Skip to content

Commit a947eb4

Browse files
author
Gyan Ranjan Panda
committed
docs: condense persona pages for clarity
Shortened all three persona landing pages to be more concise: - Legal/Compliance: 117 → 40 lines - Security/SCA: 150 → 45 lines - Developer/Integrator: 226 → 75 lines Changes focus persona pages on quick navigation paths rather than full tutorials. Removed redundant tool descriptions and verbose explanations while keeping essential code examples and links. Total reduction: ~540 → ~160 lines (~70% shorter) Signed-off-by: Gyan Ranjan Panda <gyanranjanpanda@gmail.com>
1 parent 05c8415 commit a947eb4

File tree

3 files changed

+83
-422
lines changed

3 files changed

+83
-422
lines changed

docs/source/personas/developer-integrator.rst

Lines changed: 35 additions & 187 deletions
Original file line numberDiff line numberDiff line change
@@ -4,221 +4,69 @@
44
For Developers & Integrators
55
====================================
66

7-
Welcome! If you're integrating AboutCode tools into your development workflow, CI/CD
8-
pipeline, or building applications that consume AboutCode data, you're in the right place.
7+
If you're integrating AboutCode into your development workflow, CI/CD pipeline, or building
8+
applications that consume AboutCode data, this is your starting point.
99

10-
AboutCode provides powerful APIs, command-line tools, and libraries that you can use to
11-
automate scanning, generate SBOMs, and integrate license and vulnerability analysis into
12-
your systems.
10+
Quick Start Paths
11+
=================
1312

14-
What You Can Accomplish
15-
=======================
13+
**Command-Line Usage**
14+
:ref:`scancode-toolkit-project` - CLI scanning and SBOM generation
1615

17-
With AboutCode, you can:
16+
**API Integration**
17+
:ref:`scancodeio-project` - REST API documentation
18+
:ref:`vulnerablecode-project` - Vulnerability API
19+
→ https://purldb.readthedocs.io - Package metadata API
1820

19-
- **Automate Code Scanning**: Run license and vulnerability scans from the command line or CI/CD
20-
- **Generate SBOMs Programmatically**: Create CycloneDX and SPDX SBOMs via API or CLI
21-
- **Integrate with Your Tools**: Use REST APIs to query vulnerability data and package metadata
22-
- **Build Custom Workflows**: Create pipelines that combine scanning, analysis, and reporting
23-
- **Parse and Process Results**: Work with structured JSON/YAML output for downstream processing
21+
**CI/CD Pipelines**
22+
:ref:`scancode-action-project` - GitHub Actions integration
2423

25-
Key Workflows
26-
=============
24+
**SBOM Workflows**
25+
:ref:`create-sboms` - Generate SPDX and CycloneDX SBOMs
26+
:ref:`consume-sboms` - Import and process SBOMs
2727

28-
1. Command-Line Scanning
29-
------------------------
30-
31-
Use ScanCode Toolkit from the command line to scan code, detect licenses, extract
32-
copyrights, and identify packages.
33-
34-
The CLI provides extensive options for customizing scans, filtering results, and
35-
generating output in various formats (JSON, YAML, SPDX, CycloneDX).
28+
Quick Examples
29+
==============
3630

37-
**Example:**
31+
**Basic CLI Scan:**
3832

3933
.. code-block:: bash
4034
41-
# Basic scan
4235
scancode -clpieu --json-pp output.json /path/to/code
4336
44-
# Scan with license policies
45-
scancode --license-policy policies.yml --json output.json /path/to/code
46-
47-
# Generate SPDX SBOM
48-
scancode --spdx output.spdx /path/to/code
49-
50-
**Learn more:** :ref:`scancode-toolkit-project`
51-
52-
**Tools you'll use:** ScanCode Toolkit
53-
54-
2. API Integration
55-
------------------
37+
**Generate SPDX SBOM:**
5638

57-
ScanCode.io provides a REST API for triggering scans, retrieving results, and managing
58-
projects programmatically.
39+
.. code-block:: bash
5940
60-
You can integrate scanning into your CI/CD pipeline, automate SBOM generation, or build
61-
custom applications that consume scan data.
41+
scancode --spdx output.spdx /path/to/code
6242
63-
**Example:**
43+
**Python API Usage:**
6444

6545
.. code-block:: python
6646
6747
import requests
68-
69-
# Create a project
7048
response = requests.post(
7149
'https://your-scancodeio.com/api/projects/',
7250
json={'name': 'my-project'},
7351
headers={'Authorization': 'Token your-api-token'}
7452
)
7553
76-
# Upload code and run pipeline
77-
project_url = response.json()['url']
78-
# ... upload files and trigger pipeline
79-
80-
**Learn more:** :ref:`scancodeio-project`
81-
82-
**Tools you'll use:** ScanCode.io API, VulnerableCode API, PurlDB API
83-
84-
3. CI/CD Pipeline Integration
85-
-----------------------------
86-
87-
Integrate AboutCode scanning into your continuous integration pipeline to catch license
88-
and security issues early in the development process.
89-
90-
You can use GitHub Actions, GitLab CI, Jenkins, or any CI system that supports running
91-
command-line tools or making API calls.
92-
93-
**Example (GitHub Actions):**
94-
95-
.. code-block:: yaml
96-
97-
- name: Scan with ScanCode
98-
uses: aboutcode-org/scancode-action@v1
99-
with:
100-
path: .
101-
output: scancode-results.json
102-
103-
**Learn more:** :ref:`scancode-action-project`
104-
105-
**Tools you'll use:** ScanCode Action, ScanCode Toolkit, ScanCode.io
106-
107-
4. Creating and Consuming SBOMs
108-
-------------------------------
109-
110-
Generate software bills of materials (SBOMs) in industry-standard formats like SPDX
111-
and CycloneDX.
112-
113-
You can create SBOMs from scan results, import SBOMs from other tools, enrich them with
114-
additional data, and export them for sharing with customers or partners.
115-
116-
**Learn more:** :ref:`create-sboms` and :ref:`consume-sboms`
117-
118-
**Tools you'll use:** ScanCode Toolkit, ScanCode.io, DejaCode
119-
120-
Recommended Tools & Libraries
121-
==============================
122-
123-
**ScanCode Toolkit**
124-
Command-line scanner with extensive options and multiple output formats. The
125-
foundation for all AboutCode scanning.
126-
127-
:ref:`scancode-toolkit-project`
128-
129-
GitHub: https://github.com/aboutcode-org/scancode-toolkit
54+
Key Concepts
55+
============
13056

131-
**ScanCode.io**
132-
Web application with REST API for running complex scanning pipelines. Supports
133-
Docker images, packages, and codebases.
57+
**Package URLs (PURLs)**
58+
Universal package identifiers: ``pkg:npm/express@4.18.2``
13459

135-
:ref:`scancodeio-project`
136-
137-
GitHub: https://github.com/aboutcode-org/scancode.io
138-
139-
**VulnerableCode API**
140-
REST API for querying vulnerability data by package, CVE, or PURL.
141-
142-
:ref:`vulnerablecode-project`
143-
144-
Public API: https://public.vulnerablecode.io/api/
145-
146-
**PurlDB API**
147-
REST API for querying package metadata by PURL.
148-
149-
https://purldb.readthedocs.io
150-
151-
Public API: https://public.purldb.io/api/
60+
**Output Formats**
61+
JSON, YAML, SPDX, CycloneDX, CSV, HTML
15262

15363
**Python Libraries**
154-
- **license-expression**: Parse and normalize SPDX license expressions
155-
- **packageurl-python**: Work with Package URLs (PURLs)
156-
- **commoncode**: Common utilities for file handling, hashing, and dates
157-
- **extractcode**: Universal archive extraction
158-
159-
:ref:`license-expression-project`
160-
161-
Working with Package URLs (PURLs)
162-
==================================
163-
164-
Package URLs (PURLs) are a universal way to identify software packages across all
165-
ecosystems. AboutCode tools use PURLs extensively.
166-
167-
**Format:**
168-
169-
.. code-block:: text
170-
171-
pkg:type/namespace/name@version?qualifiers#subpath
172-
173-
**Examples:**
174-
175-
.. code-block:: text
176-
177-
pkg:npm/express@4.18.2
178-
pkg:pypi/django@4.2.0
179-
pkg:maven/org.apache.commons/commons-lang3@3.12.0
180-
pkg:docker/library/nginx@1.25.0
181-
182-
**Python usage:**
183-
184-
.. code-block:: python
185-
186-
from packageurl import PackageURL
187-
188-
purl = PackageURL.from_string('pkg:npm/express@4.18.2')
189-
print(purl.type) # 'npm'
190-
print(purl.name) # 'express'
191-
print(purl.version) # '4.18.2'
192-
193-
Output Formats
194-
==============
195-
196-
AboutCode tools support multiple output formats:
197-
198-
- **JSON**: Structured data for programmatic processing
199-
- **YAML**: Human-readable structured data
200-
- **SPDX**: Industry-standard SBOM format (JSON, YAML, RDF, tag-value)
201-
- **CycloneDX**: OWASP SBOM standard (JSON, XML)
202-
- **CSV**: Tabular data for spreadsheet analysis
203-
- **HTML**: Human-readable reports
204-
205-
Next Steps
206-
==========
207-
208-
**New to AboutCode?**
209-
Start with :ref:`start-scanning-code` to understand the basics.
210-
211-
**Ready to automate?**
212-
Check out the ScanCode Toolkit CLI documentation for command-line options.
213-
214-
**Building an integration?**
215-
Review the ScanCode.io API documentation for REST endpoints.
216-
217-
**Need to understand the data model?**
218-
See :ref:`aboutcode_data` for AboutCode data structures.
64+
- ``packageurl-python`` - Work with PURLs
65+
- ``license-expression`` - Parse SPDX license expressions
21966

220-
**Also need compliance workflows?**
221-
Visit :ref:`persona-legal-compliance` for policy management and reporting.
67+
Also Explore
68+
============
22269

223-
**Interested in security analysis?**
224-
Check out :ref:`persona-security-researcher` for vulnerability scanning.
70+
- :ref:`aboutcode_data` - AboutCode data structures
71+
- :ref:`persona-legal-compliance` - For compliance workflows
72+
- :ref:`persona-security-researcher` - For vulnerability analysis

docs/source/personas/legal-compliance.rst

Lines changed: 22 additions & 102 deletions
Original file line numberDiff line numberDiff line change
@@ -4,115 +4,35 @@
44
For Legal & Compliance Professionals
55
========================================
66

7-
Welcome! If you're responsible for ensuring your organization's software complies with
8-
licensing requirements, manages open source risks, or needs to generate attribution
9-
documentation, you're in the right place.
7+
If you're responsible for license compliance, managing open source policies, or generating
8+
attribution documentation, AboutCode helps you understand what's in your software and meet
9+
your legal obligations.
1010

11-
AboutCode provides tools to help you understand what's in your software, ensure license
12-
compliance, and generate the reports you need for audits and legal reviews.
13-
14-
What You Can Accomplish
15-
=======================
16-
17-
With AboutCode, you can:
18-
19-
- **Understand License Obligations**: Identify all licenses in your codebase and
20-
understand what they require
21-
- **Manage License Policies**: Define which licenses are approved, restricted, or
22-
prohibited for your organization
23-
- **Generate Attribution Documents**: Automatically create license notices and attribution files
24-
- **Review Supplier SBOMs**: Analyze software bills of materials from your vendors
25-
- **Support Regulatory Compliance**: Meet requirements like the EU Cyber Resilience Act (CRA)
26-
27-
Key Workflows
28-
=============
29-
30-
1. Managing License Policies
31-
----------------------------
32-
33-
Define your organization's license policies and apply them consistently across all projects.
34-
35-
You can specify which licenses are approved for use, which require legal review, and which
36-
are prohibited. These policies can then be applied automatically when scanning code.
37-
38-
**Learn more:** :ref:`manage-license-policies`
39-
40-
**Tools you'll use:** DejaCode, ScanCode.io
41-
42-
2. Generating Attribution Documents
43-
-----------------------------------
44-
45-
When you ship software that includes open source components, you need to provide proper
46-
attribution to comply with license terms.
47-
48-
AboutCode can automatically generate attribution notices, license texts, and other
49-
required documentation based on your scan results.
50-
51-
**Learn more:** :ref:`create-sboms`
52-
53-
**Tools you'll use:** ScanCode Toolkit, DejaCode, AboutCode Toolkit
54-
55-
3. Reviewing Software from Suppliers
56-
------------------------------------
57-
58-
When you receive software from vendors or suppliers, you need to understand what's
59-
included and whether it meets your compliance requirements.
60-
61-
You can import SBOMs (Software Bills of Materials) from suppliers, enrich the data with
62-
additional analysis, and verify compliance with your policies.
63-
64-
**Learn more:** :ref:`consume-sboms`
65-
66-
**Tools you'll use:** ScanCode.io, DejaCode, PurlDB
67-
68-
4. Supporting CRA Compliance
69-
----------------------------
70-
71-
The EU Cyber Resilience Act requires manufacturers to provide transparency about the
72-
software components in their products.
73-
74-
AboutCode provides the scanning, analysis, and SBOM generation capabilities you need to
75-
meet these requirements.
76-
77-
**Learn more:** :ref:`cra-compliance`
78-
79-
**Tools you'll use:** DejaCode, ScanCode.io
80-
81-
Recommended Tools
11+
Quick Start Paths
8212
=================
8313

84-
**DejaCode**
85-
Enterprise application for managing your open source compliance program. Create
86-
products, track components, manage policies, and generate reports.
87-
88-
:ref:`dejacode-project`
89-
90-
**ScanCode.io**
91-
Web-based scanning platform with pipelines for analyzing code, packages, and
92-
containers. Integrates with DejaCode for comprehensive compliance workflows.
93-
94-
:ref:`scancodeio-project`
95-
96-
**ScanCode Toolkit**
97-
Command-line tool for detecting licenses, copyrights, and other metadata in code.
98-
The foundation for all AboutCode scanning capabilities.
14+
**New to AboutCode?**
15+
:ref:`start-scanning-code` - Learn the basics of scanning code
9916

100-
:ref:`scancode-toolkit-project`
17+
**Setting Up Compliance**
18+
:ref:`manage-license-policies` - Define approved/restricted licenses
19+
:ref:`create-sboms` - Generate attribution documents
10120

102-
Next Steps
103-
==========
21+
**Reviewing Supplier Software**
22+
:ref:`consume-sboms` - Import and analyze vendor SBOMs
10423

105-
**New to AboutCode?**
106-
Start with :ref:`start-scanning-code` to understand how scanning works.
24+
**Regulatory Requirements**
25+
:ref:`cra-compliance` - EU Cyber Resilience Act support
10726

108-
**Ready to set up your compliance program?**
109-
Follow :ref:`manage-license-policies` to define your organization's policies.
27+
Key Tools
28+
=========
11029

111-
**Need to analyze supplier software?**
112-
Check out :ref:`consume-sboms` for importing and reviewing SBOMs.
30+
- **DejaCode** - Enterprise compliance management platform
31+
- **ScanCode.io** - Web-based scanning with policy enforcement
32+
- **ScanCode Toolkit** - Command-line license and copyright detection
11333

114-
**Looking for developer integration?**
115-
See :ref:`persona-developer-integrator` for API and automation options.
34+
Also Explore
35+
============
11636

117-
**Interested in security analysis?**
118-
Visit :ref:`persona-security-researcher` for vulnerability scanning workflows.
37+
- :ref:`persona-security-researcher` - If you also handle security compliance
38+
- :ref:`persona-developer-integrator` - For automation and CI/CD integration

0 commit comments

Comments
 (0)