DOCSEARCHbyAlgolia
Submit Docs

Trusted OSS Full Guide

website·Indexed 29 days ago

https://trustedoss.github.io

Documentation for Trusted OSS, covering the building of management systems, AI coding, and tools to turn scan results into reports and fixes.

Tokens
468
Snippets
1
Records
4
Agent score
25%

What's inside Trusted OSS

  1. Overview of Trusted OSS Management System components

    Building a Trusted OSS management system involves several key organizational and technical pillars: software supply chain security, environment setup, establishing an Open Source Program Office (OSPO), defining open source policies, process design, implementing tools for SBOM generation and vulnerability analysis, training, and achieving self-certification for ISO/IEC 5230 and 18974 conformance.

  2. Implement DevSecOps for open source security

    A comprehensive DevSecOps pipeline for Trusted OSS includes the following tool categories and specific tools:

    • SAST (Static Analysis): Semgrep, CodeQL
    • SCA (SBOM & Vulnerability): syft, grype
    • Secret Detection: Gitleaks, truffleHog
    • Container Security: Trivy
    • IaC Security: Checkov, tfsec
    • DAST (Dynamic Analysis): OWASP ZAP, Nuclei
    • Monitoring/Remediation: Dependabot, Renovate
    • Integration: GitHub Actions and GitLab CI
    • Compliance: Mapping to ISO/IEC 18974 requirements.

  3. Run Trusted OSS Agents for automation

    Trusted OSS agents require cloning the repository. They read from templates/ (or templates/en/ for English) and write results to output/.

    Available agents include:

    • ai-coding-setup and devsecops-setup: Generate configurations for existing projects.
    • sbom-vuln-analyst, sast-analyst, secret-analyst, and iac-fixer: Convert security scan results into actionable reports and fixes.
    • Self-study chain (02 to 07): Guides the process from organization design to self-certification declaration.

  4. Configure AI coding tools for open source policy compliance

    To prevent AI coding tools from breaking open source policies, a five-level strategy is employed: prompt-dependent, rules embedded, CI/CD blocking, AI review, and automatic remediation. Specific configuration files are used depending on the tool to embed license, security, SBOM, and copyright rules:
    - Claude Code: CLAUDE.md
- Cursor: .cursor/rules/
- GitHub Copilot: copilot-instructions.md
- Devin Desktop: .devin/rules/
- Cline / Aider: .clinerules or AGENTS.md