hatto
hatto is CLI for SBOM policy evaluation.
Requirements
hatto is using PyO3. So, hatto requires Python shared library.
Usage
evaluate
<FILE>
The evaluate ARGS file is SBOM or tsv. SBOM supports SPDX
or CycloneDX
.
Yet another hatto supports tsv. This tsv file must contain header.
example example.tsv
name version licenses annotations
foo 1.0.1 MIT,Apache-2.0 usage=service
bar 1.1.2 UNKNOWN
These files can generate with any license collection tool. If the license collection tool does not support SBOM, you shoud convert to tsv or SBOM.
And you can configure --policy
and --curation
.
The --policy
file defines license policy that written in python. The policy file must implements def evaluate(material, result)
.
example polocy.py
#!/usr/bin/python
=
UNKNOWN
is not allowed on policy.py
. Therefore hatto evaluate
is failed.
You may know bar
true license is BSD-3-Clause
. In such a case you can patch license information by --curation
file. The curation file must implement def curate_material(material)
.
example curation.py
#!/usr/bin/python
=
These allow hatto to perform flexible license policy evaluation on your teams or organizations.
Lisense
Licensed under either of
- Apache License, Version 2.0 (LICENSE-APACHE or http://www.apache.org/licenses/LICENSE-2.0)
- MIT license (LICENSE-MIT or http://opensource.org/licenses/MIT)
at your option.
Contribution
Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.