Security and compliance
What Putki publishes about the security of each release, and where your security, compliance and procurement people find it. Most of it is generated from one source, the assessment we make of every finding in the images and plugins we ship, so the pages below agree with each other.
What we publish
| What | Where | Who can see it |
|---|---|---|
| Our assessment of every vulnerability finding, per release line: affected or not, and why | Vulnerability scans | Everyone |
| The same assessment as an OpenVEX file for your scanner, scoped to your edition | vex-<edition>.json on your edition's release page on forge.putki.io | Customers, with their forge.putki.io account |
| A CycloneDX SBOM for every image and plugins archive you receive | sbom-*.cdx.json on your edition's release page on forge.putki.io | Customers, with their forge.putki.io account |
| Which release lines are supported, until when, and when patches ship | Support lifecycle | Everyone |
| What changed in each release and patch release | Releases | Everyone |
| How to report a vulnerability | Vulnerability scans and below | Everyone |
Contents
- Use the VEX file with your scanner: download it for your edition and release, and let Trivy or Grype drop the findings we have already assessed.
- Get the SBOM for your release: download the software bill of materials of every image and plugins archive, and check it against what you run.
Report a vulnerability
Email security@putki.io. We acknowledge within one business day and aim to confirm our assessment within five. If you have a proof of concept against a supported release, say so in the subject line. If it is in Apache Hop's own code, we pass it to the Apache Software Foundation's security team and follow their process. You can also report Apache Hop vulnerabilities to the ASF directly, as described in Apache Hop's security policy.