This is unreleased documentation for SBOM Scanner 0.13-dev.

VEX Support

VEX communicates vulnerability exploitability information. Software projects can share VEX documents with scanning tools.

VEX can reduce false-positive vulnerability findings in the final report.

If you want to know more about VEX, take a look here.

VEX Hub

VEX Hub is a place where VEX (Vulnerability Exploitability eXchange) documents from different open-source projects are collected and organized. It helps people and security tools find and use important information about software vulnerabilities more easily.

If you want to know more about VEX Hub, take a look here.

Getting Started

To scan Registries with VEX, create one or more VEXHub resources.

This is a VEXHub resource example. See examples/vexhub.yaml.

apiVersion: sbomscanner.kubewarden.io/v1alpha1
kind: VEXHub
metadata:
  name: kubewarden
spec:
  url: "https://github.com/rancher/vexhub"
  enabled: true

Apply the resource with:

kubectl apply -f examples/vexhub.yaml

Apply a ScanJob that scans the target registry.

SBOM Scanner automatically detects VEXHub resources and includes them in the scan.

The VEXHub custom resource is cluster-scoped. You can use the same configuration for multiple registries.

Managing Multiple VEX Hub Repositories

You can configure an arbitrary number of VEXHub repositories within your cluster.

To disable a VEX Hub, set spec.enabled to false.

This will let SBOM Scanner exclude the VEXHub resource when scanning the registries.

Here’s the command to disable a VEXHub resource:

kubectl patch vexhub <vexhub-name> -p '{"spec":{"enabled":false}}'

Air Gap

Air Gap support for VEX Hub is described here.