oss-review-toolkit/ort

ORT is a policy automation and orchestration toolkit for managing open source software dependencies and compliance.

The toolkit addresses the challenge of tracking licenses, security vulnerabilities, and policy violations across software dependencies at scale. It works by combining multiple specialized tools into a customizable pipeline: an Analyzer determines project dependencies across different package managers, a Downloader fetches source code, a Scanner detects license and copyright findings, an Advisor retrieves security vulnerability data, an Evaluator applies custom policy rules, and a Reporter generates results in formats like SBOMs, attribution documentation, and compliance reports. This modular approach lets teams automate compliance checks without being locked into specific tools or formats.

ORT suits organizations with complex dependency landscapes that need systematic compliance enforcement. It works well for projects requiring SBOM generation, license compliance verification, or policy-as-code enforcement across multiple repositories. The toolkit can be used as a library, command-line tool, or through CI integrations, making it adaptable to different workflows. Teams should expect to invest in understanding the policy evaluation layer and configuring scanners and advisors for their specific compliance needs.

The project's issue tracker is primarily driven by internal planning rather than external user demand, with most issues raised by the core team. Response times to new issues and pull requests are slow, often taking weeks or longer for initial feedback. Development activity concentrates on the Analyzer, Reporter, and Scanner components, suggesting these areas receive the most attention and refinement.