Finally! Automated End-to-End VEX Streams You Can Trust
summary
Claims an end-to-end automated VEX stream by using compiler reachability to generate canonical OpenVEX statements, implemented via govulncheck producing OpenVEX documents that feed scanners like Grype; demonstrates this reduces false positives by suppressing non-exploitable CVEs discovered in build symbol tables. Shows integration with Kubernetes image releases and plans for an OpenVEX trust framework (Sigstore-based signing, per-statement authorship, tamper detection) to add authentication on top of existing authorization.
AI-written summary · about
chapters (8)
- 0:00Introduction and speaker background
- 3:54Why VEX is needed
- 7:12How VEX documents work
- 10:00Automation and trust challenges
- 11:26Go Vulncheck integration demo
- 13:56Next steps for VEX adoption
- 16:05OpenVEX trust framework
- 18:35Closing and Q&A
related talks
24mEmbracing the Era of Transparency: Automating VEX Application for Scalable, Context-Aware Security
50mDemocratizing Exploitability Data with OpenVEX
26mWeaving a VEX Feed Through the Kubernetes Project
27mWeaving a VEX Feed Through the Kubernetes Project
48m5 Steps to VEX Success: Managing the End-to-End Workflow
50mBOF - Discussion Regarding False Positive Results from Vulnerability Scanners and the Use of VEX
45mVEXing Open Source Security: Vulnerability Data for Everything
12mKeynote: We’re VEXing the Cloud Native Landscape. Bring Your Code!