Skip to main content
SourceTrustSign in

Help center

Guides for SourceTrust: Importing dependencies, reviewing licenses, external obligations, publishing attestation pages, billing, plain-language license explainers, and procurement-oriented explainers for common open-source licenses.

What is SourceTrust?

← All articles

SourceTrust turns a lockfile into a branded attestation page. Import, review licenses, publish for procurement, and export NOTICE files with each release.

SourceTrust helps software vendors prove what open-source packages their product uses and under which licenses. The result is a clean, branded attestation page you can paste into a security questionnaire instead of building a PDF by hand.

The four steps

  1. Import your dependencies from a lockfile or SBOM.
  2. Review each package: confirm its license, attach the license text, and meet its obligations.
  3. Publish a branded public attestation page.
  4. Export ready-to-ship files (THIRD_PARTY_LICENSES.md, NOTICE, JSON) to bundle with releases.
An attestation page is not a raw SBOM. It publishes the legal/compliance subset. Component identity and license posture. Not a version-exact dependency map. See Help center → Attestation page vs SBOM (Attestation page vs SBOM).