FOSSA vs TRUSCA

FOSSA scans software projects for dependencies, vulnerabilities, and license issues across the development lifecycle. Its open-source dependency analysis covers more than 30 languages, and its policy engine can enforce organization-wide license, security, and quality requirements, including build-blocking rules. Teams can generate, import, export, and manage software bills of materials (SBOMs). Scanning options include CLI and CI/CD workflows, container analysis, snippet detection, Quick Import from code hosts, and enterprise binary and SBOM uploads. Quick Import scans source without running the build, so its results are less complete than a CLI scan. Documented integrations include Jira, GitHub, Slack, Bitbucket, GitLab, APIs, and OIDC providers. FOSSA offers web, Linux, API, and self-hosted options; customers can operate its on-premises deployment using Kubernetes and Helm. Free includes five projects, 10 contributing developers, and five imported SBOMs. Business is listed at $2,020,710 a year; Enterprise pricing is custom and not listed.

TRUSCA is a free, open-source, self-hosted software composition analysis platform for CVE tracking, license compliance, and SBOM management. It uses cdxgen to detect packages across more than 30 language ecosystems, while Trivy matches components with NVD, OSV, GitHub Advisory, EPSS, and KEV data. Weekly database refreshes add new CVEs. TRUSCA imports CycloneDX or SPDX SBOMs and exports CycloneDX in JSON or XML and SPDX in JSON or Tag-Value. CI integrations include GitHub Actions, GitLab CI, Jenkins examples, a REST API, and API keys; build gates can fail on Critical CVEs or forbidden licenses. License workflows classify licenses as allowed, conditional, or forbidden, generate NOTICE files, and block forbidden licenses. The platform also offers approvals, an append-only audit log, email, Slack, Teams notifications, VEX triage, and EPSS prioritization. It runs through Docker Compose or Helm. It does not analyze users’ own source code.