Skip to content

Configuring Rules and Weights

TrustSight exposes two configuration files. Together they control which rules fire, how much each signal contributes to the score, and how evidence tiers are weighted.

Configuration files

File Purpose
rules.toml Enable/disable individual rules, adjust severity weights, set scope constraints
config.toml Global scoring parameters: severity_weights, source_bucket_weights, novelty_weights

Both files live in the TrustSight config directory and are read automatically on every run.

Rule namespaces

TrustSight has two rule namespaces:

Namespace Location Editable Description
R-series (R001-R131) rules.toml + code Yes (TOML-defined subset) Detection rules : PKGBUILD pattern matching. Users can enable, disable, and re-weight the TOML-defined set (R001-R013, R014, R016-R025, R039-R059); R060+ are code-emitted and not TOML-configurable.
C-series (C001-C007) Code only No Structural invariants : domain classification, checksum coherence, dependency graph anomalies. These cannot be disabled through rules.toml.

The C-series enforce invariants that the detection rules depend on. They fire automatically and their contribution is built into the scoring model. If you need to adjust their impact, modify the evidence tier weights in config.toml rather than trying to suppress them.

Adjusting severity weights in rules.toml

[rules.R004]
enabled = true
severity = "HIGH"        # default: HIGH
weight_override = 15     # default severity weight

[rules.R009]
enabled = true
severity = "MEDIUM"
scope = "function_body"  # only fire inside function bodies

Changing a rule's severity or weight directly changes the score. Always re-run benchmarks after editing rules.toml.

Adjusting scoring parameters in config.toml

[severity_weights]
INFO = 2
LOW = 5
MEDIUM = 10
HIGH = 20
CRITICAL = 40
FATAL = 100

[source_bucket_weights]
known = 0
trusted = 3
untrusted = 8
unknown = 15
malicious = 40

There is no block for verification or pinning. Declared checksums, PGP keys, GPG sources and source pins are reported as weight-0 P001-P007 findings and cannot be given a weight: a signal an attacker can assert for free must not be able to move a score. See B10.

Re-baselining after changes

Any change to weights or rules invalidates the current baseline. Scores will shift; packages that were UNFLAGGED may become FLAGGED and vice versa.

After editing rules.toml or config.toml:

  1. Run trustsight review against your full package set.
  2. Review the new score distribution.
  3. If the new baseline is acceptable, persist it with the re-baselining workflow.

Warnings

Changing weights changes scores. A small adjustment to MEDIUM from 10 to 12 shifts every package that fires a MEDIUM rule. Always validate against your package set before committing config changes.

C-series rules are not configurable in rules.toml. If you need to adjust their contribution, modify the corresponding evidence tier weight in config.toml. Their logic is structural and cannot be disabled without forking the codebase.

See also