Germany – Research and development services and related consultancy services – Project "ScanCode"

The contract concerns the project ScanCode which covers the performance, accuracy, security and long term resilience of the tool that identifies the components, licenses, copyright holders and dependencies inside software. As part of four work packages, the contract covers research into faster scanning through the reuse of earlier testresults, a redesigned architecture for collecting package information and a prototype port to a faster programming language; the development of more precise license detection, a public license database, and detection of additional package ecosystems and of repositories that hold many packages; the remediation of findings from an independent security audit together with scheduled security analysis of the project's own code; and the design of contribution rules, an AI policy, a shared model for ScanCode's output and a plan for sharing scan data across organisations. The aim of this service is to give public administrations, manufacturers and open source projects accurate, verifiable and secure knowledge of what their software contains, so they can respect license terms, respond to disclosed vulnerabilities and produce the component inventories the Cyber Resilience Act requires.