SW360
What it is
SW360 is an open-source software catalogue and repository for organizations tracking components across projects and products. It stores component, release, and project information, manages license obligations, and supports workflows for producing license documents. Software Bill of Materials management is listed as a use case. SW360 also collects vulnerability information and matches it with components in its component service. A REST API exposes its functions, with documented HTTP Basic, API token, OAuth2, and Keycloak authentication options. The system can trigger a FOSSology clearing process and import its reports; FOSSology performs the license scanning. SW360 itself does not scan licenses or source code. Recommended version 20 deployment uses Docker- or Podman-compatible containers containing the frontend, Keycloak, CouchDB, and Spring Boot backend. The project is licensed under EPL-2.0 and supports self-managed deployment. Its audience includes quality managers, developers, legal counsels, software architects, and R&D managers. Version 20.1.0 is listed with a July 29, 2026 date.
For and against
For
- Open source under EPL-2.0
- Tracks components, releases, and projects
- Supports SBOM management
- Provides REST API access
- Integrates with FOSSology
Against
- Self-managed deployment required
- Does not scan licenses itself
- Does not scan source code
- Container deployment is complex
The verdict
SW360 centralizes software component and compliance information with API access and external scanning integration. Teams must provide specialized scanning tools and manage the deployment themselves.
Who it suits
SW360 suits organizations coordinating component, license, SBOM, and vulnerability information. Its listed roles include developers, legal counsels, architects, quality managers, and R&D managers.
Plans and prices
SW360
Open source · EPL-2.0 · Self-managed deployment
Read 5 Oct 2026 · eclipse.dev
On the record
- API and integrations
- SW360 exposes its functionality through a REST API and documents HTTP Basic, API token, OAuth2, and Keycloak authentication options.eclipse.dev · read 5 Oct 2026
- Component tracking
- SW360 tracks software components used in projects or products and maintains related component, release, and project information.eclipse.dev · read 5 Oct 2026
- Deployment
- The recommended SW360 v20 deployment uses containers compatible with Docker or Podman and includes the frontend, Keycloak, CouchDB, and Spring Boot backend.eclipse.dev · read 5 Oct 2026
- FOSSology integration
- SW360 can trigger a FOSSology clearing process and import its reports; FOSSology performs the license scanning.eclipse.dev · read 5 Oct 2026
- Latest release shown
- The Eclipse project page lists version 20.1.0, dated July 29, 2026.projects.eclipse.org · read 5 Oct 2026
- License
- The project is open source and licensed under EPL-2.0.eclipse.dev · read 5 Oct 2026
- License compliance
- The application manages license information and obligations and supports workflows for producing license-related documents.eclipse.dev · read 5 Oct 2026
- Notable limitation
- License scanning and source code scanning are outside SW360’s scope; it delegates scanning to specialized tools and exchanges data with them.projects.eclipse.org · read 5 Oct 2026
- Purpose
- SW360 is a software catalogue and repository for collecting, organizing, and sharing information about software components used in an organization.eclipse.dev · read 5 Oct 2026
- SBOMs
- The user guide lists Software Bill of Materials management as a use case.eclipse.dev · read 5 Oct 2026
- Security configuration
- The security guide recommends TLS with trusted certificates, secret management, and restricting bearer-token validation to trusted issuers.eclipse.dev · read 5 Oct 2026
- Support and community
- The documentation lists a developer mailing list, a public Slack channel, and open developer meetings.eclipse.dev · read 5 Oct 2026
- Vulnerabilities
- SW360 collects vulnerability management information and matches it with components stored in its component service.eclipse.dev · read 5 Oct 2026
- Who it is for
- The project identifies quality managers, software developers, legal counsels, software architects, and R&D managers among the roles served.eclipse.dev · read 5 Oct 2026
