Enabling VEX and Full SBOM Coverage with Wolfi Based Containers
Talkat Open Source Summit Europe 2023 · on Wednesday, 2023-09-20· at 15:55· Room 0C (Floor 0), Abandoibarra Etorb., 4, 48011 Bilbao, Bizkaia, Spain·
summary
Wolfi-based images ship full SBOM coverage (SPDX per package, file-level hashes) and an advisory feed that a new tool called vaccine consumes to emit OpenVEX statements automatically when a CVE is assessed. vexctl composes image-level VEX from component VEX plus the image SBOM, and the demo shows grype with OpenVEX support suppressing false positives (example CVE flagged by scanners but marked not affected by VEX).
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:34Story Time
- 5:20Completeness
- 8:20Vulnerability Scanner
- 11:15VEX
- 15:13Generating VEX
- 19:12Alternative
- 21:50Open VEX
- 28:45Questions
related talks
33mEnabling VEX and Full SBOM Coverage with Wolfi Based Containers
56mFrom SBOM to VEX - Discovering What's in the Box and How Badly it Can Hurt You
47mI Can’t Cope! How OWASP Is Helping To Manage Vulnerability Overload
27mSecuring Open Source With SBOM: From Visibility To Trust
26mStreamlining Vulnerability Management: The Power of VEX Inheritance in Container Ecosystems
45mVEXing Open Source Security: Vulnerability Data for Everything
50mBOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX
30mDistribution Builders Meet VEX