TrustSource adds OpenSSF Scorecards

click here to enlarge image

In our component database, where we collect meta and clearing information on components, we added the Open Source Security Foundation (OpenSSF) Scorecard to help exploring the security status of open source projects. The score, introduced by the OpenSSF project of the Linux Foundation in 2020 and currently evaluated on regular basis for about 1 million open source projects on Github, is an aggregated value reflecting the security measures taken by the open source project. It can be used as an indication on how much you may trust the security efforts of a particular project without having evaluated it further.

What does the Scorecard tell?

The scorecard value or score is the result of sixteen checks reflecting secure software development best practises. They comprise the domains of development, testing, maintenance and vulnerabilities but also code and build management. Based on the a comprehensive set of best practises the tests scan the code repository for evidence, that the practises are actively supported by the project.

Currently 18 tests are available, 16 of which are available through the API. The detailed documentation can be found here. Each test will receive a score between 0 and 10, with 10 being the best possible score. The tests come with a result and and a risk as weight. The sum of all tests together with their weight derives the total score.

Some tests may sometimes not be applicable due to project design decisions, e.g. if the project does not supply packages through Github, the packaging test will not apply, since the current implementation does not yet provide a mechanism to verify the different package managers.

However, given you want to make a decision whether or not to use a particular component, running a scorecard test – or looking at the component in our database – will help you getting an impression on what effort you might need to invest in securing the component. The higher the score the more you may trust on the component.

What does the Scorecard NOT tell?

Please do not understand a high score as a guarantee for a secure component! Also a low score does not immediately relate to a weak or flawy component! There is no logic in assuming that a low score is an indication for a vulnerable component!

The score indicates which steps the project takes to ensure the code it provides follows best practises and therefor has a high likeliness of being free from errors and vulnerabilities. But it is no guarantee! If all is done fine, all tests boost to 10, there still might be the chance that a vulnerability occurs in an upstream component which is not simple or possible to fix for the project itself.

Use the score as an indicator but make the decision of whether to use a component or not based on its functionality not only on the score. You will – especially in these early days when the score is not yet widely adopted –

What comes next?

However, we highly recommend using scorecards because they give an indication of how strongly you may rely on your upstream components.

Since TrustSource knows all the components you apply inside your solution, it will now be possible to make more out of the single scores. A simple average will not make sense. Due to the amount of components an average score will have to be expected somewhere at a meaningless 5. But we are currently experimenting with quantiles or top 10 and low 10 averages as well as the relation of not scored components compared to scored ones.

In addition we will provide a service, that will allow you to check your own components by just providing a URL and transferring the scorecard to non github projects. Given we achieve some success, we will contribute our developments back to OpenSSF.

Questions? Stop searching further, just reach out and get answers!


TrustSource and SCANOSS will work closer in supporting Open Source Compliance

TrustSource und SCANOSS will work closer in supporting Open Source Compliance

In the run-up to the Open Source Summit Europe 2022, SCANOSS – provider of probably the largest database for open source information – and TrustSource – the automation solution for processes in the area of open chain security and compliance – have agreed to cooperate more closely in the future.

The OpenChain Tooling Workgroup has been developing the Open Source Compliance Capability Model over the last months. This model describes the different competences and skills required for a comprehensive handling of open source compliance. “SCANOSS has standardised >snippet scanning< with the first Open Source solution, which has been broadly adopted by Open Source communities like, e.g. OSS Review Toolkit”, reports Jan Thielscher, who is currently coordinating the workgroup. “This is exactly the area we (TrustSource) have been avoiding so far due to its complexity. Working closer with SCANOSS, we will be able to offer our customers access to their incredible information base. This helps to close the last white spot on our capability map by adding the snippet and export restrictions aspect.”

Currently, it is already possible to import scan results generated using the SCANOSS Workbench or SCANOSS CLI into TrustSource and thus follow up the findings in the compliance process managed by TrustSource. ScanOSS users are thus given the opportunity to not only have results available in the form of an audit result, but to integrate them into the regular context of a company-wide compliance management. TrustSource users will initially benefit from the ability to use the additional insights provided by SCANOSS. In the near future, the extended insights such as export controls, etc., which SCANOSS can provide, will also be available to manage or monitor compliance with in TrustSource.

“That will round things off,” says Jan Thielscher. “Of course, insufficient metadata, undeclared licences or unclear commit situations continue to pose challenges for OSPOs, but the majority of the tasks can already be automated thanks to the high level of integration and the many reports that are available due to the high level of integration. And that’s where the immense efficiency gain can be realised!”

Meet us at the Open Source Summit in Dublin @ B.19

Learn more about the Open Chain Tooling Workgroup Capability Model, TrustSource and how much process automation is already available in the area of open source compliance.


Free Vulnerability Lake Search - Better identify potentially vulnerable Components and other Tools

TrustSource Vulnerability Lake Search

Both software developers and security researchers are familiar with the challenge of assigning known vulnerabilities to open source components. Although the CPE (Common Platform Enumeration) codes provide a standardised scheme for associating vulnerabilities, the nomenclature was originally developed for vendor software and only fits poorly in the context of open source components, which often lack a clear “organisation”.

This leads to problems in finding and correctly assigning them. Sometimes the project name wins, e.g. “kubernetes:kubernetes“, other times it is the organising foundation, e.g. “apache:http“. Sometimes projects pass through different organisations over time, like the widely used Spring framework. Then information can be found under “pivotal_software:spring_framework” and from 2019 under “vmware:spring_framework“, which will cause a lot of irritation for years to come due to the concurrency of versions.
And, to top it off, there are even challenges with the project names themselves: “npmjs” or rather “npm_js” or “npmjs:npm”?

TrustSource Vulnerability Lake Search turns the tables: it provides search options to search in the existing CPEs and thus ensures to find the right keys to be considered.

With the help of TrustSource Vulnerability Alert I will catch all Known Vulnerabilities even while asleep!!

 

TrustSource Vulnerability Alert

With the help of the TrustSource Vulnerability Alert, you can always stay up to date. The identifiers found with the search described above can be subscribed to. Registered users – registration is free and easy, e.g. via a GitHub account – can add selected terms to a list. These lists are checked every few hours against updates from managed sources such as the NVD. If updates or new entries are found, the subscriber receives an email with a link to the new information.

TrustSource customers get this functionality automatically applied to all the bills of materials (SBOMs) in their solution(s). TrustSource-Scanners

determine the SBOMs while your application is being built and therefore know all the dependencies, including the transitive ones. In addition, you can also add infrastructure components to the project in TrustSource itself, and thus identify the vulnerable libraries that do not occur in your own source code.

Vulnerability alerts can be communicated either by email to the relevant project participants or to the system’s own inbox.   The latter is especially necessary to avoid failures due to absences or other filters of asynchronous communication.

To enable easy integration into surrounding systems, all these functions are also available via API. However, the use of the API is subject to a fee and is not part of the free plans.

In order to enable a quick classification of the criticality, TrustSource always shows the information on the attack vector as well as the criticality in CVSS values (Common Vulnerability Scoring System, find details on CVSS here) in addition to the description of the CVE or its assignment to the OS components.

TrustSource Life Cycle Alert

These capabilities result in yet another service that TrustSource makes available to its customers: The Life-Cycle Alert.

The obligation of a software manufacturer to inform its customers about known vulnerabilities does not end with the delivery of the software, it usually begins only then. This is even more true for equipment manufacturers. The less possibility there is to motivate the customer for timely updates, the more complex the situation becomes.

If, in the course of time _after_ the release of the software, known vulnerabilities emerge in the components used, it is up to the manufacturer to inform its customers in the sense of proper information provision. This obligation is already applied in the area of medical devices (MDR) and will certainly extend to other areas.

TrustSource makes it possible to record SBOMs that have been released and thus subject them to continuous monitoring. Every patch or release status that has been generated on a customer product can be tracked and alerted accordingly.

It sounds promising but you are not sure whether your specific demand will be met?

Or would you prefer to get hands-on experience in a free trial?


Free Open Source Compliance Training

For years, the same questions have arisen again and again in the context of open source:

  • Am I allowed to use open source in applications used for business purposes?
  • What are the consequences of using open source?
  • Is the GPL a “toxic” license?
  • What do the American licenses mean for us in Europe?

The irritation hits developers in particular, who are confronted with the use or deployment of open source in the front line. Now, computer scientists are rarely also lawyers, and even if law and computer science are similar in many aspects, it is not trivial to interpret a license without prior legal knowledge.
To help overcome this gap, we have provided a basic Open Source Compliance – Training. The training introduces the topic, briefly describes the background and gives insight into the essential aspects of licenses. More than 4 hours of video material, presentations and quizzes have been incorporated into the freely available, self-paced online training course.

In the course the participant gets an overview of:

  • The motivation and background of open source compliance,
  • The challenges that make open source compliance more than just making a list,
  • Solution concepts that help to anchor standard compliant open source compliance in an organization.

The presentations, held in English, are divided into small, short bites, so that they can be easily consumed in between online meetings or in short doses at the beginning of each day.
Direct access can be found here on the Trainings page.


EACG and OpenChain agree on partnership

Frankfurt, June, 8th 2018, EACG - the mother company of TrustSource - and the Linux Foundation agree on a partnership to co-operate in the OpenChain project.

EACG acts for several years now in the field of open source governance and compliance. Based on the experiences from some larger projects, EACG has developed TrustSource , the platform for automation of open source governance.  "We are close to having all of the stuff automated. Even the legal part!", summaritzes Jan the efforts over the last few years.

"Our platform delivers the technical part: scanning, mapping, documentation and reports. But Governance is much more, that a tool may do. To really ensure compliant software delivery and distribution also processes and culture need to change. This is where OpenChain comes in. The many, well thought and carefully designed requirements will lead towards the required change, if managed carefully. We support that and provide all required features to ensure OpenChain compliance. "

EACG offer consulting services in the area of open source compliance and governance as well as the solution platform TrustSource. there are different editions available according to your needs. To check it out and test it here.


June 19th, Compliance Breakfast @ Frankfurt a.M.

To achieve a fast Go-to-market for innovative products and services, the application of software, especially open source software is essential.

But, open source software is no free lunch!

What obligations are related to the use of open source software, what triggers the different obligations and what is resulting therefrom? What are athe risks and how to manage them? All this will be part of this informational event. You will receive an overview of the current legal situation as well as practical experiences of the introduction of Open Source Governnace.

0830-0900 Welcome coffee & tea

0900-0915 Introduction of speakers

0915-0945 Current legal situation and challenges (Heinzke)

0945-1000 Questions and discussion

1000-1045 Lessons learned from introducing Open Source Governance in a conglomerate (Thielscher)

1045-1100 Questions and discussion

Tickets can be booked here. To ensure a sound experience, the event is limited to 25 participants. Please note, the event will be in German.