Glossary¶
Key terms used throughout the TrustSource documentation.
| Term | Definition |
|---|---|
| Approval | A formal quality gate — a frozen snapshot of a module's bill of materials, reviewed and signed off before release. |
| Capability | An optional functional bundle of the TrustSource platform — e.g. OSCAR Chat, Risk, Product, Medical, CVD, CSAF Trusted Provider. Capabilities sit alongside the platform core; not all are present in every edition (the Community Edition omits SaaS-only capabilities). Not to be confused with "Module", which inside the app refers to a deployment artefact of a software product. |
| CBOM | Crypto Bill of Materials — lists cryptographic algorithms used in software. |
| Component | A third-party building block — a library, package, or artifact — referenced from a module. |
| CRA | EU Cyber Resilience Act — mandatory cybersecurity requirements for products with digital elements. |
| CSAF | Common Security Advisory Framework — a standard for structured security advisories. |
| CVE | Common Vulnerabilities and Exposures — a unique identifier for a security vulnerability. |
| CycloneDX | An SBOM format maintained by OWASP, strong in vulnerability and security metadata. |
| Deep Scan | File-level repository analysis for license, copyright, and crypto detection. |
| Infrastructure Module | A module representing third-party runtime dependencies (databases, base images, web servers). |
| Module | Inside the app, the unit of analysis in TrustSource — a deployment artefact of one piece of software with its bill of materials. Not to be confused with "Capability", which describes an optional functional bundle of the platform itself. |
| NIS2 | EU Network and Information Security Directive 2 — cybersecurity obligations for essential entities. |
| Notice File | An attribution document listing all open-source components and their licenses. |
| PURL | Package URL — a standard format for identifying software packages. |
| Release | A published, frozen version of an approved module under continuous vulnerability monitoring. |
| SARIF | Static Analysis Results Interchange Format — a standard for SAST tool output. |
| SBOM | Software Bill of Materials — a list of all components in a piece of software. |
| SOUP | Software of Unknown Provenance — a medical device regulatory concept for third-party software. |
| SPDX | An SBOM format maintained by the Linux Foundation (ISO/IEC 5962:2021). |
| VEX | Vulnerability Exploitability eXchange — communicates whether a vulnerability actually affects a product. |