Stop supply chain
attacks before
they ship.

# Install from PyPI (recommended)
pip install oss-trust-framework

# Or install latest dev build from GitHub source
# pip install "git+https://github.com/chrisgillham/oss-trust-framework.git"

# Verify
oss-trust --version
# oss-trust, version 0.5.1

# Check a package
oss-trust check   --package requests   --version 2.33.0   --ecosystem PyPI   --github-repo psf/requests

name: Dependency trust validation
on:
  pull_request:
    paths:
      - "**/requirements*.txt"
      - "**/package-lock.json"
      - "**/Cargo.lock"
      - "**/go.sum"
      - "**/pyproject.toml"

jobs:
  trust-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"

      - name: Install OSS Trust Framework
        run: |
          pip install oss-trust-framework

      - name: Validate dependency updates
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          # Replace with your package name, version, and ecosystem
          oss-trust check             --package "requests"             --version "2.33.0"             --ecosystem "PyPI"             --github-repo "psf/requests"             --output json | tee trust-result.json
          # Exit code 1 on BLOCKED or QUARANTINE — fails the PR
          python -c "import json,sys; r=json.load(open('trust-result.json')); sys.exit(0 if r['outcome']=='approved' else 1)"

# Full pipeline check — standard lane
oss-trust check   --package requests   --version 2.33.0   --ecosystem PyPI   --github-repo psf/requests

# Gate             Passed   Decision
# age              yes      pass (1732h old)
# oob_trust        yes      PASS (score: 93/100, vulns: 0)

# JSON output for scripting
oss-trust check --package requests --version 2.33.0   --ecosystem PyPI --output json | jq .outcome
# "approved"

# Check a package with active CVEs — expect QUARANTINE
oss-trust check --package Pillow --version 9.0.0 --ecosystem PyPI
# Outcome: QUARANTINE (14 active CVEs found)

# Step 1: Request an expedited exception
# CVE is machine-verified against NVD + OSV + GHSA before proceeding
oss-trust zeroday request   --cve CVE-2024-XXXXX   --package requests   --version 2.33.1   --requester security@yourorg.com

# CVE confirmed by 3 sources.
# Quorum request created
#   Request ID : a3f9b2c1d4e5
#   Approvals  : 0 / 2 required   Expires: 6 hours
#   Requester excluded from approver pool

# Step 2: Each named approver votes (run independently)
oss-trust zeroday approve   --request-id a3f9b2c1d4e5   --approver-id approver_001   --mfa-token 123456

# Step 3: Check status
oss-trust zeroday status --request-id a3f9b2c1d4e5
# Request a3f9b2c1d4e5: APPROVED

# 1. Clone the framework repo
git clone https://github.com/chrisgillham/oss-trust-framework
cd oss-trust-framework

# 2. Create and activate virtual environment
python -m venv .venv && source .venv/bin/activate

# 3. Install in editable mode with dev dependencies
pip install -e ".[dev]"

# 4. Verify
oss-trust --version
# oss-trust, version 0.5.1

# 5. Copy and configure environment
cp .env.example .env

# Full suite — 131 tests, all offline, under 5 seconds
pytest tests/ -v

# With coverage (note: oss_trust_framework not src)
pytest tests/ -v --cov=oss_trust_framework --cov-report=term-missing

# Run a specific gate
pytest tests/test_gate5_behavioral.py -v
pytest tests/test_zeroday_lane.py -v

# Run a single test
pytest tests/test_gate5_behavioral.py::test_ironworm_001_tor_onion -v

git clone https://github.com/chrisgillham/oss-trust-framework
cd oss-trust-framework

python -m venv .venv && source .venv/bin/activate
pip install -e ".[dev]"

cp .env.example .env
# Edit .env with your credentials

# Run tests
pytest tests/ -v --cov=src

# Full pipeline check — standard lane
oss-trust check \
  --package requests \
  --version 2.32.3 \
  --ecosystem PyPI \
  --github-repo psf/requests

# Output (table format)
# requests@2.32.3 (PyPI) — lane: standard
# Outcome: APPROVED
#
# Gate             Passed   Decision
# age              yes      pass (118.3h old)
# provenance       yes      LOW
# orphan_commits   yes      pass
# workflow_perms   yes      pass
# pr_provenance    yes      LOW
# oob_trust        yes      PASS (score: 78/100)
# sbom             yes      pass
# sandbox          yes      pass

# JSON output for scripting
oss-trust check --package requests --version 2.32.3 \
  --ecosystem PyPI --output json | jq .outcome

# Step 1: Request an expedited exception
# CVE is machine-verified against NVD + OSV + GHSA before proceeding
oss-trust zeroday request \
  --cve CVE-2024-XXXXX \
  --package requests \
  --version 2.32.4 \
  --requester security@yourorg.com

# Output:
# CVE confirmed by 3 sources.
# Quorum request created
#   Request ID : a3f9b2c1d4e5
#   Approvals  : 0 / 2 required   Expires: 6 hours

# Step 2: Each named approver runs this independently
oss-trust zeroday approve \
  --request-id a3f9b2c1d4e5 \
  --approver-id approver_001 \
  --mfa-token 123456    # TOTP or hardware key

# Step 3: Check status
oss-trust zeroday status --request-id a3f9b2c1d4e5
# Request a3f9b2c1d4e5: APPROVED

name: Dependency trust validation
on:
  pull_request:
    paths:
      - "**/requirements*.txt"
      - "**/package-lock.json"
      - "**/Cargo.lock"

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: pip install oss-trust-framework
      - run: |
          oss-trust check \
            --package "${{ env.PACKAGE }}" \
            --version "${{ env.VERSION }}" \
            --ecosystem "${{ env.ECOSYSTEM }}" \
            --github-repo "${{ env.GITHUB_REPO }}" \
            --output json > result.json
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}