https://OpenChain-Project.github.io/OpenChain-KWG/en/tags/trusca/Recent content in TRUSCA on OpenChain KWGHugoenhttps://OpenChain-Project.github.io/OpenChain-KWG/en/guide/tools/11-trusca/Mon, 01 Jan 0001 00:00:00 +0000https://OpenChain-Project.github.io/OpenChain-KWG/en/guide/tools/11-trusca/<p>Managing the vulnerabilities and licenses of open source components calls for an SCA (Software Composition Analysis) tool. Several commercial products exist, but some organizations look for an open source tool they can install and run on their own infrastructure.</p> <p>TRUSCA is a self-hosted SCA portal published for that purpose. Released under Apache 2.0, it brings vulnerabilities (CVE), license compliance, and SBOM management into a single screen. It is developed by <a href="https://OpenChain-Project.github.io/OpenChain-KWG/en/guide/trustedoss/">TrustedOSS</a>, a project that grew out of KWG community work.</p>https://OpenChain-Project.github.io/OpenChain-KWG/en/guide/trustedoss/Mon, 01 Jan 0001 00:00:00 +0000https://OpenChain-Project.github.io/OpenChain-KWG/en/guide/trustedoss/<div class="pageinfo pageinfo-primary"> <p>TrustedOSS grew out of KWG community work and was published by the author of this guide. Its documentation is released under CC BY 4.0 and its code under MIT and Apache 2.0.</p> <p><strong>Site: <a href="https://trustedoss.github.io/en/">https://trustedoss.github.io/en/</a></strong></p> </div> <p>TrustedOSS covers four areas.</p> <h2 id="generating-self-certification-deliverables">Generating self-certification deliverables</h2> <p>It produces the documents required for ISO/IEC 5230 and ISO/IEC 18974 self-certification through a conversation with an AI agent: organizational setup, policy, processes, SBOM analysis, vulnerability reports, training curricula, and a draft conformance statement. It follows the same six steps described in the <a href="https://OpenChain-Project.github.io/OpenChain-KWG/en/guide/opensource_for_enterprise/">open source management guide</a>.</p>