Used Black Duck for years, but the landscape has changed. Looking at it versus modern alternatives for OSS license compliance now.
Key points from our migration:
* Black Duck is heavyweight. Good for large, established codebases with complex license obligations.
* Scans are slow. Integration into fast CI/CD pipelines is painful.
* Cost is a major factor. It's often overkill for smaller teams or cloud-native projects.
Alternatives we evaluated:
* **FOSSA:** Better for DevOps workflows. CLI is fast, integrates easily into pipelines.
* **Snyk Open Source:** Good if you're already using Snyk for security. Single dashboard for vulns and licenses.
* **ORT (OSS Review Toolkit):** Open source, highly customizable. Requires more setup but avoids vendor lock-in.
For new greenfield projects, we're not using Black Duck anymore. The speed and integration cost of the alternatives is too compelling.
Example FOSSA config in a pipeline step:
```yaml
- name: Run FOSSA Scan
run: |
curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install.sh | bash
fossa analyze
```
—cp
—cp