Capabilities in comparison

TrustSource @ FOSDEM 2021

TrustSource @ FOSDEM 2021

wir freuen uns auf die Vorträge von @Jan Thielscher & @Grigory Markin auf der FOSDEM 2021.

Open Source Compliance Tooling – Capability Reference Architecture

Jan wird im OpenChain Dev-Room das Referenzmodell der Open Source Tooling Workgroup vorstellen, welches die fachlichen Capabilities und ihre Zusammenhänge darlegt. Das Modell ist in den letzten zwei Jahren von Mitgliedern der Arbeitsgruppe erstellt worden und soll eine Übersicht der erforderlichen Aufgaben geben, die im Kontext einer Open Source Compliance erforderlich werden. Es eignet sich auch, um die unterschiedlichen Werkzeuge abzubilden oder sich klar zu machen, welche Funktionalität sie abdecken.

Jan wird den Talk auch benutzen, um die Anbieter der Werkzeuge zu motivieren, Ihre Werkzeuge gegen das Modell zu mappen.

Capabilities in comparison

In einem zweiten Talk wird Grigory Markin im Dev-Room Software Composition das Open Source Werkzeug TrustSource DeepScan sowie den gleichnamigen, freien online Service DeepScan vorstellen. Die Lösung kann eingesetzt werden, um die erforderlichen Informationen (Copyright & Lizenzen) zu bestimmen, welche für eine rechtlich konforme Nutzung erforderlich sein können:

TrustSource DeepScan – How to effectively excavate effective licenses

In diesem 15 minütigen Talk werden Grigory und Jan kurz die Herausforderung der „effective“ Lizenzen anreißen und auf die unterschiedlichen, technischen Möglichkeiten und Herausforderungen der automatisierten Lizenzanalyse u.a. mit Hilfe der Similarity-Analyse eingehen. Abschließend werden kurz das Werkzeug, der gegenwärtige Arbeitsstand und die nächsten Schritte dargestellt.

Sie haben an dem 6./7. Februar keine Zeit, würden aber gerne mehr erfahren?

TrustSource v1.9 released!

We are happy to announce our latest release of TrustSource, version 1.9 to arrive Sept. 10th 2019!

With our v1.8 we have introduced a more detailed versioning schema allowing a closer matching between the code repos and the scan results by introducing support for branch and tag. In this release on of the major updates is the new approval, which allows to specify a combination of versions which shall be taken for an approval. But besides this, there is even more:

New Features:

  • Improved Approval Process:
    The new approval will be started as the former version. But a wizard will guide you through the steps. You will be able to give the approval a particular name, select the modules and analysis versions to apply. When you are confident with your selection and issue the approval request, TrustSource will generate all relevant documentations (Notice File, if required a SOUP file – see below – and  a new compliance report) and process the request towards the compliance manager(s).
    They will find the information in their inbox and can immediately dive into the new compliance report.
  • Compliance Report:
    The new compliance report will give a comprehensive summary of the project situation including legal and vulnerability status. Also it will the required documentation and unveil the degree of completion. Also the report will outline the changes in component status a project manager has made will be shown. Thus manual status changes will become immediately visible, comments on vulnerabilities having been muted will be available for review and more….
  • DeepScan:
    How often do you rely on the declared license? How many of us really dig deep to ensure that there is no little snippet of code containing another license? I probably better do not want to know. However, we proudly present DeepScan. This new service allows you to specify the URL of a component repository, which DeepScan then will assess for you in the background. It will search for all sort of data providing a relation to a license specification and present the findings to you. Give it a try! You might be surprised…
  • Support for Medical Device Directive Documentation:
    In 2020 the European Medical Device Directive will force developers of software related to medical devices to clearly outline all third party software and track these changes and require these to register each change (UDI-ID). We prepare to support this procedure and already offer automatically generated SOUP-lists as well ass COTS-component management. Further steps to follow, sty tuned with our newsletter.


  • Improved sorting and selections from lists
  • Multi-license cases will be marked as warning as long as no decision about the license to use has been made, even if both licenses would result in no obligations. Thus all required decisions will be easy to identify.
  • We were able to identify some inputs from scanners being misinterpreted, e.g. „>=“-version conditions, resulting in difficulties with the correct version matching. These cases will be properly resolved now.