SourceTrust's headline output is a branded attestation page for procurement and legal review. It publishes the compliance subset your team deliberately approved: component identity, confirmed license, license text, and obligations posture.
What an attestation page is
- Human-readable for security questionnaires and vendor due diligence.
- Revisioned: Readers see a numbered publish, not work in progress.
- The private inventory can include the full resolved lockfile set; the public page includes only the reviewed compliance subset your team publishes.
What it is not
- Not a public dependency graph or a dump of every private inventory row.
- Not a vulnerability report (security findings stay vendor-only).
- Not a substitute for your own SBOM generation pipeline when regulations require a full graph.
When to download an SBOM export
Use Download data → CycloneDX or SPDX when a buyer or tool needs machine-readable disclosure of the same published subset. Pick the spec version your tooling expects. See Help center → Download and export formats (Download and export formats).