vex ls, validate and merge

All three take --vex <file|dir> (repeatable, required) and -o pretty|json. Inputs may mix OpenVEX, CycloneDX VEX and CSAF VEX.

vex ls

Lists every statement and what it asserts, so you can review a set of documents before trusting it to suppress anything.

vulnetix vex ls --vex ./vex/
vulnetix vex ls --vex ./vex/ --status not_affected
vulnetix vex ls --vex vendor.openvex.json -o json

Flag	Default	Description
--status		Only list this status: not_affected, affected, fixed, under_investigation

vex validate

A document can parse and still assert nothing usable. validate reports these problems.

vulnetix vex validate --vex vendor.openvex.json
vulnetix vex validate --vex ./vex/ -o json

Problem	Fatal	Why
The document has no statements	yes	Nothing to apply
A statement names no vulnerability	yes	Nothing to match
A status outside not_affected, affected, fixed, under_investigation	yes	Cannot be acted on
not_affected with neither a justification nor an impact statement	yes	Invalid per OpenVEX
not_affected with a justification outside the OpenVEX list	no	Read, but not a standard reason
affected with no action statement	no	Tells a consumer nothing to do
A statement names no product	no	Applies to everything the document describes

The OpenVEX justifications are component_not_present, vulnerable_code_not_present, vulnerable_code_not_in_execute_path, vulnerable_code_cannot_be_controlled_by_adversary and inline_mitigations_already_exist.

Exits 1 when any problem is fatal.

vex merge

Combines documents into one OpenVEX 0.2.0 document.

vulnetix vex merge --vex vendor.openvex.json --vex ours.json --out merged.openvex.json
vulnetix vex merge --vex ./vex/ --out merged.openvex.json

Flag	Default	Description
--out	stdout	Write the merged document here

Statements are keyed by (vulnerability, product). When two documents disagree about the same pair, the newer timestamp wins: a vendor who published under_investigation in March and not_affected in June has said the second thing.

Exit codes

Code	Meaning
0	Success, and for validate no fatal problem
1	A fatal problem (validate), --vex missing, a document unreadable, or a flag invalid