[Docs] Audit the Trustify documentation

[ritz303]

Do an exhaustive audit of the Trustify documentation hosted on https://docs.guac.sh/trustify/ and https://docs.trustification.dev/trustify/index.html. The purpose of this audit is to improve the overall readability and find-ability.

Audit items:

• Grammar
• Minimalism
• Content organization
• Accessibility
• Mark (down/up) language syntax review

After this initial audit, the technical writer will provide suggestions for updating the source content, creating specific issues for those suggested changes.

[shivanisathe25]

Suggested changes in introduction on https://docs.trustification.dev/trustify/index.html

Trustify is a platform that enables organizations to store, manage, and query Software Bills of Materials (SBOMs) and security advisories. Developers can use this information to understand common security vulnerabilities and dependency changes across their software supply chain.

Trustify enables you to:

• Store SBOMs and security advisories for your software and its dependencies.
• Discover and assess the state of vulnerabilities affecting your software.
• Search and explore SBOM and advisory data using flexible queries.
• Share access to SBOM and advisory information with others.

[shivanisathe25]

Suggested changes in ToC on https://docs.trustification.dev/trustify/index.html

1. Introduction to Trustify
   1.1 Key Concepts
2. Administration Guide
   2.1 Deployment
   2.2 Infrastructure Requirements
   2.3 Resource Requirements
3. Self-Managed Kubernetes Deployment using Helm Charts
4. AWS Managed Services Deployment
   4.1 Manual AWS Resource Provisioning
   4.2 Automated AWS Provisioning with Terraform (OpenShift)
   4.3 Deploying Trustify with Helm
   4.4 OIDC Provider Configuration (Keycloak)
   5 Connecting to an AWS RDS Database

[shivanisathe25]

Changes in deployment options:

You have several deployment options for running Trustify.

Bare metal

Running Trustify on bare-metal servers requires downloading the trustd binary from the source available on the Trustify releases page.

There are currently two variants of this binary: trustd and trustd-pm. The -pm version includes a few embedded services, such as PostgreSQL and an OIDC issuer, which make it easier to run Trustify locally for evaluation purposes. However, this setup may be insecure and is not production-ready. It is best suited for testing, demos, and experimentation.

Container image

Trustify services are available as a container image:
ghcr.io/trustification/trustd.

Kubernetes

Since Kubernetes runs containers, deploying Trustify on Kubernetes is straightforward. We do not provide out-of-the-box Helm charts or installation scripts, as many configuration options depend on the target environment.

However, we maintain a Helm chart in the following repository, which you can use as a starting point for deploying a Trustify instance in your environment:
https://github.com/trustification/trustify-helm-charts

Data migration

If you are already using the Trustification project, you may want to migrate your SBOMs to Trustify. Vulnerability and advisory information is automatically ingested into the Trustify database.

The Trustification project uses S3-compatible object storage to store original SBOM files. The recommended migration approach is to ingest these SBOMs from the corresponding S3 bucket.

At present, there is no automated tool for this process, but the steps are straightforward:

1. Download SBOMs from the S3 bucket to a local directory:

   aws s3 sync s3://bombastic-prod/data/ /tmp/sboms/

2. Use a tool of your choice to traverse the directory and ingest the SBOMs into Trustify by posting them to the SBOM upload API endpoint.

   For example, the CSAF Walker library provides the sbom command-line tool, which can be used for this purpose:

   sbom scoop http://localhost:8080/api/v2/sbom /tmp/sboms/

In the future, we plan to provide additional options for ingesting SBOMs directly from various cloud object storage providers.

[ritz303]

@shivanisathe25 : Thank you for taking the time to review the Trustify documentation! While we continue to audit the docs, over the next week or so, I'll start creating separate GitHub issues for the specific docs work to be done. This way, we can keep the work to be done in smaller, more manageable chunks. In these new issues we can discuss the specific changes in more details, if needed.