CLI tool to create, transform and attest VEX metadata
vexctl is a CLI tool to create, apply, and attest VEX (Vulnerability
Exploitability eXchange) data. Its purpose is to help with the creation and
management of VEX documents that allow "turning off" security scanner alerts of
vulnerabilities known not to affect a product.
VEX can be thought of as a "negative security advisory". Using VEX, software
authors can communicate to their users that an otherwise vulnerable component
has no security implications for their product.
Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.
Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.
