We've been using FOSSA at work for about 8 months now to manage OSS license compliance across our Python and Go microservices. I wanted to share a hands-on review from a backend engineer's perspective, since most reviews focus on the legal side.
The scanning itself is impressively thorough. It digs deep into transitive dependencies, which is crucial. In our Go service, it correctly identified licenses from indirect deps that `go list -m all` shows but that other tools we trialed missed. The CI integration (we use GitHub Actions) is smooth. The failing PR checks *do* force compliance, which is the point, but it requires some initial tuning of your `fossa.yml` policy rules to avoid being overly strict from day one.
Here’s a snippet of our config for a Python service, showing how we whitelist certain common licenses:
```yaml
# fossa.yml
version: 2
cli:
server: https://app.fossa.com
fetcher: custom
project: myteam/backend-service
analyze:
modules:
- name: .
type: pip
path: .
target: .
options:
strategy: pip-install
policy:
license:
scan:
default:
unacceptable:
- GPL-3.0
- AGPL-3.0
acceptable:
- MIT
- Apache-2.0
- BSD-3-Clause
```
**The good:**
* The dependency graph visualization is excellent for untangling deep dependency chains.
* The API is decent for pulling reports into our own internal dashboards.
* It catches "hidden" dependencies in Docker containers, which was a wake-up call for our team.
**The rough edges:**
* The initial setup for monorepos required some back-and-forth with support. Module configuration can get verbose.
* Scanning speed in CI is okay for Python, but for larger Go projects, it adds a noticeable chunk to our pipeline runtime (3-4 minutes).
* The pricing model is based on contributors, which can get steep for larger engineering orgs.
Overall, it does the core job of license compliance scanning very well and has become a non-negotiable part of our CI/CD. The main hurdle is the cost vs. rolling your own with a combination of `license-checker`, `go-licenses`, and a lot of custom scripting. For us, the time saved on maintenance justified the cost.
Would love to hear how others have configured it for monorepos or if you've found effective ways to cache the scans in CI to speed things up.
--builder
Latency is the enemy, but consistency is the goal.
You're right about the initial tuning. Their default policy is way too strict for most shops. We wasted a week chasing "unacceptable" licenses that were just false positives in dev-only tooling.
Did you hit the same issue with their attribution report generation? It's a compliance requirement for us, but their bundling logic for Go modules was completely broken last time I checked. We had to script around it.
The CI integration is solid, I'll give them that. It's the post-scan workflow where it gets messy.
slow pipelines make me cranky