Install and quick start

Install the trustbom CLI, scan a repository, and see a cited draft in a few commands.

Pre-launch. The CLI is not yet published and trials are not yet open to customers. The commands below are what will work at release; they will not succeed today.

Install

Recommended: npm

You need Node.js, npm and Git. You do not need the .NET SDK or Docker. On Linux the binary needs the ICU runtime library (for example libicu74 on Ubuntu 24.04), and Alpine and other musl-based systems are not supported. Run it without installing anything:

npx trustbom scan

Or install it globally, which gives you the trustbom command and the shorter tbom:

npm install --global trustbom

Run trustbom license at any time to read the license terms for your installed version. It works offline. The terms are also on the terms page.

Without Node: script installers

For machines without Node, install.sh (Linux and macOS) and install.ps1 (Windows) install a standalone binary. They take an explicit release location; there is no default URL. Both download the archive for your platform and SHA256SUMS, and verify the checksum before installing trustbom and tbom into $HOME/.local/bin (add it to your PATH if needed).

# Linux or macOS
sh install.sh --base-url "https://github.com/resolveinterim/aitrustbom-releases/releases/download/v<version>"

# Windows (PowerShell)
.\install.ps1 -BaseUrl "https://github.com/resolveinterim/aitrustbom-releases/releases/download/v<version>"

Download install.sh (Linux and macOS) and install.ps1 (Windows) from the same release as the archives: https://github.com/resolveinterim/aitrustbom-releases/releases/download/v<version>/install.sh and .../install.ps1. They are separate assets and are not covered by SHA256SUMS, which lists the archives only. Download them over HTTPS and read them before running. Replace <version> with the release tag number. Releases are published as assets in the public aitrustbom-releases repository. Supported platforms are Windows x64, Linux x64 and arm64, and macOS arm64 and x64. Git is still required. On Linux the binary also needs the ICU runtime library (for example libicu74 on Ubuntu 24.04); Alpine and other musl-based systems are not supported. A matching checksum protects against accidental corruption, not against a source that replaces both the archive and the checksum file, so use a release source you trust.

Unsigned binaries

The Windows and macOS binaries are not code-signed or notarized at launch. A binary downloaded in a browser carries a quarantine marker and may trigger a warning:

Windows SmartScreen may show “Windows protected your PC”. Choose More info, then Run anyway, or run Unblock-File .\trustbom.exe in PowerShell first.
macOS Gatekeeper may say the binary “cannot be opened because the developer cannot be verified”. Run xattr -d com.apple.quarantine ./trustbom, or use System Settings > Privacy & Security > Open Anyway.

The npm and script-installer routes download without a browser, so they avoid these warnings. Always check a downloaded archive against SHA256SUMS from the same release.

For .NET developers: .NET global tool

If you already work with .NET, you can instead install the CLI as a global tool. This route needs the .NET SDK:

dotnet tool install --global trustbom

Update and uninstall

npm: npm update --global trustbom and npm uninstall --global trustbom.
Script install: rerun the installer with a newer archive and SHA256SUMS from a trusted release. To remove it, delete only trustbom and tbom (Linux, macOS) or trustbom.exe and tbom.cmd (Windows) from the install directory.
.NET tool: dotnet tool update --global trustbom and dotnet tool uninstall --global trustbom.

Offline and internal registries

Offline: copy the matching archive and SHA256SUMS from the same release to the machine and pass the folder with --release-dir (-ReleaseDir on Windows). No network access is needed. To serve archives internally, copy the release files to an HTTPS location and pass it as the base URL.
Internal npm registry: set npm_config_registry to your mirror’s URL. Mirror the exact trustbom version and its matching platform package, for example @resolveinterim/trustbom-linux-x64. Keep registry credentials out of the repository.

Quick start

From the root of the repository you want to cover. Everything here is free and works with no license, key or network connection.

trustbom init

Review the generated files, replace the example CODEOWNERS teams with your reviewers, and commit them before scanning. The scanner reads Git-tracked files only, so commit any new source or configuration you want included too.

trustbom scan
trustbom gate
trustbom readiness
trustbom export --draft

init scaffolds trust/system.yml, trust/manual.yml and trust/approvals.yml, a sample CODEOWNERS file and a GitHub Actions workflow. Existing files are preserved.
scan writes a cited draft: trust/card.json, card.md, questionnaire.yml and findings.sarif.
gate compares the result with the approved baseline and lists what blocks a pull request. Before any approval exists it reports that a bootstrap approval is required.
readiness writes an advisory checklist of evidence gaps. export --draft writes a watermarked internal snapshot that is never approved for buyers.

To get an approved, sendable pack:

trustbom request-approval
# a different Trust reviewer approves and merges the pull request
trustbom export

request-approval only writes a proposal. It becomes an approval when a CODEOWNER with the Trust role, who is not its author, approves and merges the pull request. export then needs a license (see below). Add --help to any command for its options.

If request-approval refuses because of unwaived findings at or above the default medium threshold, fix the findings or have Trust record reasoned, time-limited waivers in trust/approvals.yml, then retry. Use --fail-on to change the threshold only if your policy calls for it. After the approval is merged, run trustbom scan again before export --draft; the earlier scan belongs to the previous commit.

Want to see it end to end first? Walk through the Abingdon Taxi Solutions example, or clone the public starter repository on GitHub.

Start the free trial

The 30-day trial covers the paid commands for one GitHub owner and needs no payment card. A GitHub owner is the account name in your repository address: a GitHub organization or a user account. For example, github.com/acme belongs to owner acme. One license covers one GitHub owner; each additional GitHub organization or user account needs its own license. There is no trial web form; you request it from the CLI:

Run a paid command such as trustbom export. In an interactive terminal it asks: Enter your license key, or press Enter to request a free 30-day trial. Or run trustbom license request-trial --email you@example.com.
The CLI shows a short privacy notice and asks you to confirm. It then sends your email address, your GitHub owner and the client version to the license service. See the privacy page.
If eligible, you receive a trial key by email. Paste it at the prompt, or run trustbom license activate --key-stdin and supply the key on standard input.

A refused or previously used trial does not generate an email. If no email arrives within 10 minutes, try the request once more, then contact support@aitrustbom.com if you still need help.

The trial lasts 30 days from when the key is issued and is available once per GitHub owner. In CI, supply a key through the TRUSTBOM_LICENSE_KEY secret. See pricing for subscription terms.

Using it in GitHub

trustbom init writes a workflow that runs the scan and gate on every pull request and posts a comment and an AI TrustBOM check. It needs Node.js, npm and Git on the runner and does not use Docker. To make the gate block merges, require that check and CODEOWNER review of trust/approvals.yml in your branch protection settings.

Documentation

The detailed product guides are not yet published on this site. The how it works page and the public Abingdon Taxi Solutions starter cover the first journey. For anything else, email us.