About ts-obom¶
ts-obom grew out of threat-modelling work: to draw trust boundaries around a system you need to know which identities the software runs as and what those identities may touch. Dependency scans do not carry that information; the infrastructure definitions do. The extraction was first prototyped inside ts-scan and then moved into its own tool, because an access graph is a different artefact than a Software Bill of Materials and deserves its own, unambiguous command. Here it is: ts-obom.
About TrustSource¶
TrustSource is a brand representing a SaaS-solution that supports companies to cope with all sort of regulations to comply with when developing and distributing software, such as ISO/IEC 5230 (OpenChain on Oopen source compliance), ISO/IEC 18974 (Open Source Security Assurance) or the Cyber Resilience Act (CRA) introduced by the European Union in October 2024.
While the platform is provided as a managed service, the scanners as well as the core itself are available as open source solutions. You may use it to self host the
About EACG¶
EACG is the company behind TrustSource. EACG is an enterprise architecture consulting company, that has started the endavour in 2014. EACG supports its clients with design and delivery of digital business models. Explorationa and relisation of the prototypes and development of the first business units are part of their eingagement. This very early lead to the question of licenses and ownership.
Based on the experiences how fast a wrong license may enter the repository automated SBOM creation has been invented before even the SBOM became a dominating slogan. Vulnerbaility management has been added 2018 as a logical consequence, the service started to become interesting to others...
About EACG Operations Services¶
EACG decided to hand the operations of the platform to its AWS operations subsidiary. Thus EACG OS is taking care to run and manage the platform as well as the provisioning of support services while EACG is taking care for the individual consulting services. You may find further information on the EACG website. Find here links to further information: