What is ZertTree?

ZertTree is an SBOM risk visualizer. It takes a CycloneDX SBOM, queries OSV.dev for known vulnerabilities, scores each component on CVE severity and license risk, and renders the result as a CLI report, a JSON/HTML file, or an interactive Svelte + D3.js graph.

Status: early alpha (v0.1.0). The CLI + web UI work end-to-end on CycloneDX 1.5 SBOMs. APIs and report formats may change.

Features

Not implemented yet

The earlier README oversold a few things. To stay honest, here's what is not in v0.1.0:

• Freshness / maintenance scoring. Hooks existed but always returned the same constant. Removed until they're backed by a real registry lookup.
• PDF export. Was advertised, never implemented.
• cargo install zertree. Not yet on crates.io — build from source for now.
• zertannax/zertree-action@v1. Not yet published to GitHub Marketplace — reference the action by path inside this repo instead.
• Performance benchmarks. No "1000+ components/sec" claim is made — none has been measured.

PRs to fix any of these are welcome.

Quick Start

CLI (build from source)

git clone https://github.com/Zertannax/Zertree.git
cd Zertree/rust-parser
cargo build --release
./target/release/zertree --input ../examples/test-sbom-cyclonedx.json

Useful flags:

zertree --input sbom.json --mode prod          # stricter scoring
zertree --input sbom.json --output json        # writes zertree-report.json
zertree --input sbom.json --offline            # skip OSV lookup
zertree --input sbom.json --no-cache           # bypass the SQLite cache
zertree --input sbom.json --cache /path/to.db  # override cache location

Web UI

cd web-ui
npm install
npm run dev
# open http://localhost:5173

GitHub Action (from this repo)

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: Zertannax/Zertree/github-action@main
        with:
          sbom-path: './sbom.json'
          mode: 'prod'
          fail-on-critical: 'true'

Risk Scoring

The final score per component is a weighted sum on a 0–10 scale:

score = cve_score * cve_weight + license_risk * license_weight

A single CRITICAL CVE (CVSS ≥ 9.0) is enough to push a component into the Critical bucket regardless of its license.

Custom rules

{
  "name": "my-company-rules",
  "cve_weight": 0.70,
  "license_weight": 0.30,
  "blocked_licenses": ["GPL-3.0", "Proprietary"],
  "license_unknown_score": 7.0
}

Pass it with --rules my-rules.json.

Architecture

graph LR
    A[SBOM JSON] -->|Parse| B[Rust Engine]
    B -->|Score| C[Risk Analysis]
    C -->|Query by purl| D[OSV.dev]
    D -->|Cache 24h| E[SQLite]
    C -->|Output| F[Reports]
    F --> G[CLI]
    F --> H[Web UI]
    F --> I[GitHub Action]

Project Structure

zertree/
├── rust-parser/     # CLI + parser + scorer + OSV client (Rust)
├── web-ui/          # Interactive visualization (Svelte + D3.js)
├── github-action/   # Docker-based GitHub Action
├── examples/        # Test SBOMs
└── docs/            # Documentation + assets

Design System

Fonts: Space Grotesk (titles), JetBrains Mono (code), Inter (body)

Testing

cd rust-parser && cargo test          # 16 unit tests across parser/scorer/cache
cd ../web-ui && npm run build         # smoke build

Contributing

See CONTRIBUTING.md for guidelines.

License

MIT — see LICENSE.