Replies: 21 comments 62 replies
-
Idea!Title: Sample project idea 1Goal: Example Automate the process of model training using pipelining.Detailed explanation about the project idea. What is expected, if there is already any workflow, etc to be added here. Bellow are rating out of 3.
Contact: @GMishx |
Beta Was this translation helpful? Give feedback.
-
Idea!Title: Creating Components as a separate service in SW360Goal: Idea is to create a Components as a service that can then be used by multiple Org to reuse common component repositoryDecompose SW360 backend and extract out the Component and related modules like Releases, Packages. This new service should be capable of running with its own DB and as a standalone service.
Contact : @GMishx @bibhuti230185 @amritkv @rudra-superrr |
Beta Was this translation helpful? Give feedback.
-
Idea!Title: SBOM ValidatorGoal: Design and implement an SBOM Validator that ensures uploaded SBOMs meet organizational and regulatory requirements by validating completeness, consistency, and structureThe SBOM Validator processes SBOMs generated by different tools and provided in various standard formats (such as SPDX and CycloneDX). It validates that all mandated fields are present and correctly populated according to defined policies and compliance requirements. The validator may optionally convert incoming SBOMs into a standardized internal representation. When enabled, this internal format is used to simplify validation logic, ensure consistent behaviour across SBOM sources, and reduce format-specific handling. When not enabled, validation can be performed directly against the original SBOM structure. During processing, the validator consolidates duplicate or overlapping packages and components, resolving inconsistencies such as multiple representations of the same dependency. Additionally, the validator supports SBOM enrichment by augmenting existing data with derived or externally sourced information, such as normalized package identifiers or additional metadata. Before final import, users are provided with a clear graphical and navigable visualization of the parsed and consolidated SBOM data instead of boaring flat list view, allowing them to review structure, metadata, and detected issues. In a summary:
Contact : @amritkv |
Beta Was this translation helpful? Give feedback.
-
Idea!Title: CLIXML visualizer for release attachmentsGoal: The idea here is to provide a clearance report visualizer for the CLIXML coming from FOSSologyCurrently, SW360 users must download separate CLIXML files or log into FOSSology to understand the clearance status of a release. This feature would allow SW360 to parse the CLIXML report directly within the browser. The key features to this idea can be pointed out as follows:
Contact : @amritkv @rudra-superrr @deo002 |
Beta Was this translation helpful? Give feedback.
-
Idea!Title: Integration of SW360 and LicenseDBGoal: To establish LicenseDB as the sole source for all license and obligation data within SW360, streamlining data management and ensuring consistency.Currently, SW360 relies on a fragmented approach for managing license and obligation information. Licenses can be imported from external sources like OSADL or SPDX, or created manually. Obligations, which define the requirements associated with each license, can only be created manually within SW360. This decentralized system can lead to inconsistencies, manual overhead, and difficulty in maintaining a single, accurate view of license compliance. This project aims to change how SW360 manages this data by integrating it directly with LicenseDB. The successful completion of this project will involve:
Checkout LicenseDB at: https://github.com/fossology/LicenseDb
|
Beta Was this translation helpful? Give feedback.
-
Idea!Title: Remove Apache Thrift and Migrate to Direct Spring Service CallsGoal: Eliminate Apache Thrift dependency from SW360 and replace inter-service communication with direct Spring Bean injection and REST APIsSW360 currently uses Thrift for backend service communication (ThriftClients, *Service.Iface). This adds complexity, requires .thrift IDL files, and creates tight binary coupling. Migrate to Spring-managed services with direct injection for in-process calls and REST for external integrations. Current state vs Expected state
Contact : @GMishx @bibhuti230185 @amritkv @rudra-superrr |
Beta Was this translation helpful? Give feedback.
-
Idea!Title: Archival of Components and ProjectsGoal: Creation of an archival and restore functionality to remove unnecessary Projects and Components from SW360 serverAs an SW360 instance grows over years of use, the database becomes cluttered with "stale" projects and deprecated component versions that are no longer in active use. This feature introduces an Archival Workflow. The archival workflow should allow complete removal of a Project or Component or Release from the SW360 server (with entire metadata like changelogs, attachments, etc.) into a single compressed package (e.g., a ZIP or TAR containing JSON metadata), and purges them from the active database. At the same time, there should be a Workflow to restore these archived projects/components/releases individually for the purpose of audit, reuse, etc. This archival process will allow usage of cold storage backups and improve upon the performance of application by reducing index size, speeds up UI responsiveness, and saves significant disk space. Feature points to consider:
Contact : @GMishx @amritkv @rudra-superrr |
Beta Was this translation helpful? Give feedback.
-
Idea!Title: Project 360 viewGoal: To empower product owners and compliance teams with a single, trusted source of compliance truthProject 360° View delivers a holistic compliance dashboard for both parent and child projects, offering complete visibility into software usage, security risks, and license obligations. It consolidates vulnerability data across the entire project hierarchy, clearly highlighting severity levels, affected components, and overall compliance impact. The view also presents approved and pending releases, along with clearing request and legal approval status, giving product owners a clear picture of release readiness. By unifying security, legal, and release data into a single interface, Project 360° View enables faster audits, reduces compliance risk, and supports confident, data-driven release decisions.
Contact: @amritkv @rudra-superrr @deo002 |
Beta Was this translation helpful? Give feedback.
-
Idea!Title: Customize Copy ProjectGoal: Idea is to allow users to provide fields they want to carry over while using the "Copy Project" featureCurrently when a user wants to use duplicate/copy projects to create, lets say a new version, they do not have a choice of fields to be carried over. SW360 copies all and everything to the new Project and the user has to manually make sure everything is up-to-date. This new feature will allow users to pick and choose the fields they want to carry over into the new Project and leave the rest. To implement this feature, the changes would have to be done at both front-end and back-end side.
|
Beta Was this translation helpful? Give feedback.
-
Idea!Title: Provide alternative Component linkGoal: Provide a data structure to deprecate a Component and provide link to new ComponentDepending on how Admins are using the SW360 instance, they want to manage the Component naming/grouping in a different way. There can also be scenarios where an OSS project decided to rename themselves over period. In such cases, you might want to mark a Component as deprecated and provide an alternative to be used instead. All this information still needs to be preserved and documented in SW360 but needs to be machine readable as well. When using automation to generate SBOM and import in SW360 like with capycli, adding all such customization makes them tool specific and someone using different tool might not understand this. The main idea of this project is to provide such fields in the Component DataStructure where user can mark a Component (and all its Releases) as deprecated. At the same time, make it easy to provide link to alternatives to be used. Such information, when provided over REST API, can be used by frontend to display information like bellow. At the same time allow tools to use this information to make smart decisions. As an add-on, SW360 can be allowed to completely disallow changes in deprecated Components and use the alternative instead to create new Releases.
Contact: @amritkv |
Beta Was this translation helpful? Give feedback.
-
|
Hi @GMishx @amritkv @bibhuti230185 @rudra-superrr, I'm Sneha Khoreja, currently pursuing a Master's in Applied Computer Science and exploring potential GSoC 2026 contributions to SW360. I’ve been going through the repository and the project ideas listed here, particularly the “Remove Apache Thrift and Migrate to Direct Spring Service Calls” proposal. My background is mainly in Java/Spring microservices. Over the past couple of years I’ve worked on backend systems built with Spring Boot, Hibernate, Docker, and Kafka, including projects involving service discovery and inter-service communication patterns. While reading through the idea, a few implementation questions came up: 1)For the Thrift removal, is the expectation to migrate incrementally (module/service by module) or move toward a single larger refactor? 2)Are there specific modules in SW360 where Thrift usage is more isolated and could serve as a good starting point for the migration? 3)During the transition, should the goal be to maintain temporary compatibility with existing Thrift interfaces, or is a clean replacement acceptable for the initial scope? At the moment I’m setting up SW360 locally and reviewing how Thrift is currently used across the backend modules so I can identify a reasonable starting point for a first contribution. I’m also interested in the “Creating Components as a separate service” idea, since it involves service decomposition and standalone deployment. If there are particular areas of the codebase that would be useful to explore first, I’d appreciate the direction. GitHub: https://github.com/sneha4175 Thanks. Sneha |
Beta Was this translation helpful? Give feedback.
-
|
Hi maintainers @GMishx @amritkv @rudra-superrr @deo002, I’m Omkar, a Computer Science student interested in applying for GSoC 2026 with SW360. After exploring the ideas listed here, I’m particularly interested in working on Project 360° View and Customize Copy Project, as they involve both backend APIs and frontend development. My experience includes JavaScript, React, Next.js, Node.js, REST APIs, and database work. I’m currently exploring the SW360 repository and setting up the project locally to better understand the architecture. I would love to start contributing and would appreciate guidance on beginner-friendly issues or areas I should explore first while preparing my proposal. Looking forward to contributing to SW360! |
Beta Was this translation helpful? Give feedback.
-
|
Greetings @GMishx @amritkv @rudra-superrr @deo002! |
Beta Was this translation helpful? Give feedback.
-
|
Hello @GMishx, @amritkv, @rudra-superrr and @deo002! I have a strong interest in backend development with Spring Boot, and I want to use this GSoC season to move away from building simple prototypes and learn how to contribute to a professional, large-scale codebase. This 'Small' project seems like a great place for me to start learning the SW360 architecture correctly. My first goal is to set up the environment locally via Docker to see the tool in action. While I work on that, are there any specific Java files or 'Good First Issues' related to the 'Copy' logic that you recommend I study first? Excited to be part of the community! |
Beta Was this translation helpful? Give feedback.
-
|
Hi everyone! My name is Muneeb Ahmed Siddiqui (@byte-muneeb). I am a full-stack developer (React/NextJS & Spring Boot) and I have just officially submitted my GSoC 2026 proposal for the Customize Copy Project idea! I've read the 2026 guidelines regarding installation and contributions. I am currently setting up my local development environment using Docker to provide the required proof of installation. @GMishx @deo002, while I work on that, are there any specific 'good first issues' you recommend I look into to satisfy the contribution criteria? |
Beta Was this translation helpful? Give feedback.
-
|
Hi @GMishx, @bibhuti230185, @amritkv, and @rudra-superrr, I’m Mahmoud, a software engineering student from Egypt with professional experience building Java/Spring Boot microservices. I'm currently preparing my GSoC 2026 proposal to extract the SW360 Components module into a standalone service. To familiarize myself with the codebase, I recently submitted PR #3956 (resolving Issue #3955 in As I begin outlining my proposal, I’d appreciate your guidance to ensure I'm heading in the right direction:
I’ll share an initial draft with you very soon for early feedback. Thanks for your time and mentorship! |
Beta Was this translation helpful? Give feedback.
-
|
Subject: Draft Proposal: Eliminating Apache Thrift for Spring Native Services "Hello SW360 Mentors @GMishx @deo002, I am Sanjana Dubariya, a 3rd-year IT student. I’ve been exploring the SW360 backend and am very interested in the project to Remove Apache Thrift and Migrate to Direct Spring Service Calls. I have a strong background in Java/Spring Boot and C++, and I’ve already successfully set up the SW360 development environment using Docker and WSL. I’ve drafted a proposal focused on: Moving from Thrift IDL to clean POJOs with Lombok. Transitioning to Direct @Autowired injection for in-process calls. Expanding the REST Resource Server to replace Thrift servlets. I would love to get some initial feedback on this direction before I finalize my PDF for the GSoC portal. You can view my draft [Link to a Google Doc or GitHub Gist]. Looking forward to contributing! |
Beta Was this translation helpful? Give feedback.
-
|
Hi @GMishx @deo002 |
Beta Was this translation helpful? Give feedback.
-
|
Thanks a lot, that makes sense now 🙏
I was focusing on CouchDB, didn’t realize the issue was from the OAuth
layer.
I’ll run the script inside the container and try getting the access token
before calling the API.
Really appreciate your help 🤍
…On Thu, 26 Mar 2026 at 10:55 PM Sujal Kalauni ***@***.***> wrote:
Hey @mvchnccc-oss <https://github.com/mvchnccc-oss>, I had the same
issue. Your CouchDB is set up correctly — the databases are there. The
unauthorized error is coming from the OAuth layer, not CouchDB itself.
The fix is to run addUnsafeDefaultClient.sh inside the SW360 container.
This creates the OAuth client and admin user that the API needs to
authenticate requests.
docker exec -it sw360 bash
bash /app/sw360/scripts/addUnsafeDefaultClient.sh
After that, use the token endpoint to get an access token before hitting
the API. Hope that helps.
—
Reply to this email directly, view it on GitHub
<#3631?email_source=notifications&email_token=BVMPQ2FTQJHLQTLRAQ2V4334SWKLBA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNRTGMZDQNZRUZZGKYLTN5XKO3LFNZ2GS33OUVSXMZLOOSWGM33PORSXEX3DNRUWG2Y#discussioncomment-16332871>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/BVMPQ2A2MYQJHUU76G3BNUL4SWKLBAVCNFSM6AAAAACTFF3V42VHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTMMZTGI4DOMI>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
|
Beta Was this translation helpful? Give feedback.
-
|
Hi @GMishx and mentors, I have started setting up SW360 locally and explored the codebase structure. Due to system constraints, the full Docker setup is taking time, but I am actively studying the backend modules and would like to start contributing. I am particularly interested in the "Customize Copy Project" idea. Could you please suggest beginner-friendly issues or areas to start contributing? Looking forward to contributing! Thanks, |
Beta Was this translation helpful? Give feedback.
-
|
Hi @GMishx, just wanted to let you know I've submitted my final GSoC proposal. PR #3915 has the full backend implementation — happy to address any review comments or questions before the deadline. Thanks for the feedback so far. The link : https://docs.google.com/document/d/1cLfGo4z-SagQF2sAX3CLD2I8y4oAnxhova-f5erGUN8/edit?tab=t.0 |
Beta Was this translation helpful? Give feedback.






Uh oh!
There was an error while loading. Please reload this page.
-
Hello all!
SW360 as an org is planning to apply for Google Summer of Code this year. In preparation to do so, we are creating this discussion to gather ideas for the GSoC-2026 projects.
Since 2022, there are some changes made by Google in the program. You can read more about it on their website. But as a summary,
Also, starting this year, 2026, Google has strong advice about the usage of Generative AI in the GSoC program. Please check them at:
Based on the suggestions from Google, SW360 has following guidelines for GSoC contributors:
Please feel free to drop any questions here (or start a new discussion) you have regarding the program, you want to submit a proposal idea, you want to be mentor in the program, etc.
While submitting a project idea, please tag it to be "Medium" or "Large" sized and who you'll prefer working on it "student" or "professional".
Some resources from Google:
You can also check the detailed documentation of previous students from FOSSology GSoC-2024.
Here is the list of the people who would be volunteering as mentors & org-admins for GSoC-2026.
Want to mentor this GSoC-2025 ? Please contact OrgAdmins.
Beta Was this translation helpful? Give feedback.
All reactions