Software composition analysis tool

Veikkaus is about to purchase an SCA tool (Software composition analysis) for automated analysis of the use of open source components in Veikkaus' proprietary software. The tool itself must be provided as a SaaS service.

Veikkaus is acquiring an SCA tool to analyze Veikkaus' proprietary code and binary images to track the use of open source libraries at Veikkaus. In short, Veikkaus aims for a tool that is capable for providing automatically • A software bill of materials (SBOM) • Vulnerability information of the open source packages • Licensing information of the open source packages of scanned source code and binary images. The comprehensive list of requirements can be seen in the annex 2 SCA requirements.xslx. The tool itself must be provided as a SaaS service. The procurement contains the following parts • All pieces of software required to run the application (including any possible plugins or extensions to other pieces of software) • Supporting services and updates to the extent of the whole contract period • Supporting services during the introduction of the software • Training and sharing best practices of using the software. Veikkaus holds the right to expand the use of the software from the extent described in Annex 1 - Service description.