Get Started With OCCTET: From Your First Assessment to Reviewed Software Evidence

Reference Installation
Secure FOSS Development
Open Source Stewards
Checklists & Templates
OCCTET helps SMEs and open source teams understand their CRA readiness, analyse software dependencies and document security decisions. Start with one product or repository, review the results, and build a repeatable process.
You can use the self-assessment and practical guides independently, or combine ORT Server and OCCTET Curator to analyse and review your software.
The self-assessment supports preparation and prioritisation. It is not a certification or a formal conformity assessment.
Choose a repository that represents a product you maintain. For a first trial, a small project with a familiar build system makes the results easier to interpret.
Have the following information ready:
Before analysing confidential code on a hosted service, discuss access and data-handling arrangements with the team. Use the service’s supported credential configuration rather than sending passwords or tokens by email.
The hosted ORT Server and Curator instances are part of the OCCTET reference installation, hosted in the EU by the Eclipse Foundation. They require an account: contact the OCCTET team to request access and confirm the arrangements available for your project.
Include your organisation, the tools you want to try, your project’s technologies, and whether the repository is public or private. Please do not include credentials.
If you prefer to manage your own infrastructure, reproduce the reference installation: its public deployment material installs the whole toolkit, one Helm release per component, in production or on a local minikube cluster. Each tool also has its own installation instructions: ORT Server and OCCTET Curator.
The reference installation already connects the Curator to ORT Server, with a shared single sign-on. If you assemble your own setup, make sure Curator can connect to ORT Server: the required configuration depends on the versions you use.
Once your access and repository configuration are ready:
Processing time and coverage depend on the repository, build system and configuration. A completed run can still contain analysis issues, so check whether the components relevant to your product were successfully resolved.
Your first milestone
An analysis of a known revision, with its dependency inventory and any analysis limitations recorded.
Bring the analysis results into Curator using the integration configured for your deployment. Review components, licence information and vulnerability findings.
For each important finding:
A vulnerability finding is a starting point for review. It does not automatically mean that the vulnerability is exploitable in your product.
Where supported, use VEX statements to document whether a known vulnerability affects the product and why. Review AI-assisted suggestions before accepting them.
Your second milestone
A prioritised list of actions and a record of the decisions made.
Use the exports available in your deployment to retain the software inventory and reviewed findings. ORT Server supports SBOM reporting; Curator provides curation and export capabilities.
Check which SBOM and VEX formats your installed version supports. Keep exported files alongside:
These records can support your technical documentation and discussions with customers or suppliers. They are part of a broader compliance process.
Repeat the analysis when dependencies change, before relevant releases, and at intervals appropriate to your product’s risk. New advisories can affect an unchanged codebase.
Assign responsibility for reviewing findings and keeping the evidence current. Use the dependency update policy and vulnerability handling templates to establish a simple routine.
When contacting the team, include the tool, repository or project identifier, run identifier if available, and a sanitised error message.