Skip to content

Commit 518cf1f

Browse files
DennisClarkDennisClark
authored
Merge pull request #202 from aboutcode-org/improve-docs
CRAVEX-Docs: Improve docs for Getting Started purposes aboutcode-org/www.aboutcode.org#49
2 parents f8242cb + 13262f8 commit 518cf1f

13 files changed

+491
-3
lines changed

‎docs/source/aboutcode-project-overview.rst‎

Lines changed: 35 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,45 @@
44
AboutCode Project Overview
55
==========================
66

7-
The primary current AboutCode projects are:
7+
Primary AboutCode Projects
8+
--------------------------
89

910
.. toctree::
1011
:maxdepth: 2
1112

12-
aboutcode-projects/scancode-toolkit-project
1313
aboutcode-projects/scancodeio-project
14-
aboutcode-projects/scancode-workbench-project
1514
aboutcode-projects/vulnerablecode-project
15+
aboutcode-projects/purldb-project
16+
aboutcode-projects/scancode-toolkit-project
17+
aboutcode-projects/scancode-workbench-project
18+
aboutcode-projects/dejacode-project
19+
20+
Supporting AboutCode Projects
21+
-----------------------------
22+
23+
.. toctree::
24+
:maxdepth: 2
25+
26+
aboutcode-projects/license-expression-project
27+
aboutcode-projects/scancode-licensedb-project
28+
aboutcode-projects/source-inspector-project
29+
aboutcode-projects/python-inspector-project
30+
aboutcode-projects/scancode-action-project
1631
aboutcode-projects/aboutcode-toolkit-project
32+
33+
Getting Started
34+
---------------
35+
36+
.. toctree::
37+
:maxdepth: 2
38+
39+
getting-started/start-scanning-code
40+
41+
getting-started/manage-license-policies
42+
43+
getting-started/create-sboms
44+
45+
getting-started/consume-sboms
46+
47+
getting-started/cra-compliance
48+

‎docs/source/aboutcode-projects/dejacode-project.rst‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
.. _dejacode-project:
2+
3+
DejaCode
4+
========
5+
6+
`DejaCode <https://github.com/aboutcode-org/dejacode>`_: is a Cloud
7+
application server that automates open source license compliance and ensures
8+
software supply chain integrity. It is a comprehensive enterprise-level application,
9+
powered by `ScanCode <https://github.com/aboutcode-org/scancode-toolkit>`_,
10+
the industry-leading code scanner.
11+
12+
* Run scans and track all the open source and third-party products and
13+
components used in your software.
14+
* Apply usage policies at the license or component level,
15+
integrate into ScanCode to ensure compliance.
16+
* Capture software inventories (SBOMs), generate compliance artifacts, and keep
17+
historical data.
18+
* Ensure FOSS compliance with enterprise-grade features and integrations for DevOps
19+
and software systems.
20+
* Scan a software package, simply by providing its Download URL, to get comprehensive
21+
details of its composition and create an SBOM.
22+
* Load software package data into DejaCode with the integration for the open source
23+
ScanCode.io and ScanCode Toolkit projects to create a product’s SBOM.
24+
* Track and report vulnerability tracking and reporting by integrating with the open
25+
source VulnerableCode project.
26+
* Create, publish and share SBOM documents in DejaCode, including detailed attribution
27+
documentation and custom reports in multiple file formats and standards, such as
28+
CycloneDX and SPDX.
29+
30+
Read more at: https://dejacode.readthedocs.io
31+
32+
Get the code at: https://github.com/aboutcode-org/dejacode
33+

‎docs/source/aboutcode-projects/license-expression-project.rst‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
.. _license-expression-project:
2+
3+
license-expression
4+
==================
5+
6+
`license-expression <https://github.com/aboutcode-org/license-expression>`_: is a
7+
comprehensive utility library to parse, compare, simplify and normalize license
8+
expressions (such as SPDX license expressions) using boolean logic.
9+
10+
- Read more at: https://github.com/aboutcode-org/license-expression
11+
- Get the code at: https://github.com/aboutcode-org/license-expression/releases

‎docs/source/aboutcode-projects/purldb-project.rst‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
.. purldb-project:
2+
3+
PurlDB
4+
======
5+
6+
`PurlDB <https://github.com/aboutcode-org/purldb>`_: is a set of
7+
tools to create and expose a database of purls (Package URLs). This project is
8+
sponsored by NLnet project https://nlnet.nl/project/vulnerabilitydatabase/ and
9+
nexB for https://www.aboutcode.org/
10+
11+
The PurlDB tools include:
12+
13+
* PackageDB that is the reference model (based on ScanCode toolkit) that contains
14+
package data with PURL (Package URLs) being a first class citizen.
15+
* MineCode that contains utilities to mine package repositories
16+
* MatchCode that contains utilities to index package metadata and resources for
17+
matching
18+
* MatchCode.io that provides package matching functionalities for codebases
19+
* ClearCode that contains utilities to mine Clearlydefined for package data
20+
* purldb-toolkit CLI utility and library to use the PurlDB, its API and various
21+
related libraries.
22+
23+
Read more at: https://purldb.readthedocs.io
24+
25+
Get the code at: https://github.com/aboutcode-org/purldb
26+

‎docs/source/aboutcode-projects/python-inspector-project.rst‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
.. _python-inspector-project:
2+
3+
python-inspector
4+
================
5+
6+
`python-inspector <https://github.com/aboutcode-org/python-inspector>`_:
7+
is a collection of utilities to:
8+
9+
- resolve PyPI packages dependencies
10+
11+
- parse various requirements.txt files and setup.py files as input
12+
for resolving dependencies.
13+
14+
- parse various manifests and packages files such as
15+
Pipfile, pyproject.toml, poetry.lock and setup.cfg and legacy and
16+
current metadata file formats for eggs, wheels and sdist. These
17+
have not been wired with the command line yet.
18+
19+
- query PyPI JSON and simple APIs for package information
20+
21+
It grew out of ScanCode-Toolkit to find and analyze PyPI archives and
22+
installed Python packages and their files.
23+
24+
The goal of python-inspector is to be a comprehensive library
25+
that can handle every style of Python package layouts, manifests and lockfiles.
26+
27+
- Get the code at: https://github.com/aboutcode-org/python-inspector

‎docs/source/aboutcode-projects/scancode-action-project.rst‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
.. _scancode-action-project:
2+
3+
scancode-action
4+
===============
5+
6+
`scancode-action <https://github.com/aboutcode-org/scancode-action>`_: enables
7+
you to run ScanCode.io pipelines from your workflows.
8+
9+
- Read more at: https://github.com/aboutcode-org/scancode-action
10+
- Get the code at: https://github.com/aboutcode-org/scancode-action/releases

‎docs/source/aboutcode-projects/scancode-licensedb-project.rst‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
.. _scancode-licensedb-project:
2+
3+
ScanCode LicenseDB
4+
==================
5+
6+
`ScanCode LicenseDB <https://github.com/aboutcode-org/scancode-licensedb>`_:
7+
is a large free and open database of software licenses, in particular open-source
8+
software licenses, with over 2300 curated licenses texts and their metadata.
9+
10+
LicenseDB is built from the ScanCode Toolkit license dataset. ScanCode Toolkit
11+
is a leading open source code scanner and license detection engine.
12+
13+
LicenseDB is an essential reference license resource for license compliance and
14+
SBOMs. LicenseDB includes all the SPDX and OSI licenses together with an extended
15+
curated collection of other licenses and license metadata. These licenses are
16+
carefully reviewed and curated and continuously updated by an open community of
17+
contributors.
18+
19+
LicenseDB is available as a web site at: https://scancode-licensedb.aboutcode.org/
20+
You can search the licenses by name, key and other attributes. The web site is updated
21+
daily by a GitHub action with updates from scancode-toolkit develop.
22+
23+
LicenseDB is also available as a JSON or YAML API and a git repository
24+
making it easy to reuse and integrate in tools that need a database of reference
25+
software licenses.
26+
27+
- Get the code at: https://github.com/aboutcode-org/scancode-licensedb

‎docs/source/aboutcode-projects/source-inspector-project.rst‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
.. _source-inspector-project:
2+
3+
source-inspector
4+
================
5+
6+
`source-inspector <https://github.com/aboutcode-org/source-inspector>`_:
7+
is a collection of utilities to inspect and analyze source code and collect interesting
8+
data using various tools such as code symbols, strings and comments.
9+
This is also a ScanCode-Toolkit plugin.
10+
11+
- Get the code at: https://github.com/aboutcode-org/source-inspector

‎docs/source/getting-started/consume-sboms.rst‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
.. _consume-sboms:
2+
3+
Use AboutCode to consume SBOMs from your suppliers
4+
==================================================
5+
6+
You can use **ScanCode.io** to consume SBOMs from your suppliers. ScanCode.io will
7+
identify all the licenses associated with your codebase resources, highlighting the ones
8+
that need attention based on your policies. ScanCode.io also identifies and highlights
9+
software vulnerabilities.
10+
11+
You can also use **DejaCode** to consume SBOMs from your suppliers, generally in the
12+
context of an SBOM that you intend to use in one of your own products.
13+
14+
1. Install AboutCode Projects
15+
-----------------------------
16+
17+
**Install ScanCode.io**
18+
19+
https://scancodeio.readthedocs.io/en/latest/installation.html
20+
21+
**Install DejaCode.**
22+
23+
https://dejacode.readthedocs.io/en/latest/installation.html
24+
25+
**Setup your own Dataspace in DejaCode**
26+
27+
https://dejacode.readthedocs.io/en/latest/dataspace.html
28+
29+
.. note::
30+
Not ready to install your own instance of DejaCode? Consider taking a look at
31+
the DejaCode public evaluation site to take a test drive, and if you have specific
32+
requirements, you may also request a private SaaS evaluation dataspace.
33+
See https://public.dejacode.com/account/register/
34+
35+
Configure DejaCode to integrate with ScanCode.io. See
36+
37+
https://dejacode.readthedocs.io/en/latest/application-settings.html#scancodeio
38+
39+
**Install PurlDB**
40+
41+
https://aboutcode.readthedocs.io/projects/PURLdb/en/latest/getting-started/install.html
42+
43+
Configure DejaCode to integrate with your PurlDB instance. See:
44+
45+
https://dejacode.readthedocs.io/en/latest/application-settings.html#purldb
46+
47+
.. note::
48+
Not ready to install your own instance of PurlDB? You can configure DejaCode to
49+
integrate with the public version at https://public.purldb.io/
50+
51+
**Install VulnerableCode**
52+
53+
https://vulnerablecode.readthedocs.io/en/latest/installation.html#installation
54+
55+
Configure Dejacode to integrate with your Vulnerablecode instance.
56+
57+
https://dejacode.readthedocs.io/en/latest/dataspace.html#enable-vulnerablecodedb-service
58+
59+
.. note::
60+
Not ready to install your own instance of VulnerableCode? You can configure DejaCode
61+
to integrate with the public version at https://public.vulnerablecode.io/
62+
63+
64+
2. Load Package Data from SBOMs to ScanCode.io
65+
----------------------------------------------
66+
67+
Create a new Project in ScanCode.io .
68+
69+
https://scancodeio.readthedocs.io/en/latest/user-interface.html#creating-a-new-project
70+
71+
Load package data from one or more SBOMs to your Project using the load_sbom Pipeline.
72+
73+
https://scancodeio.readthedocs.io/en/latest/built-in-pipelines.html#load-sbom
74+
75+
Review the details in your ScanCode.io project.
76+
77+
Export the results in the appropriate format to share with your team, such as CycloneDX
78+
and SPDX SBOMs.
79+
80+
https://scancodeio.readthedocs.io/en/latest/output-files.html#output-files
81+
82+
83+
3. Import SBOM data to a DejaCode Product
84+
-----------------------------------------
85+
86+
Create a new Product in DejaCode for comprehensive analysis and action.
87+
88+
https://dejacode.readthedocs.io/en/latest/tutorial-1.html
89+
90+
Load an SBOM to your Dejacode Product.
91+
92+
https://dejacode.readthedocs.io/en/latest/tutorial-5-sboms.html#load-an-sbom-to-your-product
93+
94+
Review and edit your Product in DejaCode. Enrich the data as needed.
95+
96+
Generate Attribution and SBOMs from DejaCode Products.
97+
98+
https://dejacode.readthedocs.io/en/latest/tutorial-5-sboms.html#tutorial-5-working-with-sboms-in-a-product

‎docs/source/getting-started/cra-compliance.rst‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
.. _cra-compliance:
2+
3+
Use AboutCode to support CRA compliance
4+
=======================================
5+
6+
The AboutCode stack provides you with the tools you need to support CRA Compliance
7+
activities, including code scanning and analysis, license identification, vulnerability
8+
management, and SBOM generation.
9+
10+
https://dejacode.readthedocs.io/en/latest/reference-3-cravex.html
11+

0 commit comments

Comments
 (0)