Pre-Build OSS Compliance: Automated Dependency, License, and CVE Detection

Open-source software (OSS) is a critical component of modern software development, demanding robust compliance mechanisms for dependency management, license, and vulnerability detection. This paper presents an automated framework that enhances Software Composition Analysis at the pre-build stage by tracking transitive dependencies, improving license compliance by identifying licenses in files, and enhancing Common Vulnerability and Exposure (CVE) detection by integrating multiple data sources. The proposed method automates dependency identification for Python, Java, and Go, leveraging a multi-database approach to improve vulnerability detection accuracy. The framework's effectiveness is evaluated against Dependabot using its Security Alerts and SBOM export function. The study examines the most-starred GitHub projects with security alerts for each programming language. Given that no single CVE database is exhaustive, Precision, Recall, and F1-score are computed in the absence of ground truth using a probabilistic approach to assess detection performance. The findings highlight the importance of aggregating multiple vulnerability sources for comprehensive security coverage and adopting advanced license scanning techniques for improved compliance management. Despite challenges such as external data source rate limits, the proposed method provides a more effective solution for OSS compliance at the pre-build stage.