- Home
- SBOM Management Software
- TRUSCA
TRUSCA
What it is
TRUSCA is a self-hosted software composition analysis platform for tracking vulnerabilities, reviewing licenses, and managing software bills of materials. It uses cdxgen to identify packages across more than 30 language ecosystems, while Trivy checks components against NVD, OSV, GitHub Advisory, EPSS, and KEV data. New CVEs are included through weekly database refreshes. TRUSCA can import CycloneDX or SPDX SBOMs and export CycloneDX in JSON or XML, plus SPDX in JSON or Tag-Value. CI options include a GitHub Action, GitLab CI template, Jenkinsfile example, REST API, and API keys. Build gates can fail for a Critical CVE or forbidden license. License workflows classify licenses as allowed, conditional, or forbidden, generate NOTICE files, and can block forbidden licenses. Teams can approve components, keep an append-only audit log, and receive email, Slack, or Teams notifications. A seven-state CycloneDX VEX workflow and EPSS prioritization support security triage. TRUSCA focuses on third-party components and does not analyze users’ own source code. Users deploy it themselves with Docker Compose or a Helm chart; a read-only live demo is available. The project has no paid support tier or managed hosting.
For and against
For
- Free Apache-2.0 self-hosted deployment
- Imports and exports CycloneDX and SPDX
- CI build gates for vulnerabilities and licenses
- Email, Slack, and Teams notifications
Against
- Does not analyze users’ own source code
- No paid support tier or managed hosting
- Users must deploy it themselves
The verdict
TRUSCA combines component discovery, vulnerability checks, license controls, and SBOM exchange in a self-managed platform. Teams looking for managed hosting, paid support, or analysis of their own source code will need a different fit.
Who it suits
TRUSCA is intended for engineering, legal, and security teams that need self-hosted component vulnerability, license, and SBOM workflows. It is not a source-code analysis tool for a team’s own code.
Plans and prices
Apache-2.0 self-hosted
No per-seat licensing · self-hosted deployment
Read 3 Oct 2026 · trustedoss.github.io
On the record
- CI integrations
- The project documents a GitHub Action, GitLab CI template, Jenkinsfile example, REST API, and API keys; its build gate can fail on a Critical CVE or forbidden license.trustedoss.github.io · read 3 Oct 2026
- Component detection
- It uses cdxgen to detect packages across 30+ language ecosystems.trustedoss.github.io · read 3 Oct 2026
- Deployment
- TRUSCA is distributed for users to run themselves with Docker Compose or a Helm chart; a read-only live demo is also available.trustedoss.github.io · read 3 Oct 2026
- Intended users
- The project describes the portal as serving engineering, legal, and security teams.trustedoss.github.io · read 3 Oct 2026
- Language support
- The UI, error messages, and documentation are available in English and Korean.trustedoss.github.io · read 3 Oct 2026
- License workflow
- Licenses are classified as allowed, conditional, or forbidden, with NOTICE file generation and build blocking for forbidden licenses.trustedoss.github.io · read 3 Oct 2026
- Not a SAST scanner
- The documentation says TRUSCA does not analyze users’ own source code and focuses on third-party components.trustedoss.github.io · read 3 Oct 2026
- Notifications and audit
- Workflow features include component approval, an append-only audit log, and notifications via email, Slack, and Teams.trustedoss.github.io · read 3 Oct 2026
- Purpose
- TRUSCA is a self-hosted software composition analysis platform for CVE tracking, license compliance, and SBOM management.trustedoss.github.io · read 3 Oct 2026
- SBOM
- TRUSCA exports CycloneDX in JSON or XML and SPDX in JSON or Tag-Value, and can ingest CycloneDX or SPDX SBOMs.trustedoss.github.io · read 3 Oct 2026
- Security triage
- TRUSCA provides a seven-state CycloneDX VEX triage workflow and EPSS prioritization.trustedoss.github.io · read 3 Oct 2026
- Support
- The project says it has no paid support tier or managed hosting and directs users to its community support channels.github.com · read 3 Oct 2026
- Vulnerability feeds
- Trivy matches components against NVD, OSV, GitHub Advisory, EPSS, and KEV data, with new CVEs picked up on weekly database refreshes.trustedoss.github.io · read 3 Oct 2026
