TrustSource @ LSEC on SBOMs

Let’s meet at the IIOT SBOM Nov. 10th!

Thank you @           LSEC – Leaders In Security           for inviting us to talk about #SBOM #DevSecOps and the upcoming challenges form the security point of view. @Jan will address the challenges around generating SBOMs, how to tackle it on the automation side in his talk “Getting the SBOM right, and then?”. Further on the talk will address thoughts on the life cycle perspective, what comes after the SBOMs creation. It also will also report about the work the #LinuxFoundation #OpenChain Automation work group is performing as well as invite to a new sort of SBOM user group, outlining best practises on defining SBOMs.
Looking forward having great conversations and learn even more about the challenges you are facing while creating SBOMs in the IIOT world.

C U there!


(22.11.22) Thank you very much for the kind hosting and the gerat exchange to all other speakers and participants at the IIOT SBOM. It has been great to learn about your demands and thoughts. Looking forward talking to you further. All speeches have been recorded and are avialble at the IIOT SBOM website. Jan’s talk we linked here.

It is split into two sections due to coordination with some speakers from different time zones. However, the first part addresses the SBOM and its contents. What should go in, what is a suitable format and what are the benefits of producing SBOMs (besides compliance with regulatory requirements). The second part addresses SBOM creation automation, transfer a few experiences from the legal SBOM design and spins a few thoughts on what you may do with SBOMs whilst they are around.

TrustSource and SCANOSS will work closer in supporting Open Source Compliance

TrustSource und SCANOSS will work closer in supporting Open Source Compliance

In the run-up to the Open Source Summit Europe 2022, SCANOSS – provider of probably the largest database for open source information – and TrustSource – the automation solution for processes in the area of open chain security and compliance – have agreed to cooperate more closely in the future.

The OpenChain Tooling Workgroup has been developing the Open Source Compliance Capability Model over the last months. This model describes the different competences and skills required for a comprehensive handling of open source compliance. “SCANOSS has standardised >snippet scanning< with the first Open Source solution, which has been broadly adopted by Open Source communities like, e.g. OSS Review Toolkit”, reports Jan Thielscher, who is currently coordinating the workgroup. “This is exactly the area we (TrustSource) have been avoiding so far due to its complexity. Working closer with SCANOSS, we will be able to offer our customers access to their incredible information base. This helps to close the last white spot on our capability map by adding the snippet and export restrictions aspect.”

Currently, it is already possible to import scan results generated using the SCANOSS Workbench or SCANOSS CLI into TrustSource and thus follow up the findings in the compliance process managed by TrustSource. ScanOSS users are thus given the opportunity to not only have results available in the form of an audit result, but to integrate them into the regular context of a company-wide compliance management. TrustSource users will initially benefit from the ability to use the additional insights provided by SCANOSS. In the near future, the extended insights such as export controls, etc., which SCANOSS can provide, will also be available to manage or monitor compliance with in TrustSource.

“That will round things off,” says Jan Thielscher. “Of course, insufficient metadata, undeclared licences or unclear commit situations continue to pose challenges for OSPOs, but the majority of the tasks can already be automated thanks to the high level of integration and the many reports that are available due to the high level of integration. And that’s where the immense efficiency gain can be realised!”

Meet us at the Open Source Summit in Dublin @ B.19

Learn more about the Open Chain Tooling Workgroup Capability Model, TrustSource and how much process automation is already available in the area of open source compliance.

TrustSource @ FOSDEM 2021

TrustSource @ FOSDEM 2021

we are looking forward to the presentations of @Jan Thielscher & @Grigory Markin at FOSDEM 2021.

Open Source Compliance Tooling – Capability Reference Architecture

Jan will present the Open Source Tooling Workgroup‘s reference model in the OpenChain Dev-Room , which outlines domain-specific capabilities and their interrelationships. The model has been created over the last two years by members of the workgroup and is intended to provide an overview of the required tasks that will be needed in the context of open source compliance. It is also useful for mapping the different tools or being clear about what functionality they cover. See the complete video here.

During the talk Jan will also try to motivate tool vendors to map their tools against the model.

Capabilities in comparison

In a second talk, Grigory Markin will present the TrustSource DeepScan open source tool and the free online service DeepScan of the same name in the Dev-Room Software Composition. This solution has been developed to support open source users in identifying the effective licenses and attribution information (license & copyright) :

TrustSource DeepScan – How to effectively excavate effective licenses

In this 15 minute talk, Grigory and Jan will briefly outline the challenge of “effective” licenses and discuss the various technical possibilities and challenges of automated license analysis using similarity analysis, among other things. Finally, the tool, the current state of work and the next steps will be briefly presented.

Want to learn more about SBOMs or OpenSSF? Feel free contacting us!

June 19th, Compliance Breakfast @ Frankfurt a.M.

To achieve a fast Go-to-market for innovative products and services, the application of software, especially open source software is essential.

But, open source software is no free lunch!

What obligations are related to the use of open source software, what triggers the different obligations and what is resulting therefrom? What are athe risks and how to manage them? All this will be part of this informational event. You will receive an overview of the current legal situation as well as practical experiences of the introduction of Open Source Governnace.

0830-0900 Welcome coffee & tea

0900-0915 Introduction of speakers

0915-0945 Current legal situation and challenges (Heinzke)

0945-1000 Questions and discussion

1000-1045 Lessons learned from introducing Open Source Governance in a conglomerate (Thielscher)

1045-1100 Questions and discussion

Tickets can be booked here. To ensure a sound experience, the event is limited to 25 participants. Please note, the event will be in German.