The OSS Review Toolkit (ORT) helps engineering teams automate repeatable parts of open-source compliance: discovering dependencies, collecting source code, scanning for license and copyright information, checking configured security advisories, evaluating policy, and producing reports. It is a flexible toolkit rather than a single all-or-nothing compliance check: teams can combine the stages and integrations that suit their workflow, then review important findings before relying on them.
What is the OSS Review Toolkit?
ORT is an open-source toolkit for analyzing software dependencies and orchestrating configurable FOSS policy workflows. It can be used as a library, from its command-line interface, or in CI integrations. Its outputs can include CycloneDX or SPDX software bills of materials (SBOMs), FOSS attribution notices, and policy results. The ORT introduction describes its purpose and capabilities.
ORT is not itself a legal determination that a product is compliant. It organizes dependency data, configured checks, and reports so a team can apply its own policy and review process.
How ORT’s pipeline works
The project’s components can be combined into a customizable pipeline. A team does not have to run every component for every project.
Recommended Free Tools
#1 Best Overall
| Component | Role |
|---|---|
| Analyzer | Identifies dependencies and package metadata across supported package managers and build systems. |
| Downloader | Fetches dependency source code for later steps. |
| Scanner | Uses configured scanners to find license and copyright information in source files. |
| Advisor | Retrieves security advisories from configured services. |
| Evaluator | Applies configured rules and license classifications to produce policy violations. |
| Reporter | Creates visual reports, notices, and SBOMs. |
| Notifier | Sends results through configured notification channels. |
These roles and the available outputs are described in the project introduction. The stages make it possible to tailor a workflow—for example, to generate an SBOM and notices without treating every optional integration as mandatory.
How a team runs ORT
The documented CLI workflow starts analysis with a project directory as input and a chosen output directory. ORT can also be incorporated into CI; the usage guide describes a basic analyzer, scanner, and reporter flow. Exact commands and options depend on the chosen inputs and configuration, so use the ORT usage guide for the current syntax.
- Install ORT and confirm runtime requirements. Choose a Docker image, release binary, or source build using the installation guide. For binaries, the current runtime requirements specify Java 25 or later.
- Configure the project and policy. ORT supports global configuration and project-level
.ort.ymlsettings. The repository configuration can define inclusions and exclusions, resolutions, curations, package configurations, and license choices. See Repository Configuration. - Run the stages needed for the workflow. Start with analysis, then add source downloading, scanning, advisory lookup, evaluation, reporting, or notification as appropriate. A CI pipeline can run these stages on the team’s chosen schedule or change trigger.
- Review results and maintain configuration. Investigate findings that affect policy or releases, document justified resolutions, and update curated metadata when package versions or evidence change.
Installation choices and operational needs
The official installation documentation describes Docker images, downloadable release binaries, and building from source. It distinguishes a full ort image, which includes all supported package managers, from ort-minimal, which includes a smaller commonly used subset. Release examples and version labels on documentation pages can change; consult the installation guide for the version currently offered rather than treating an example as a permanent latest-release claim.
The runtime documentation lists Linux, Windows, and macOS as well-supported. Its general recommendation is 8 GiB of memory and at least 4 CPU cores, while noting that actual needs vary by project size and type. Treat this as planning guidance, not a universal minimum or a measured guarantee.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- Used Book in Good Condition
What ORT can report—and what it cannot decide for you
ORT can create SPDX and CycloneDX SBOMs, FOSS attribution documentation, visual reports, and policy results. Those artifacts help teams inventory dependencies and communicate configured findings. Their usefulness depends on the inputs, integrations, configuration, and review process behind them.
License information needs particular care because several different data points can appear for the same package:
- Declared license: the license claim in package metadata.
- Detected licenses: scanner findings from files in the source.
- Concluded license: a curated conclusion based on review and verifiable evidence.
- Effective license: the license applied in the project context, including a valid selection among alternatives.
Declared metadata and scanner findings can disagree. ORT’s license-handling guide recommends objective, evidence-based curation. Broad overrides can hide a new or changed license in a later package version, so a narrow finding-level curation is preferable where it addresses the issue.
License choices and policy are contextual
A configured license choice is valid only for alternatives joined by SPDX OR. It changes which effective license ORT uses for evaluation and reporting; it does not prove that the selection is legally correct in every context. Teams should define policy and review findings in light of their own distribution model, release context, and legal requirements. The configuration reference and license guide explain these mechanisms.
Free tools Windows power users keep installed
One-click scans. No signup required.
Where human review remains essential
Automation is most useful for repeatable discovery, evidence gathering, policy application, and report generation. People still need to decide what a finding means for a particular product and whether the available evidence supports a resolution.
- Check meaningful differences between package metadata and source scans rather than assuming one automatically overrides the other.
- Base curated conclusions on verifiable facts and keep them as narrow as practical.
- Review security and license policy outcomes against the organization’s configured rules and release context.
- Revisit resolutions and curation when dependency versions or source evidence change.
- Have appropriate legal or compliance reviewers assess questions that require interpretation beyond the configured rules.
Who should consider ORT?
ORT is suited to engineering teams and open-source program offices that need a configurable way to analyze dependencies, apply FOSS policy, and generate reusable compliance artifacts. It can fit teams that want a CLI or CI workflow and are prepared to own configuration, integrations, and review. The project is licensed under Apache License 2.0 and describes itself as a Linux Foundation project and part of ACT; see the ORT license page.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
