OpenVEX Products and Subcomponents: purl Matching Rules
An OpenVEX statement suppresses a finding only when its products, subcomponents and purls line up with what the scanner found. Here is how the go-vex …
Tag
Trivy
CSAF VEX product_tree: Resolve Product IDs to SBOM purls
A CSAF VEX file never puts a purl next to a status. Product IDs in product_status point into the product_tree, often through relationships. Here is …