At the Open Chain and Friends event this March, one session stood out for its immediate practical value. Divided into two parts, the presentation moved from the “Why” of community curation to the “How” of technical implementation.
Following the Chatham House Rule, here is a simplified breakdown of the most practical session of the day.
Part 1: The Community Approach (OSSelot)
The first half of the session addressed a common headache: every company spends hours scanning the same open-source packages (like curl or bash) independently. This is a massive waste of resources.
The solution presented is OSSelot—a public curation database. Instead of starting from scratch, you can download pre-cleared compliance data.
-
What you get: Curated SPDX reports, license texts, and copyright notices that have already been reviewed by experts.
-
The Goal: To drastically reduce the time needed to clear a software package by reusing existing work.
Part 2: Putting it into Practice (FOSSology)
The second half, led by a deep dive into FOSSology, showed exactly how to automate this workflow. The beauty of this approach is in how it handles version updates.
The 3-Step Workflow:
-
Baseline Upload: You upload the “official” version of a package from OSSelot into FOSSology (often via a simple API call or URL upload).
-
Import Curated Data: Since the OSSelot data is already “cleared,” FOSSology absorbs this information instantly.
-
The “Delta” Scan: When you need to check a new version of that software, you run a scan and tell FOSSology to reuse the results from the OSSelot baseline.
Why this is a game-changer: FOSSology will automatically match the files that haven’t changed. You only have to manually review the new or modified files.
Final Thoughts
This was very practical and most interesting session for me at that day. It transformed the daunting task of license compliance into a manageable, collaborative process. By using community-curated data and the “Reuse” features of FOSSology, we can stop reinventing the wheel and focus only on what has actually changed in our code.
It’s a perfect example of how sharing creates value for everyone in the open-source ecosystem.
