Looking for a tool to replace Black Duck. Their pricing got ridiculous and the UI is way too complex for what we need.
We only care about open source license compliance. Need to scan a few Java and Python repos. Must have a clear, simple policy engine. No false positive nightmare. What are people using that doesn't cost an arm and a leg?
If the complexity and cost of Black Duck are your main issues, I'd suggest looking at FOSSA. It handles license compliance for Java and Python well, and the policy engine is straightforward to set up. The scanning is accurate in my experience, so you won't spend hours weeding out false positives.
Another option that's gained traction is Snyk Open Source. It's primarily a security tool, but their license compliance module is quite good for common open source licenses, and the pricing is often more palatable for smaller teams.
Both have much cleaner UIs. Just make sure whichever you choose can ingest your SBOM format if you have existing outputs to compare against.
—Anita
Thanks for the suggestion on FOSSA. I've heard their policy engine is simple, which is key. Did you run into any trouble with Python virtual environments during scanning? I've seen some tools struggle with that setup.
Snyk's license module is good for basics, but we found it could miss some obligations around notices for licenses like Apache 2.0. Something to watch for if your policies are strict.
How does FOSSA handle license conflicts when you have transitive dependencies with incompatible terms? That's where our last tool got really noisy.
Python virtual environments are a consistent pain point for license scanners. FOSSA uses a CLI-first approach that requires you to run it within the activated environment, which can complicate CI/CD pipelines. You'll need to ensure your build process explicitly activates the virtual environment before the scan. Their documentation has workarounds, but it adds scripting overhead.
On your question about transitive dependency conflicts, FOSSA's policy engine performs a dependency graph resolution. It identifies the conflicting licenses, but its default reporting is less noisy because it suppresses conflicts where a compatible upstream license already satisfies the obligation. The trade-off is you might need to manually verify that suppression is correct in complex chains, particularly with "or later" license clauses.
For Apache 2.0 notices, Snyk's limitation you observed is a known gap in their rule set. They prioritize copyleft detection. If notice attribution is a strict requirement, you'd need to supplement their findings with a manual review process, which defeats the purpose of automation for many teams.
FOSSA and Snyk are decent suggestions, but I'll add Mend (formerly Whitesource) into the mix. Their policy engine is dead simple and their scan results for Java/Maven were more accurate for us than Snyk's license module on transitive dependencies.
Pricing is still a factor, but their "Unlimited" plan for just license compliance was reasonable compared to Black Duck's quote. Just avoid the upsell for their full platform.
One caveat: you'll need to test their Python scanning against your specific virtualenv setup. Their agent-based approach handles it, but you might need to tweak the config file.
Show me the query.
I feel your pain on Black Duck's pricing and complexity. It's a common reason teams start looking elsewhere.
For a straightforward license compliance focus on Java and Python, FOSSA is the frontrunner I'd suggest. Their policy engine is exactly the "clear, simple" experience you're asking for. The UI is intuitive and it drastically cuts down on the false positive noise compared to Black Duck.
Just budget a little time to test their Python scanning against your specific project structure, as their approach to virtual environments can require some extra steps in automation.