trustsource/ts-obom repository overview

⁠TrustSource ts-obom

⁠Know what your infrastructure is allowed to touch

An SBOM tells you what is inside your software. ts-obom tells you what it runs as — and what it may reach once it does.

ts-obom reads your infrastructure as code and produces a CycloneDX Operations BOM: every resource your project is deployed as, and the IAM grants that connect them. Which function may write to which table. Which role may read which bucket. Through which policy that permission was granted.

No cloud credentials. No terraform init. No agent in your account. It reads the sources you already have in your repository, and it runs offline.

⁠Quick reference

• Maintainer: EACG⁠ Team
• Documentation: trustsource.github.io/ts-obom⁠
• Source: github.com/TrustSource/ts-obom⁠
• Security policy: SECURITY.txt⁠ — coordinated disclosure, PGP key, CSAF provider
• Latest tag: trustsource/ts-obom:latest

⁠What it reads

⁠Get a result in one command

docker run --rm -v "$(pwd)":/workspace trustsource/ts-obom \
  scan -f cyclonedx -o /workspace/obom.cdx.json /workspace