Skip to content

1.0 - Release Notes

Version: 1.0 (app version 1.0.0), released 2026-09-16 Audience: All users. Items relevant only to operators are marked.

TrustSource CE 1.0 is the initial release of the TrustSource Community Edition: a self-hosted, open source edition of the TrustSource platform, licensed under the AGPL-3.0. The Updates page in the app lists it as version 1.0, Initial release.

Included

  • Self-hosted installation with Docker Compose. A reference setup runs the app, MongoDB, the license check service and a local mail catcher. Five settings are required; the first administrator and company are created on the first start. (Operators) See Installation & Setup.
  • Bring in your bill of materials. Import SPDX (JSON, RDF) and CycloneDX files, receive scans from CI/CD pipelines through the REST API, import SARIF results as SW quality scans, and look up single licenses or components with Check.
  • Analysis. Every module is analysed for license compliance (with the bundled license check service), vulnerabilities (from OSV, with EPSS exploit scores), versioning, viability, end-of-life, cryptography and export control. CE has no data source for end-of-life dates or repository activity, so the end-of-life and viability checks mostly report no data or OK.
  • Projects, modules and products. Organise modules in projects, add infrastructure and COTS modules, and describe what you ship as products with CRA classification, solutions, contacts, support, documents, photos and misuse cases.
  • Risks. A risk register with overview, risks and tasks, countermeasures and threat-model fields; risks from SARIF findings.
  • Approvals and releases. Approval workflow with review tabs, released module versions with signed SBOM, notice and VEX files, and monitoring of releases for new vulnerabilities.
  • Outbound documents. SBOMs and CBOMs (CycloneDX 1.7, SPDX 2.3), notice files (PDF, TXT), CSAF advisories with publishing to a CSAF provider, and Verify for signed files.
  • Knowledge. Component Lake, Infrastructure Elements, 3rd party (COTS), Vulnerability Lake, Licenses and the open source policy.
  • Administration. Company settings, user management with seven roles, API keys, release keys and CSAF feed keys, policies, audit logs and login history, and integrations with Jira, Azure DevOps (TFS), GitHub, LeanIX, webhooks, Microsoft Teams and Slack.
  • REST API under /api/v2 with built-in API documentation.
  • Email and password sign-in with optional two-factor authentication, invitations, and optional self sign-up (off by default).
  • Guide panel and guided tours. The compass icon in the right bar opens guidance for the current screen; a welcome tour starts on the first visit. See Guide, tour and demo project.
  • Demo project. Compliance managers and managers can load a demo project whose sample scan runs through a real analysis, and remove it again.
  • Version check. (Operators) At start, the app logs its version and checks GitHub for a newer one, sending a random installation id. The check cannot be switched off by a setting and fails harmlessly without internet access. See External Services.

Not included

Single sign-on, the AI assistants (OSCAR chat, Threat Model Agent), repository deep scans and several other capabilities of the TrustSource SaaS platform are not part of CE. See CE and SaaS compared.

See also: Release Notes index