Blog Post
From Security Findings to Trusted Evidence
The Role of RESCALE’s Trust Orchestrator
Security tools can produce large amounts of useful information, but separate reports do not automatically create trust. Findings must be linked to the correct component and version, checked against the expected format, and combined with the other evidence required to describe the component’s security state.
Without this coordination, organisations may end up with several assessment reports that are technically correct but difficult to compare, verify, or maintain. RESCALE addresses this challenge through its Trust Orchestrator Framework and, in particular, the TrustOR component. TrustOR connects the results produced by the assessment tools with the platform’s management and trust mechanisms. Its role is to turn separate SBOMs, static and dynamic guarantees, and vulnerability information into a coherent and traceable TBOM workflow.
Moving Beyond a Collection of Reports
The static and dynamic testing modules focus on assessing components and generating structured results. The Static Supply Chain Component Guarantee, or SSCG, records the outcomes of static assessment, while the Dynamic Supply Chain Component Guarantee, or DSCG, captures evidence collected during execution. These artefacts are useful on their own, but their full value appears when they are connected to the same software component and supply-chain context. TrustOR checks these relationships before the evidence is accepted into the wider process. For example, the SBOM and SSCG are submitted together because one describes the software composition and the other describes the static assessment performed against it. TrustOR validates their CycloneDX structures, checks that the required component and version information is present, and confirms that the SSCG refers to the correct SBOM. The DSCG is submitted after dynamic testing. TrustOR verifies that it refers to an existing static assessment and that its identifiers are unique and consistent. These checks help prevent malformed, duplicated, or unrelated evidence from being combined into the same trusted record.
Coordinating the Complete Workflow
The State Manager acts as the main coordination point between the Dashboard, the assessment modules, and TrustOR. It receives component registrations and assessment results, checks access permissions, and forwards the relevant artefacts to TrustOR. Once the required evidence has been validated, TrustOR begins the TBOM creation process. It retrieves the related SBOM, SSCG, and DSCG, prepares the Bill of Vulnerabilities, and combines the available information into the trusted structure. The original documents remain available in the RESCALE repositories. The TBOM preserves the links between them, allowing users and systems to trace the final trust record back to the assessment evidence on which it was based.
Under the final RESCALE trust design, complete TBOM documents remain off-chain and under organisational control. Compact integrity evidence, including hashes, lifecycle transitions, and immutable events, can be anchored on the permissioned ledger. This makes later verification possible without publishing sensitive document contents on-chain. The State Manager keeps track of the process and allows the Dashboard to show the current status to the user. The user therefore sees the progress of the workflow without needing to interact with each individual assessment, repository, or trust service.
Keeping the Trust Record Up to Date
TrustOR’s role continues after the TBOM has been created. When the Continuous Security Assurance component identifies a newly disclosed vulnerability affecting a registered asset, it generates a structured alert. The alert can include the affected component, CVE identifier, severity, description, timestamp, and project reference. TrustOR uses this information to identify the appropriate TBOM and update the related vulnerability evidence. This creates a continuous connection between the initial assessment and the later security state of the component. The TBOM does not remain a fixed record created at release time. It can evolve as new information becomes available.
The Trust Orchestrator Framework is supported by the wider RESCALE integration environment. GitLab and Jenkins support source management and automated workflows, Docker provides consistent containerised deployments, Harbor distributes images, and Keycloak manages identity and access. REST interfaces allow components developed by different partners to exchange structured information without requiring a shared programming language or implementation model.
Turning Technical Results into Usable Assurance
The value of security assessment depends not only on what the tools detect, but also on what happens to the results afterwards. They must be validated, connected, protected, updated, and made understandable to the people who rely on them. TrustOR provides this coordination within RESCALE. By managing the relationships between component information, assessment results, vulnerability records, and trust mechanisms, it turns a collection of technical outputs into evidence that can support decisions across the supply chain.