Your first scan

By the end of this tutorial you will have scanned a project, read the report, and verified its signature — which is the part 0.0.1 could not do.

You need ZTVS 0.0.2 and a project directory.

Install#

cargo install ztvs --version 0.0.2
ztvs --version

Scan#

ztvs scan ./my-project

  scanning ./my-project
  resolved 412 packages from 3 sources
  verified 412/412 against on-disk artefacts
  matched 7 advisories · 2 suppressed by policy

  HIGH    ZTVS-2026-0031  openssl 0.10.55  → 0.10.66
  MEDIUM  ZTVS-2026-0044  time 0.3.20      → 0.3.36

Two lines are new since 0.0.1. verified 412/412 means every package the lockfile claimed was also found on disk. 2 suppressed by policy means a policy file made a decision — suppressed findings are counted, never hidden.

Sign the result#

ztvs scan ./my-project --attest --out report.json

This produces report.json and report.json.att, a detached attestation over the report, the scanner version and the advisory snapshot.

Verify it#

Verification is a separate command on purpose — someone who does not trust you should be able to run it:

ztvs verify report.json --attestation report.json.att

  ✓ signature valid
  ✓ scanner   ztvs 0.0.2
  ✓ advisories  snapshot 2026-08-17T04:00:00Z
  ✓ subject digest matches report

If any line fails, the report is not evidence of anything.

What changed since 0.0.1#

Next#

• Set up continuous scanning — see the next tutorial
• Write a policy to suppress a finding with a reason — see the how-to guides