OpenVEX Products and Subcomponents: purl Matching Rules
An OpenVEX statement suppresses a finding only when its products, subcomponents and purls line up with what the scanner found. Here is how the go-vex …
Tag
Purl
CVE packageURL: Join CVE JSON 5.2 Records to SBOM purls
CVE Record Format 5.2.0 added an optional packageURL field to affected entries. We counted it across all 400,445 published records: 1.6% carry one, 12 …
CSAF VEX product_tree: Resolve Product IDs to SBOM purls
A CSAF VEX file never puts a purl next to a status. Product IDs in product_status point into the product_tree, often through relationships. Here is …