Secure your software supply chain with confidence.
TrustGate is an enterprise-grade open-source tool for package trust analysis, artifact verification, and CI/CD gating. Stop malicious dependencies before they reach production.
Enterprise Controls
Everything you need for a secure supply chain
TrustGate provides a comprehensive suite of tools to analyze, verify, and control the code that enters your organization.
Dependency Discipline
Enforce exact package version pins, validate requirements.txt files, and mandate hash pin support to ensure deterministic builds.
Package Trust Analysis
Inspect metadata, detect yanked releases, analyze archives for startup-hooks (.pth, sitecustomize.py), and flag suspicious code patterns or native binaries.
External Trust Signals
Automatically look up OSV advisories and integrate OpenSSF Scorecard signals with explainable weak-check evidence.
Enterprise Supply-Chain Controls
Enforce internal mirrors, approved container registries, Sigstore/Cosign verification, and SLSA provenance validation hooks.
Isolation Controls
Generate hardened Docker sandbox commands with non-root execution, read-only filesystems, dropped capabilities, and disabled networking.
CI/CD Behavior
Automation-friendly CLI output with strict exit codes (0=ALLOW, 1=SANDBOX, 2=BLOCK) for policy-driven gate decisions in your pipelines.
Architecture
How TrustGate Makes Decisions
A transparent, policy-driven approach to evaluating risk.
Policy Loaded
Local or enterprise policy defines acceptable risk thresholds (pins, signatures, provenance).
Signals Collected
Analyzers inspect metadata, archives, OSV advisories, Scorecards, and signatures.
Risk Scored
Signals are evaluated against the policy. Missing provenance or startup hooks increase risk.
Decision Made
A final ALLOW, BLOCK, or SANDBOX (isolated review) decision is enforced.
Core Philosophy
Security Design Principles
TrustGate is built around these five core principles to ensure a robust and uncompromising approach to supply chain security.
1. Zero-trust by default
Do not assume packages, artifacts, images, or even scanners are safe.
2. Policy before convenience
Pinning, provenance, and trust rules come before installation speed.
3. Explainable decisions
Every decision should be reviewable and defensible.
4. Isolation for uncertainty
If something is not safe enough to trust, it belongs in a sandbox.
5. Promotion is a security event
Artifacts and images should be verified before they move deeper into the enterprise.
Threats Neutralized in the Wild
Don't just take our word for it. See how TrustGate's zero-trust architecture has actively prevented catastrophic supply chain attacks for real engineering teams.
"We almost pulled in a compromised LiteLLM dependency update during a routine CI run. TrustGate's sandbox analysis flagged anomalous network exfiltration to an unknown IP before it ever reached our dev environment. Saved our entire AI infrastructure."
"When the xz-utils backdoor hit, our team was panicking. We checked our TrustGate logs and realized our enterprise policy had automatically blocked the compromised version weeks ago due to anomalous maintainer trust signals."
"Caught a typosquatted requests package ('requessts') that a junior dev accidentally added to requirements.txt. TrustGate blocked the build immediately and suggested the correct package. Zero-trust actually working in practice."
Quick Start
Simple CLI, Powerful Results
TrustGate is designed to be easy to use locally and seamless to integrate into your CI/CD pipelines.
[INFO] Loading local_analysis_policy.json...[INFO] Analyzing package: requests==2.32.3[PASS] Risk score: 15/100[DECISION] ALLOW
[INFO] Analyzing 12 dependencies...[WARN] Package 'malicious-pkg' flagged by threat intel[FAIL] Risk score: 95/100[DECISION] BLOCK
[INFO] Checking artifact signature...[INFO] Verifying provenance...[PASS] Artifact verified successfully[DECISION] ALLOW
[INFO] Checking approved registry rules...[INFO] Verifying Cosign signature...[INFO] Validating SLSA provenance...[PASS] Image verified successfully[DECISION] ALLOW
[INFO] Active Policy: local_analysis_policy.json- exact_pins_required: true- signatures_mandatory: false- provenance_required: false- sandbox_on_weak_scorecard: false