English
Français
Deutsch
Español
Italiano
ORT Server
Analyses repositories with a pipeline of jobs, offers a web UI, a REST API and a CLI, and generates SPDX and CycloneDX SBOMs.
OCCTET deliverable D4.1
Reference Installation
OCCTET deliverable D4.1 runs the open source toolkit as a containerised cloud service, validated on the Eclipse Foundation portfolio, on SME products and on popular open source projects. Use the hosted instance or reproduce the installation from its public deployment material.
On this page
The OCCTET toolkit, ready to use
Deliverable D4.1 turns the tools of the OCCTET toolkit into a reference installation: a containerised cloud service, hosted in the EU by the Eclipse Foundation, that SMEs and open source projects use without installing anything.
Every component is open source and all the deployment material is public, so any organisation can also reproduce the installation on its own infrastructure and keep its source code in-house.
- ORT Server Analyse dependencies, licences and known vulnerabilities, and generate SBOMs. (opens an external site)
- OCCTET Curator Review the findings, record decisions and VEX statements, export curated SBOMs. (opens an external site)
- VulnerableCode Query the OCCTET instance of the open vulnerability database, without an account. (opens an external site)
Validated on real workloads
The installation was tested at the scale of an open source foundation, on SME products and on widely used open source projects.
Inside the reference installation
Four services run on a managed Kubernetes cluster in the EU. ORT Server and the Curator check vulnerabilities against two open data sources: OSV and VulnerableCode, part of the federated software metadata platform of the project.
OCCTET Curator
Imports, curates and assesses SBOMs. Its AI-assisted services use a local language model, so no data leaves the installation.
VulnerableCode
An open vulnerability database that aggregates advisories from many sources and serves them by Package URL.
Keycloak
Single sign-on shared by ORT Server and the Curator, with the OCCTET theme.
Design principles
- One entry point: a single load balancer serves every host name over HTTPS.
- One namespace per service: each service has its own database and lifecycle.
- Helm everywhere: every component is installed and upgraded as its own Helm release.
- Shared identity: one account opens ORT Server and the Curator.
Use the hosted instance
Organisations that do not want to run the installation can use the OCCTET instance. After an access request, users sign in once with an e-mail address or a GitHub account, and the same account opens ORT Server and the OCCTET Curator.
Every account can read the results of the public open source organisations of ORT Server: Eclipse projects, Eclipse Research Labs, Renowned FOSS projects and FOSS Validation. Each SME works in its own organisation, which only its members can see. The ORT Server API, CLI and tokens for CI pipelines cover automated use.
Ready to try?
The getting started guide explains what to prepare and how to request access.
Install it yourself
All the deployment material is public, in the Eclipse Foundation GitLab group occtet-eu/reference-installation, under open source licences. One repository, occtet-helm-chart, installs the whole platform, one Helm release per component.
Prepare a Kubernetes cluster
A managed Kubernetes cluster with block storage, a load balancer and four DNS host names. The documentation gives the sizing of the reference instance.
Install the ingress controller and the certificates
The entry point terminates TLS for every service, with certificates from Let’s Encrypt.
Install single sign-on
Keycloak, with the OCCTET theme and the realm shared by the tools.
Install the tools
ORT Server, the OCCTET Curator and VulnerableCode, each in its own namespace.
Publish and verify
Publish the services through the entry point, sign in and run a first analysis.
- Start with the installation guide occtet-helm-chart installs the whole platform, in production or on a local minikube cluster. (opens an external site)
- Read the D4.1 documentation Architecture, security, installation, onboarding and operations, in one document. (opens an external site)
| Component | OCCTET deployment | Upstream project |
|---|---|---|
| ORT Server | occtet-ort-server-helm-chart | Documentation · Helm charts |
| ORT Server configuration | occtet-ort-server-config | Example configuration |
| OCCTET Curator | occtet-curator-helm-chart | User guide · Helm chart |
| VulnerableCode | occtet-vulnerablecode-helm-chart | Documentation |
| Single sign-on | occtet-keycloak · occtet-keycloak-theme | Keycloak documentation · Helm charts |
| Portfolio campaigns | occtet-eclipse-projects | ORT Server API |
| Statistics and dashboards | occtet-stats | – |
Local development
The whole platform also runs on a workstation, on a local minikube cluster. Use it to try the installation before reproducing it on a cluster, or to test a change of a chart, of its values or of a secret script before it is merged and deployed by the CI. It uses the same charts, values and secret scripts as production; only a few development overrides differ.
Clone the repositories side by side
occtet-helm-chart,occtet-keycloak,occtet-ort-server-helm-chart,occtet-curator-helm-chartandocctet-vulnerablecode-helm-chart.Install the platform
make dev-up, inocctet-helm-chart, creates the cluster and installs the secrets and every release, then prints the line to add to/etc/hosts.On Linux, raise the inotify limits of the workstation first (
fs.inotify.max_user_instances=1024): the minikube node shares them.Trust the local certificate authority
make dev-ca-installimports it into Chrome, Chromium and Firefox. It can only sign names underocctet.local.Sign in
make dev-accountsprints the passwords of the development accounts. Then openhttps://ort-server.occtet.localandhttps://curator.occtet.local.
| Reference instance | Local installation | |
|---|---|---|
| Cluster | Managed Kubernetes | minikube with the Docker driver: 8 CPUs, 12 GB of memory, 60 GB of disk |
| Host names | *.occtet.eu, public DNS records | *.occtet.local, in /etc/hosts |
| Certificates | Let’s Encrypt | A self-signed certificate authority, limited to occtet.local |
| Resources | Production sizing | Smaller requests; no local AI model for the Curator; fewer VulnerableCode workers |
| Single sign-on | Realm configured by an administrator | Development realm imported at start-up, with an administrator account |
| Chart repositories | Pinned as Git submodules | Local clones: a change is tested before it is committed |
Beyond the project
The project ends on 31 October 2026. The Eclipse Foundation continues to host the platform until early 2027.
The software does not depend on this instance. ORT Server is developed in Eclipse Apoapsis, an Eclipse Foundation project, and the OCCTET Curator and VulnerableCode are open source projects on GitHub. Anyone can use them, contribute to them, fork them and reproduce the installation. The deliverable also gives a one-year infrastructure cost estimate and an operational readiness plan for a fully operational service.
Read the full deliverable
D4.1 is a public demonstrator of Work Package 4, led by Double Open. Its documentation is written in Markdown and maintained with the deployment material, under the CC BY 4.0 licence.