ort

ORT automates the open-source license-compliance work most teams either do by hand or, more honestly, don't do at all. It's a suite, Analyzer, Scanner, Advisor, Evaluator, Reporter, and Notifier, that walks your dependency tree, identifies licenses and vulnerabilities, enforces policy, and generates the compliance reports auditors ask for. It lives under the Linux Foundation's ACT initiative and carries the OpenSSF badges to match.

This is the open source answer to Black Duck, FOSSA, and Snyk's license side, tools that bill enterprises tens of thousands a year. ORT does the core job for free, wired straight into CI.

For a team shipping software with real licensing exposure, that's a serious amount of money saved. Solo devs rarely need this; small and larger teams with compliance requirements are the real audience, and self-hosting is the point.

The catch is the setup. ORT is heavy. It's a full SCA pipeline in Kotlin and Gradle, and standing it up and tuning the policy rules is a project, not an afternoon. The commercial tools charge partly for making this easy. Budget the engineering time, or the "free" gets expensive in hours.