Session 3
25 MIN
OpenChain KWG 31st Meeting · 2026-09-08

Open Source Supply
Chain Security Tools

BomLens · Trusted OSS · TRUSCA

Haksung Jang · SK Telecom

02
Supply Chain
Starting with supply chain

SBOMs Became a Delivery Condition

SK Telecom requires every partner delivering software to it to submit an SBOM (Software Bill of Materials).

01
Delivery
Source code · container images · binaries · firmware · servers · off-the-shelf products
02
SBOM enclosed
CycloneDX or SPDX. A component list ships with every deliverable
03
Inspection
Format and content are both checked. Falling short means rejection
04
Remediation
High-or-above vulnerabilities must be fixed before delivery is complete
Source sktelecom.github.io/guide/supply-chain/for-suppliers Same direction The EU CRA also requires SBOMs and vulnerability reporting
03
Rejected
Why submissions get rejected

SBOMs You Can't Actually Use

Much of what comes in is SBOM-shaped but can't be mapped against a vulnerability database. These are the three most common rejection reasons.

Rejected submission (CycloneDX excerpt)
"components": [ // the purl field is missing entirely { "name": "libfoo", "version": "1.2.0" }, // the ecosystem couldn't be identified { "purl": "pkg:generic/commons-lang3@3.12.0" } ], // no transitive dependency record "dependencies": []
Missing PURL

Scan a bare install directory or raw files, and the identifier drops out entirely.

Missing transitive dependencies

Scanning source before the build step skips npm install or mvn package.

The pkg:generic/ fallback

Shows up when the ecosystem can't be identified — the package stays unpinned.

Source sktelecom.github.io/guide/supply-chain/for-suppliers/rejection-reasons Common thread All three happen because the tool being used never produced that information
BomLens

An Open Source Tool That Lets Suppliers
Generate the SBOM Themselves: BomLens

The obligation existed. The tool didn't.

An SBOM generator that also runs open source risk assessment. No account, no upload required.

Apache-2.0 · github.com/sktelecom/bomlens

05
BOMLENS
Local-first

One Scanner

Source, container, or a received SBOM — the same scanner runs and produces the same result.

Source codeContainersBinaries · firmware A received SBOMHugging Face modelsGitHub URL · ZIP
One Docker image
CLI, web UI, and desktop app
all run the same scanner
Your source never leaves the machine
CycloneDX SBOM
PURL per component, including transitive dependencies
Open source notice
The notice document that goes in your distribution
Risk report
Security vulnerabilities and license obligations
License Apache-2.0Repository github.com/sktelecom/bomlens
06
Results
Before the demo

Where to Look in the Scan Results

Before the demo, let's fix in advance where each of the three rejection reasons gets resolved on the results screen.

PURL column

Ecosystem, name, and version all land on one row.

Origin column

Even transitively-pulled components stay on the list as their own row.

License column

Flows straight into the notice file from the same scan.

localhost:8080 · Components
ComponentPURLLicenseOrigin
lodash 4.17.21pkg:npm/lodash@4.17.21MITDirect
commons-lang3 3.12.0pkg:maven/org.apache.commons/commons-lang3@3.12.0Apache-2.0Direct
requests 2.31.0pkg:pypi/requests@2.31.0Apache-2.0Transitive
urllib3 2.2.1pkg:pypi/urllib3@2.2.1MITTransitive
gin 1.9.1pkg:golang/github.com/gin-gonic/gin@1.9.1MITTransitive
Compare Both of these columns were blank in the excerpt on slide 3
DEMO · 4 MIN

The Generation Screen

Run the scan
Scanning a sample project on the public demo. sktelecom.github.io/bomlens/demo
Components
The PURL column shows ecosystem, name, and version together
Dependencies · SBOM
Check transitive dependencies and download the CycloneDX file

The three rejection reasons from slide 3 disappear one by one on this screen.

DEMO · 1 MIN

Same Tool, for Models Too

Open a model
Open the bert-base-uncased scan result under the AI Model tab on the same local server
Model and dataset
The model is Apache-2.0; the two datasets split between wikipedia (CC-BY-SA-3.0, conditional) and bookcorpus (license unknown, needs review)
Conformance
30/41 G7 minimum elements met

This is the answer to the first question in this morning's group discussion topic A — how do you actually review the license of an open model.

08
AI Coding
The AI coding problem

Three Things AI Coding Changed

That's the supply chain half. What follows is a problem happening inside our own development organizations.

01
The agent installs things on its own. No one signs off on every new dependency anymore.
02
Review always comes late. You see the library only after it's already in the code.
03
MCP tools live outside the repository. A description alone can't tell you what the model is actually calling.
The difference Before, it was the quality of what came in. Now it's the path code takes into our own repository Next What replaces the sign-off step a person used to own
Trusted OSS

AI Coding Governance

The policy existed. There was no way to enforce it.

A self-certification kit for ISO/IEC 5230 and 18974. At its core is a 5-level maturity model built for AI-coding conditions.

trustedoss.github.io

10
5 LEVELS
The AI-coding maturity model

Five Levels

L1 and L2 are rules people follow. From L3 on, a tool enforces them instead.

L1
Personal memory policy
A rule inside one person's head
L2
CLAUDE.md
AGENTS.md
A rules file the agent reads
L3
CI/CD gate
gitleaks · semgrep · grype
L4
AI defense layer
Review · fuzzing · MCP tool monitoring
L5
Post-deployment monitoring
Dependabot · DAST
The line L1 and L2 are documents and policy; from L3 on, a tool enforces them Next The tool category that actually enforces L3 and above: SCA
11
SCA
The tool that enforces L3 and above

What Is SCA?

No one can check L3-and-above by hand every time — you need a tool to stand in.

SCA (Software Composition Analysis): a category of tools that automatically finds open source components and checks their vulnerabilities and license obligations.


What SCA sees
  • The list and version of every component pulled in
  • Known vulnerabilities attached to that version
  • The license and the notice obligations that follow from it

What SCA doesn't see
  • Logic defects in code you wrote yourself
  • Misconfiguration that only shows up at runtime
  • A code snippet pasted in with no declaration anywhere
12
TRUSCA
Trusted SCA

TRUSCA, an Open Source SCA

A document doesn't execute. A tool enforces it instead.

CVE tracking, license compliance, and SBOM management in one screen. It runs inside your own network, so neither code nor SBOMs ever leave it.

Apache-2.0 Self-hosted Docker Compose · Helm

cdxgen covers 30+ language ecosystems, so it sweeps through whatever mix of languages sits in your internal repositories in one pass.

github.com/trustedoss/trusca

CVE sources Trivy's aggregated DB · NVD · OSV · GHSA · EPSS · KEVName Short for Trusted SCA
13
Pipeline
How it works

From Detect to Enforce

StageWhat it doesWith what
DetectdiscoveryFinds the components that made it into the repositorycdxgen, 30+ language ecosystems
MatchmatchingAttaches the CVEs tied to each component and versionTrivy's aggregated DB · NVD · OSV · GHSA · EPSS · KEV
TriagejudgmentDecides whether it's exploitable and records the reasoning7-state VEX management
EnforceenforcementBlocks the build on a critical vulnerability or a banned licenseCI gate, automatic NOTICE generation
The split The first two stages find things; the last two judge and block
DEMO · 4 MIN

Where Vulnerabilities Get Handled

01
Project list
Vulnerability count and top severity collapse to one line per repository
Risk roll-up
02
Vulnerability list
The columns that tell you what to fix first
7-state VEX · EPSS · KEV
03
SBOM tab
Exports the exact list used for enforcement as a submission-ready format
CycloneDX · SPDX
This walks through Match, Triage, and Enforce from the earlier table, live on screen

trusca-demo.duckdns.org · dev@demo.trustedoss.dev · read-only

15
Install
terminal
# github.com/trustedoss/trusca git clone https://github.com/trustedoss/trusca.git cd trusca && cp .env.example .env docker-compose -f docker-compose.dev.yml up # 30 seconds later: postgres, redis, backend, celery-worker, frontend # http://localhost:5173
Try installing it yourself

Three-Line Install

An evaluation install takes 30 seconds — plenty to run before deciding whether to adopt it internally.

Production deployments support Docker Compose and a Helm chart.

Just want to look first? The same screens are at trusca-demo.duckdns.org, no install needed
16
Wrap-Up
Division of labor

BomLens and TRUSCA

Not three tools used separately — each holds a different spot on the same supply-chain line.

Supplier · BomLens
Scans locally and produces the SBOM and notice file
CycloneDX SBOM submitted
TRUSCA
An open source SCA tool that detects CVEs and enforces license terms
Foundation
Trusted OSS
The ISO/IEC 5230 and 18974 self-certification kit, plus the 5-level AI-coding maturity model. This is the framework that decides what the two tools enforce and on what grounds

The three tools we saw today answer, respectively: an SBOM that gets rejected, a policy no one follows, and a gate that never enforces.

Takeaway Both the side that produces and the side that receives need a tool, or SBOM submission stays paperwork
17
Next
What's next

October 15 — the Hands-On Session

Today covered why these tools matter. Installing and actually running a scan is what the October 15 Tooling & Legal Subgroup meeting covers.

2026-09-08
Today · KWG 31st Meeting, Session 3
Tool introduction and a demo
2026-10-15 (Thu) 14:00
Tooling & Legal Subgroup, 30th Meeting
Open source management tools, in depth
Hands-on practice — install it and scan your own repository — starts October 15
Covers Both BomLens and TRUSCAAnnounced on the korea-sg-tooling-legal mailing list