SourceTrust

What is SourceTrust?

SourceTrust helps teams prove third-party license obligations for the software they ship. It reads your lockfiles and SBOMs, checks the actual license inside each package artifact, and turns that review into a maintained compliance page. The page can be published at your own URL, updated with every push, and kept in sync with your repository. It also exports the same reviewed inventory into formats like SPDX, CycloneDX, JSON, CSV, NOTICE, and PDF, so legal, engineering, and procurement all work from one source of truth. The product is built for teams that need a clear record of license review, attribution, and distribution obligations without adding a new pipeline.

Key features

• Imports lockfiles, SBOMs, and repository manifests automatically.
• Verifies the shipped artifact against registry metadata.
• Flags copyleft, missing notices, and license mismatches.
• Publishes a branded attestation page at your URL.
• Keeps the page current on every repository push.
• Exports SPDX, CycloneDX, PDF, NOTICE, and CSV.