onot 1.2.0

onot generates open source software notices (OSS Notice) from SBOM documents. It reads SPDX 2.x (JSON/YAML/Tag-Value/RDF), CycloneDX (JSON/XML), and Excel, and produces HTML, Text, Markdown, and PDF notices. License texts are bundled, so it runs fully offline (air-gapped), so your SBOM never leaves the machine. Jointly developed by Kakao and SK telecom.

User guide: English

Download (desktop app)

No setup required. Grab the latest installer from Releases, open the app, and drop in an SBOM file to preview and save a notice.

Releases cover Windows and macOS. Linux is not published, but pnpm -C electron run dist on a Linux machine builds an AppImage from the same configuration.

The installers are unsigned, so each system asks you to confirm the first launch. On Windows, SmartScreen may warn about an "unknown publisher": choose More info then Run anyway. On macOS, right-click the app and choose Open to pass Gatekeeper.

The desktop app is self-contained: it bundles everything it needs, so you do not need Python or pip. The sections below (CLI, API, source build) are for developers and automation only.

Accessibility

The app is usable from the keyboard throughout, with a visible focus indicator on every control. Colours meet the WCAG 2.2 AA contrast bar in both themes, which an axe-core check enforces against the running app on every CI run. It ships light and dark themes and follows the system setting by default, and it honours prefers-reduced-motion. Screen reader support rests on the semantics of standard controls; it has not been tested with VoiceOver or NVDA, so reports are welcome.

CLI

pip install "onot[spdx,cyclonedx,excel,api]"   # from PyPI; add ,pdf for PDF output

# SBOM (format auto-detected) → notices in multiple formats
onot generate -i sbom.spdx.json -f html -f markdown --output-dir ./output

#   -f/--format   html | text | markdown | pdf (repeatable)
#   --lang        en (the only language at present)
#   --config      onot.yaml (company info, etc.)
#   --online      fetch missing license texts remotely (offline by default)
#   --stdout      write a single text format to stdout
#   -q/--quiet    suppress warnings
#   --json        report the written files and warnings as JSON

onot init        # a commented onot.yaml to start from
onot formats     # supported output formats
onot --version   # or: onot version

Warnings go to stderr, each on its own line, followed by a count by kind. A large SBOM can produce hundreds, so --quiet drops them and --json puts the same information on stdout for a caller that has to act on it:

{
  "product": "example-product",
  "written": [{ "format": "html", "path": "output/OSS_Notice_example-product_20260101_120000.html" }],
  "warnings": ["no license information for foo 1.2.3"]
}

Input format is auto-detected by extension and content (including SPDX JSON vs. CycloneDX JSON). PDF output needs pip install ".[pdf]" (WeasyPrint); the desktop app uses a built-in converter.

onot generate --help lists every option with examples. Exit codes, for scripting:

Local API (sidecar)

onot-sidecar --port 8765
# POST /api/parse    upload → parse result
# POST /api/render   upload + format/lang/company → notice
# GET  /api/formats, GET /healthz

Desktop app (Electron)

pnpm -C frontend install && pnpm -C frontend build
pnpm -C electron install && pnpm -C electron start   # dev
pnpm -C electron run dist                            # package (.dmg/.exe/.AppImage)

Upload → preview → download. All processing is local; the SBOM never leaves the machine.

Development

bash scripts/gate.sh   # lint + pytest (cov ≥ 90) + frontend build/test + electron sidecar test

Refresh license data with python scripts/update_license_data.py (bundles SPDX license-list-data). Design and decision records live in docs/2.0/ (TRACEABILITY.md, DECISIONS.md).

Contributing

Contributions are welcome! See CONTRIBUTING.md for how to set up your environment, run the checks, and open a pull request. Please also read our Code of Conduct. To report a security vulnerability, follow SECURITY.md instead of opening a public issue.

Maintainers

License

Apache-2.0