An explosive growth of Open Source Software (OSS) makes finding the correct origin and licensing information ever more complicated. In addition, engineers are not licensing experts and and need guidance and support in purposeful policies, processes, and infrastructure to maximize the OSS adoption efficiency and be in control of the code base. But how does Software Composition Analysis (SCA) tools work, and what techniques and strategies exist for scanning a codebase, their strengths and weaknesses?

This presentation gives an introduction to the complexity in OSS compliance and security, what challenges that SCA tools manufacturers attempt to solve, what decisions that need to be made in the analysis phase, and a few lessons learned as a tools and services vendor.