This directory contains the OpenVEX data for this repository.
The files stored in this directory are used as templates by
vexctl generate when generating VEX data for a release or
a specific artifact.
To add new statements to publish data about a vulnerability,
download vexctl
and append new statements using vexctl add. For example:
vexctl add --in-place main.openvex.json pkg:oci/test CVE-2014-1234567 fixed
That will add a new VEX statement expressing that the impact of
CVE-2014-1234567 is under investigation in the test image. When
cutting a new release, for pkg:oci/test the new file will be
incorporated to the relase's VEX data.
To know more about generating, publishing and using VEX data in your project, please check out the vexctl repository and documentation: https://github.com/openvex/vexctl
OpenVEX also has an examples repository with samples and docs: https://github.com/openvex/examples