Eclipse Apoapsis - Open Source based Software Composition Analysis at scale
summary
Eclipse Apoapsis packages a reproducible, multi‑project compliance service that wires the OSS Review Toolkit into an OR Server API, runs nightly GitHub Actions across dummy repos (C/C++, Go, Java, JavaScript, Python), emits SPDX/CycloneDX SBOMs and email summaries, and posts results to Dependency‑Track. Fact sheets and blueprints match product distribution, package managers and license obligations to tool combos. An MVP is public but rough; nightly tests prove the pipeline works while documentation and a web frontend remain WIP.
AI-written summary · about
chapters (10)
- 0:00Eclipse Apoapsis intro
- 4:05Java monoliths to modern stacks
- 9:52Scaling compliance automation
- 15:11Project goals and architecture
- 21:37Supply chain transparency
- 27:20Matching needs with solutions
- 31:58Open Source Review Toolkit setup
- 36:12OR server features and APIs
- 41:36Next steps and community
- 44:51Q&A
related talks
01h 21mOpen Source Best Practices at Eclipse Foundation
43mEclipse Oniro compliance toolchain
28mEMO & YOU
35mOSCAR - Automate software analysis, compliance and security
33mORT Automate compliance using Open Source & InnerSource
47mPolicing Open-Source Projects at Scale
39mRevising the Eclipse Foundation's Intellectual Property Due Diligence Process
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...