CSAF VEX product_tree: Resolve Product IDs to SBOM purls
A CSAF VEX file never puts a purl next to a status. Product IDs in product_status point into the product_tree, often through relationships. Here is …
Tag
Csaf
CycloneDX VEX: analysis.state and justification to OpenVEX
CycloneDX VEX uses six analysis states and nine justifications; OpenVEX and CSAF use four statuses and five justifications. Here is a field-by-field …