○Can be tuned at query time for precision and recall
New project: GenAI Code Search [2]
25

26. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
New project idea: Open Containers KB
26
●Containers composition is a mess. Most tools are just plain bad
○Lack basic tracing of license and package (and therefore vulnerabilities)
●Image builders, OS and distro vendors do not seem to care
○Official images are sometimes not compliant or not traceable
○Package volume amplifies vulnerability and license issues
○Source of binary packages disappears
●We can do better!
●Project idea: create a mini consortium to do a
proper, automated and correct SCA of key
public base images
●Share these as open data
●Work with upstream to clean their acts

27. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
AboutCode
Roadmap

28. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
Roadmap for AboutCode: ScanCode Toolkit
●Build single exe standalone apps for ScanCode for easier
deployment in Ci/CD
●Improve copyright and license detection speed
●Build smaller single-purpose tools and libraries from
"mono repo"
●Improve data models for Packages and
Dependencies/Requirements
●Parse more package manifests and lock files
●Improve support for license exceptions (WITH)
●Move inconclusive, unknown license detection to clues
●Add post-processing to rematch using SPDX matching
guidelines
2828
SCA Tools

29. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Integrate with CI and other tools
○Create Ci/CD pre-configured integrations with main CI (GitHub, GitLab, Jenkins)

●Extend binary analysis and deployment tracing workflows
○Support ELF/Native, Go, Ruby, Android in addition to Java and JS
○Find the exact subset of the code that is deployed and used in production

●Automate analysis review in ScanCode.io
○End to end automated pipelines for embedded devices, Android and C/C++
○Multi-stack deployment analysis for Java, JS, C/C++
○Report TODO items to review only "by exception"
Roadmap for AboutCode: SCA Tools
2929
SCA Tools

30. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Code match smart ranking and disambiguation
○Avoid false positives
●Accurately match to the correct package version
●Match code snippets approximately
○Using our new approximate fingerprinting
○Integrate other code matching schemes from SWH and SCANOSS
●Match source symbols and binary symbols to sources
and binaries
●New matching pipelines
●Decentralized curation and corrections using
in-codebase ABOUT files
Roadmap for AboutCode: Code matching
3030
SCA Tools

31. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Compare scans to focus review work on changes only
(DeltaCode)
●APIs and CLI to query all the things by PURL from the KB
(purl2all)
●More code inspectors
○Lightweight package dependency resolution
○Dedicated ecosystem-focused libraries
●New lightweight package-inspector
○Single executable to find packages and dependencies
●Trace build execution to find the exact subset of source
code that is deployed and used (TraceCode)
Roadmap for AboutCode: Other SCA Tools
3131
SCA Tools

32. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
Roadmap for AboutCode: Management Apps
32
●Add support for CycloneDX 1.5 and 1.6 and SPDX 3.0
●Create new review automation apps:
○License detection review
○Code match review
○Vulnerability review
●Overall goal is to reduce review and curation work
○Extend license clarity scoring to code matches with origin clarity scoring
○"Auto conclude" matches that are conclusive
●New app for advanced Vulnerability management and
support for CRA (Cyber Resiliency Act) compliance
○Automated triage of vulnerabilities and workflow triggers
○VEX creation, VEX import and export (Vulnerability Exploitability Exchange)
with CSAF and CycloneDX
32
Management
Apps

33. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Extend License data with compatibility matrix
●Add new license aliases dataset
●Add more extensive tagging and categorization
●Extend License data with improved exception details
○To disambiguate license detections of L/GPL with/without exceptions
●Extend License data with improved "or later" details
○To disambiguate detection of "or later" notices with their primary texts
●Add "key phrases" to all license detection rules
●Add variable text segments to license rules
●Add Fedora alternative SPDX identifiers
●Work with CycloneDX to become their license reference

Roadmap for AboutCode: Licenses
3333
Open
Knowledge
Base

34. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
Roadmap for AboutCode: Vulnerabilities
34
●Extend Non-vulnerable dependency resolution
○Beyond Python - add Java and JS
●Extend vulnerability data with new upstream data sources
●Add fix commit details and support for vulnerability reachability
●Mine the graph to surface related package fixes
●Mine git logs, issues and forums to enrich vulnerability data
●Surface inconsistencies and conflicts between different advisory
data sources (VulnTotal throughout)
●Add source/binary discrepancy data (from back2source)

34
Open
Knowledge
Base

35. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Confirm the true origin of code to avoid ambiguous matches
●Supply chain package verification
○Map deployed binary packages to their corresponding source code
○Find suspicious code drift between package versions
●Mine extensive list of "off registry" packages
○Common native C/C++ code and libraries for embedded
○Glibc, Busybox, zlib, etc. that are not published on ecosystem package registries
●Collect code symbols from source and binaries (for matching)
●On demand, just in time code mining to build your KB on the fly
●Federated, decentralized shared KB data with Git and ActivityPub
○Share scans, vulnerabilities, origin facts and curations
○Scan once, analyze once and collaborate on reviews to clear out the junk!
Roadmap for AboutCode: Packages
3535
Open
Knowledge
Base

36. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
The AboutCode Stack

37. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
The AboutCode stack for SCA [1]
37
SCA Tools
Management
Apps
Open
Knowledge
Base
●Web-based enterprise management application
○DejaCode for ensuring license and security compliance
●SCA tools for identifying third-party code and determining
code license and origin
○ScanCode is the leading code scanner for software component, package
and dependency identification, and license detection
○MatchCode is a new tool for package and file matching
○container-inspector: analysis tool for Docker & other images
○nuget-inspector and python-inspector for in-depth dependency resolution
○many other libraries
○See https://aboutcode.org for an overview of AboutCode projects
○See https://github.com/nexB for the code

38. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
The AboutCode stack for SCA [2]
38
SCA Tools
Management
Apps
Open
Knowledge
Base
●Open knowledge base with open data for licenses, packages
and vulnerabilities
○LicenseDB - open source and other public licenses at:
https://scancode-licensedb.aboutcode.org/
○PurlDB - package data at: https://public.purldb.io/api/packages/
○VulnerableCode - aggregated vulnerability data and comprehensive
vulnerability reporting at: https://public.vulnerablecode.io/
●Standards
○Package-URL: Specification and tools for identifying packages at:
https://github.com/package-url
○Univers: Parse and compare package versions and ranges at:
https://github.com/nexB/univers

39. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Industry-leading scanning engine
●License detection with multiple techniques, rule-based
●Copyright notices with NLP
●Identify packages
○Normalize all the package metadata
○Includes dependencies and package license detection
○Package manifests, system package databases and lockfile parsing
●New summarization and license clarity scoring
○Identify and focus curation on actual licensing issues
●Accuracy is paramount
○An incorrect license detection is treated as a bug
●ABOUT files for curations/corrections stored in the codebase
The AboutCode stack: ScanCode Toolkit
39
SCA Tools

40. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Web-based scanning server using ScanCode
○Smarter scripted scanning in multiple steps
●Specialized pipelines for customized analysis
○Tag items that need your review
○Pipeline for best-in-class container and VM scanning
●Unique deployment analysis using binary analysis
○Map binaries back to their sources
●Code matching integrated with the knowledge base
○Starting with exact and approximate file matching
●Integrated enrichment of the knowledge base
○Collect and pre-scan all the packages that you use
○Watch and collect new versions continuously

The AboutCode stack: ScanCode.io
40
SCA Tools
Open
Knowledge
Base

41. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●New Web-based code matching server
●Includes mining for custom knowledge base
○All package ecosystems and linux distros
●Smarter matching in multiple steps
○Whole tree, exact file, approximate tree and file
○Coming up: snippet matching, with a twist for AI-Generated code
●Pipeline for ranking and picking best matches
●A different matching approach
○Exact matching demands a constantly growing index
○Approximate matching can match software that is NOT indexed
○Top down rather than bottom up
The AboutCode stack: MatchCode
41
SCA Tools
Open
Knowledge
Base

42. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Inspectors: tech-specific tools and dependency resolvers
○Container and VM images, Debian, ELF and DWARF, NuGet, Python, source
●aboutcode-toolkit: Generate Attribution Notices
○Using scans or ABOUT files as input
●package-url (PURL): URL string to identify a software package
○Adopted by CSAF, CycloneDX, SPDX and the whole SCA ecosystem
○Now part of the CVE specification v5.1
○Recommended by US CISA and German BSi
●univers: parse and compare package versions and version
ranges
●license-expression: parse and compare License expressions
The AboutCode stack: Other projects
42
SCA Tools

43. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Input: buildable codebase
●Run build under "strace" and collect the trace
○All kernel syscalls that open, close, write to files, spawn processes
●Reconstruct build graph
○Determine the subset of the sources used in deployment
●Then Scan and Match the source subset
●Useful, but still marginal usage as it requires a lot of tuning


Build tracing: TraceCode
43
SCA Tools

44. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Licenses: 2,000+ licenses and 35,000 rules
○ScanCode LicenseDB has the basic license data
○ScanCode Toolkit has the license detection rules
○DejaCode is synchronized with LicenseDB and adds License Conditions
○All licenses have SPDX Identifiers with “Licenseref-scancode” namespace for the
many licenses not included in the SPDX License List (currently 567 licenses)
●No known alternative with comparable depth and breadth

The AboutCode stack: Open Data [1]
44
Open
Knowledge
Base

45. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Packages: 21M+ packages and, files and their fingerprints
○PURL-based
○Public PurlDB is at: https://public.purldb.io/api/packages/
○All major ecosystems and distributions - sources AND binaries
○Built-in mining of all package ecosystems, not half-baked
○Also just-in-time, on-demand data collection
○Collect, scan, and index all the packages sources, binaries and VCS repos
○Index with code fingerprints used for code matching
●Other Package databases:
○Software Heritage, ClearlyDefined, deps.dev (Google)
○Centralized and too big to share
○No on-premises option for private operations (too big again)

The AboutCode stack: Open Data [2]
45
Open
Knowledge
Base

46. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●Vulnerabilities: 760K+ packages and 240K+ vulnerabilities
○PURL-based
○Public VulnerableCodeDB is at: https://public.vulnerablecode.io/
○All major ecosystems and vulnerability DBs aggregated and correlated
○Discover relations (and inconsistencies) in data from mining the graph
●Other Vulnerability databases:
○OSV (reuses some AboutCode code too), GitHub, GitLab, NVD
○Often contain conflicting data for vulnerable ranges, fixed versions or affected
packages
○Comparison made possible with VulnTotal to query vulnerable version ranges
given a PURL
The AboutCode stack: Open Data [3]
46
Open
Knowledge
Base

47. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
●PURLs (Package URLs) are wonderful
●: 760K+ packages and 240K+ vulnerabilities
○PURL-based
○Public VulnerableCodeDB is at: https://public.vulnerablecode.io/
○All major ecosystems and vulnerability DBs aggregated and correlated
○Discover relations (and inconsistencies) in data from mining the graph
●Other Vulnerability databases:
○OSV (reuses some AboutCode code too), GitHub, GitLab, NVD
○Often contain conflicting data for vulnerable ranges, fixed versions or affected
packages
○Comparison made possible with VulnTotal to query vulnerable version ranges
given a PURL
The AboutCode stack: Open Data [3]
47
Open
Knowledge
Base

48. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
The AboutCode stack: DejaCode [1]
48
Integrate all tools and data in one web-based application for SCA
and compliance management
●Manage product and component Inventories
●Curate code origin and licenses
●Define and apply license policies
●Launch scans and access the Knowledge Base
●Identify package vulnerabilities
●Consume and enrich SBOMs (CycloneDX or SPDX)
●Generate FOSS compliance documents, such as product
Attribution Notices and SBOMs (CycloneDX or SPDX)
Management
Apps
Open
Knowledge
Base
SCA Tools

49. © AboutCode - License: CC-BY-SA-4.0 - https://www.aboutcode.org
The AboutCode stack: DejaCode [2]
49
Integrate all tools and data in one web-based application for SCA
and compliance management
●Standard and custom reports
●JSON API and webhooks
●Built-in basic workflows
●Integrated with AboutCode SCA Tools and Open Knowledge
Base
Management
Apps
Open
Knowledge
Base
SCA Tools