{"id":30714643,"url":"https://github.com/guacsec/trustify","last_synced_at":"2025-10-06T01:34:29.318Z","repository":{"id":233622026,"uuid":"767030962","full_name":"guacsec/trustify","owner":"guacsec","description":"Bringing together SBOMs and advisories.","archived":false,"fork":false,"pushed_at":"2025-09-25T16:03:15.000Z","size":49409,"stargazers_count":32,"open_issues_count":118,"forks_count":27,"subscribers_count":14,"default_branch":"main","last_synced_at":"2025-09-25T18:06:14.610Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://trustification.io/","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/guacsec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2024-03-04T15:24:52.000Z","updated_at":"2025-09-25T15:43:59.000Z","dependencies_parsed_at":"2025-06-03T15:32:26.480Z","dependency_job_id":"83bc8a87-fc25-4f56-bfc1-afb7c9eab536","html_url":"https://github.com/guacsec/trustify","commit_stats":null,"previous_names":["trustification/trustify","guacsec/trustify"],"tags_count":60,"template":false,"template_full_name":null,"purl":"pkg:github/guacsec/trustify","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/guacsec%2Ftrustify","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/guacsec%2Ftrustify/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/guacsec%2Ftrustify/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/guacsec%2Ftrustify/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/guacsec","download_url":"https://codeload.github.com/guacsec/trustify/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/guacsec%2Ftrustify/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278547775,"owners_count":26004772,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-05T02:00:06.059Z","response_time":54,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-09-03T05:12:48.927Z","updated_at":"2025-10-06T01:34:29.311Z","avatar_url":"https://github.com/guacsec.png","language":"Rust","funding_links":[],"categories":["Rust","Dependency intelligence"],"sub_categories":["SCA and SBOM"],"readme":"# Trustify\n\n[![ci](https://github.com/guacsec/trustify/actions/workflows/ci.yaml/badge.svg)](https://github.com/guacsec/trustify/actions/workflows/ci.yaml)\n\nTrustify provides a single, searchable abstraction over all cyclonedx/spdx SBOMs - cross referencing against public security advisories to help identify and respond to software security threats \u0026 vulnerabilities.\n\n## How Trustify Helps\nTrustify tackles some of the problems developers and companies face when keeping software safe and organized. Here’s how it helps:\n- Deploy applications with fewer vulnerabilities\n- Meet compliance regulations for SBOM management and archiving\n- Know that trusted components are in use as early as possible\n- Reduce alert fatigue with fewer false positive by getting vendor vulnerability information from the actual vendor (VEX)\n- Analyze applications without downloading and installing\n\n## Architecture\nTrustify is an evolution of the [Trustification](https://github.com/trustification) project.\nWe changed the architecture to [modulith](https://dzone.com/articles/architecture-style-modulith-vs-microservices) approach, to build a simpler-to-deploy more responsive system that can flexibly meet the needs of the company and our customers going forward.\n\nThe general architecture is as follows:\n\n### The System\n- REST APIs to support operations for ingesting and retrieving supply-chain data.\n- Comes with a set of default importers to public available vulnerability data\n\n### A single SQL database\n- PostgreSQL.\n- Extensible data-model to support all aspects of supply-chain data.\n- OIDC provider\n\n![image](https://github.com/user-attachments/assets/f251c0ef-9693-485c-9ebd-8deefe2c244c)\n\n## Quick start\n\nLet's call this \"PM mode\":\n\n```shell\nAUTH_DISABLED=true cargo run --bin trustd\n```\n\nIf you haven't setup your Rust development environment yet, i.e. you\ndon't have `cargo`, you can alternatively use the latest \"trustd-pm\"\n[release binary](https://github.com/guacsec/trustify/releases).\n\nThat will create its own database in your current directory beneath\n`.trustify/`.\n\n* To use the **GUI**, navigate to: \u003chttp://localhost:8080\u003e.\n* To use the **REST API**, navigate to: \u003chttp://localhost:8080/openapi/\u003e.\n\n### Data\n\nThe app's not much fun without data, e.g. SBOM's and Advisories. There are a few ways to ingest some:\n\n#### Datasets\n\nThere are some bundles of related data beneath\n[etc/datasets](etc/datasets). You can use any HTTP command line\nclient, e.g. curl, wget, or [httpie](https://httpie.io/) to ingest a\nzipped archive of SBOMs and/or Advisories like so:\n\n```shell\ncd etc/datasets\nmake\nhttp POST localhost:8080/api/v2/dataset @ds1.zip\n```\n\n#### Upload\n\nThere is an \"Upload\" menu option in the GUI: http://localhost:8080/upload\n\nYou can also interact with the API directly in a shell:\n\n```shell\ncat some-sbom.json | http POST localhost:8080/api/v2/sbom\ncat some-advisory.json | http POST localhost:8080/api/v2/advisory\n```\n\n#### Importers\n\nYou may configure importers to regularly fetch data from remote\nsites. See [modules/importer/README.md](modules/importer/README.md)\nfor details.\n\n### Authentication\n\nWhen testing the app using \"PM mode\", it may be convenient to set an\nenvironment variable, `AUTH_DISABLED=true`, to bypass all auth checks.\n\nBy default, authentication is enabled. It can be disabled using the\nflag `--auth-disabled` when running the server.  Also. by default,\nthere is no working authentication/authorization configuration. For\ndevelopment purposes, one can use `--devmode` to use the Keycloak\ninstance deployed with the compose deployment.\n\nAlso see: [docs/oidc.md](docs/oidc.md)\n\nHTTP requests must provide the bearer token using the `Authorization`\nheader. For that, a valid access token is required. There are\ntutorials using `curl` on getting such a token. It is also possible\nthe use the `oidc` client tool:\n\nInstallation:\n\n```bash\ncargo install oidc-cli\n```\n\nThen, set up an initial client (needs to be done every time the client/keycloak instance is re-created):\n\n```bash\noidc create confidential trusty --issuer http://localhost:8090/realms/chicken --client-id walker --client-secret ZVzq9AMOVUdMY1lSohpx1jI3aW56QDPS\n```\n\nThen one can perform `http` request using HTTPie like this:\n\n```bash\nhttp localhost:8080/purl/asdf/dependencies Authorization:$(oidc token trusty -b)\n```\n\n## Repository Organization\n\n### Sources\n\n#### `common`\n\nModel-like bits shared between multiple contexts.\n\n#### `entity`\n\nDatabase entity models, implemented via SeaORM.\n\n#### `migration`\n\nSeaORM migrations for the DDL.\n\n#### `modules`\n\nThe primary behavior of the application.\n\n#### `server`\n\nThe REST API server.\n\n#### `trustd`\n\nThe server CLI tool `trustd`\n\n### Et Merde\n\n#### `etc/test-data`\n\nArbitrary test-data used for unit tests\n\n#### `etc/datasets`\n\nIntegrated data bundles that show off the features of the app.\n\n#### `etc/deploy`\n\nDeployment-related (such as `compose`) files.\n\n## Development Environment\n\n### Rust\n\nIf you haven't already, [get started!](https://www.rust-lang.org/learn/get-started)\n\n#### If test failures on OSX\n\nPotentially, our concurrent Postgres installations during testing can\nexhaust shared-memory.  Adjusting shared-memory on OSX is not\nstraight-forward.  Use [this\nguide](https://unix.stackexchange.com/questions/689295/values-from-sysctl-a-dont-match-etc-sysctl-conf-even-after-restart).\n\n### Postgres\n\nUnit tests and \"PM mode\" use an embedded instance of Postgres that is\ninstalled as required on the local filesystem. This is convenient for\nlocal development, but you can also configure the app to use an\nexternal database.\n\nStarting a containerized Postgres instance:\n\n```shell\npodman-compose -f etc/deploy/compose/compose.yaml up\n```\n\nConnect to PSQL:\n\n```shell\nenv PGPASSWORD=trustify psql -U postgres -d trustify -h localhost -p 5432\n```\n\nIf you don't have the `psql` command available, you can also use the `podman-compose` command:\n\n```shell\npodman-compose -f etc/deploy/compose/compose.yaml exec postgres psql -U postgres -d trustify\n```\n\nPoint the app at an external db:\n\n```shell\ncargo run --bin trustd api --help\nRUST_LOG=info cargo run --bin trustd api --db-password trustify --devmode --auth-disabled\n```\n\n## Notes on models\n\n### Package\n\nA package exists or it does not. Represented by a pURL. No source-tracking required.\n\nRework to Package. VersionedPackage. QualifiedVersionedPackage. and VersionRangePackage for vulnerable references.\nPlus appropriate junction tables.\n\n### CPE\n\nPlatonic form of a product may have 0+ CPEs/pURLs.\nPlatonic form of a product may have 0+ known hashable artifacts.\n\n### CVE\n\nA CVE exists or it does not. Represented by an identifier. No source-tracking required.\n\n### CWE\n\nA CWE exists or it does not. Represented by an identifier. No source-tracking required.\n\n### Advisory\n\nAn Advisory exists or it does not. Represented by a location/hash/identifier.\nSource tracked from an Advisory Source.\n\nThere is probably always an advisory from NVD for every CVE.\n\n### Advisory Source\n\nSomething like GHSA, Red Hat VEX, etc. Maybe?\nBased on source URL? Regexp!\nStill unsure here.\n\n### Scanners don't exist\n\nThey should just point us towards first order advisories to ingest.\nOSV just tells us to look elsewhere.\nThey are helpers not nouns.\n\n### Vulnerable\n\nPackage Range + Advisory + CVE.\n\n### NonVulnerable\n\nQualifiedPackage + Advisory + CVE.\n\nBoth impl'd for pURL and CPE.\n\n### SBOM\n\nhashed document that claims things about stuff.\nAll package/product relationships exist only within the context of an SBOM making the claim.\n\n### Describes\n\nCPE (Product?) and/or pURLs described by the SBOM\n\n## Related Projects\n\n* [Trustify user interface](https://github.com/guacsec/trustify-ui)\n* [Helm charts used for the Trustify deployment](https://github.com/guacsec/trustify-helm-charts)\n* [Trustify scale tests runner](https://github.com/guacsec/trustify-load-test-runs)\n* [Trustify scale test suite](https://github.com/guacsec/scale-testing)\n* [Trustify release tools](https://github.com/guacsec/trustify-release-tools)\n* [Trustify MCP server](https://github.com/guacsec/trustify-mcp)\n\n## Related links\n\n* [Trustify scale test results](https://guacsec.github.io/trustify-scale-test-runs/)\n* [Trustify benchmark results](https://guacsec.github.io/trustify/dev/bench/)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fguacsec%2Ftrustify","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fguacsec%2Ftrustify","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fguacsec%2Ftrustify/lists"}