Enabling VEX and Full SBOM Coverage with Wolfi Based Containers
summary
Wolfi-based images produce complete SPDX SBOMs including file-level hashes and package provenance, Wolfi advisories feed an automated generator called vaccine that emits OpenVEX statements, vexctl composes component VEX into an image-level VEX document, and the grype scanner (recently added VEX support) consumes those documents to suppress false positives — demo shows one CVE present in two packages marked not affected and grype hiding it when fed the VEX.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:34Story Time
- 5:20Completeness
- 8:20Vulnerability Scanner
- 11:15VEX
- 15:13Generating VEX
- 19:12Alternative
- 21:50Open VEX
- 28:45Questions
related talks
33mEnabling VEX and Full SBOM Coverage with Wolfi Based Containers
56mFrom SBOM to VEX - Discovering What's in the Box and How Badly it Can Hurt You
47mI Can’t Cope! How OWASP Is Helping To Manage Vulnerability Overload
27mSecuring Open Source With SBOM: From Visibility To Trust
26mStreamlining Vulnerability Management: The Power of VEX Inheritance in Container Ecosystems
39mSecure Your Supply Chain: Adding a Software Bill of Materials to Your Containers to Improve...
45mVEXing Open Source Security: Vulnerability Data for Everything
36mSBOMs, VEX, and Kubernetes