ORT Server: An open source platform to automate CRA checks
summary
ORT Server builds on OSS Review Toolkit to automate CRA checks with a UI and REST API, Kubernetes scaling, Keycloak OIDC for access control, and plugin-driven analyzer/advisor/scanner/evaluator/reporter pipelines. It generates CycloneDX and SPDX SBOMs, aggregates OSV/VulnerableCode/OSS Index results, and supports rule-based resolutions (demo resolves 1 of 2 vulnerabilities in an old SemVer4j run). Project status: ~77 releases, ~50 GitHub stars, 19 contributors; UI applies resolutions to future runs and stores audit logs.
AI-written summary · about
chapters (8)
- 0:00Introduction and ORT overview
- 4:25History of ORT project
- 7:58ORT Server motivation and features
- 10:05CRA compliance with ORT Server
- 12:34ORT Server UI walkthrough
- 18:51Running scans via REST API
- 24:32Future plans for ORT Server
- 26:40Q&A session
related talks
46mTurn CRA Awareness into Action
28mGenerating a SPDX SBOM for Your Code in CI Using ORT
44mSecurity Research with Open Source Software: Vol. Omega
35mOSCAR - Automate software analysis, compliance and security
34mOROCHIFY - An Assist to Product Developers in Manufacturing Industry to Find Vulnerabilities- 44mSecurity Research with Open Source Software: Vol. Omega
51mThe SBOM Era: Leaving No Open Source Project Behind With Osskb.org
39mManaging Audits for Critical Open Source Projects