TRUSCA

What it does

CI integrations

The project documents a GitHub Action, GitLab CI template, Jenkinsfile example, REST API, and API keys; its build gate can fail on a Critical CVE or forbidden license.checked 3 Oct 2001

Component detection

It uses cdxgen to detect packages across 30+ language ecosystems.checked 3 Oct 2001

Deployment

TRUSCA is distributed for users to run themselves with Docker Compose or a Helm chart; a read-only live demo is also available.checked 3 Oct 2001

Intended users

The project describes the portal as serving engineering, legal, and security teams.checked 3 Oct 2001

Language support

The UI, error messages, and documentation are available in English and Korean.checked 3 Oct 2001

License workflow

Licenses are classified as allowed, conditional, or forbidden, with NOTICE file generation and build blocking for forbidden licenses.checked 3 Oct 2001

Not a SAST scanner

The documentation says TRUSCA does not analyze users’ own source code and focuses on third-party components.checked 3 Oct 2001

Notifications and audit

Workflow features include component approval, an append-only audit log, and notifications via email, Slack, and Teams.checked 3 Oct 2001

Purpose

TRUSCA is a self-hosted software composition analysis platform for CVE tracking, license compliance, and SBOM management.checked 3 Oct 2001

SBOM

TRUSCA exports CycloneDX in JSON or XML and SPDX in JSON or Tag-Value, and can ingest CycloneDX or SPDX SBOMs.checked 3 Oct 2001

Security triage

TRUSCA provides a seven-state CycloneDX VEX triage workflow and EPSS prioritization.checked 3 Oct 2001

Support

The project says it has no paid support tier or managed hosting and directs users to its community support channels.checked 3 Oct 2001

Vulnerability feeds

Trivy matches components against NVD, OSV, GitHub Advisory, EPSS, and KEV data, with new CVEs picked up on weekly database refreshes.checked 3 Oct 2001