Streamlining Open-Source License Compliance With the Continuous Clearing Tool
summary
An open-source pipeline called Continuous Clearing automates SBOM generation (CycloneDX 1.6 or SPDX with PURLs), creates missing entries via SW360, triggers FOSSology scans and uploads approved artifacts to JFrog, cutting a manual license-clearing cycle that once took ~588 hours (10,000+ minutes, 4–6 weeks) down to 2–3 days in a 2,005-component case with 1,264 installs and 741 duplicates and saving roughly €1,780. Key modules are Package Identifier, SW360 Package Creator and Artifactory Uploader, and CI templates (Azure DevOps, extensible) make it production-ready.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:43Open-source license compliance
- 2:30Why compliance matters
- 3:13When to check licenses
- 4:58Siemens' compliance approach
- 9:29Manual compliance process
- 13:21Automation goals
- 17:37Continuous Clearing Tool overview
- 22:13Tool config and CI/CD integration
- 26:47Impact on release timelines
- 27:50Supported package types
- 36:24Q&A
related talks
39mSBOM Automation - Making Compliance Effortless by Consuming, Enrichin...
43mUsing SBOMs for Linux Foundation Projects
13mSW360 SBOM and License Obligation Management
32mAutomating Open-Source License Compliance
47mThe Missing Link - How we collect and leverage SBOMs
22mBuilding a Robust SBOM Solution with Backstage.io
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
15mShifting Open Source Compliance Activities Left