$ show openvex/vexctl

[account ↗] [repo ↗] APPLICATION ★ 215 31 ● active (last update 3 weeks ago)

── AI DEEP ANALYSIS ──

reviewed by: deepseek/deepseek-v4-flash

vexctl is a command-line tool for creating, applying, and attesting VEX (Vulnerability Exploitability eXchange) data. It is built as a single binary using Cobra for CLI, with subcommands for creating VEX documents, merging them, filtering SARIF scanner results, generating attestations, and validating documents against the OpenVEX specification. The tool integrates with Sigstore for keyless signing and supports multiple VEX formats (OpenVEX native, CSAF, CycloneDX). It can attach VEX attestations to container images via OCI referrers API or legacy tag layout. The architecture follows a clean separation of concerns: CLI handlers in `internal/cmd/` delegate to a core library in `pkg/ctl/`, which uses an interface (`Implementation`) for testability. The `pkg/attestation/` package handles in-toto attestations and Sigstore signing independently. The codebase demonstrates strong engineering practices with dependency injection, options struct patterns, and comprehensive test data. While primarily an application, it also processes vulnerability data (SARIF, VEX documents) and includes validation logic that could be reused in other security tooling.

── METRICS ──

RATING8.4/10

QUALITY7.8/10

MAINTENANCEactive

DRIFTlow

CONTRIBUTORS27

VELOCITY0.87

OPEN ISSUES10

CLOSED ISSUES25

LAST COMMIT3 weeks ago

── TAGS ──

#vex #vulnerability-management #cli #sigstore #sbom #security-tool #container-security #go #golang #supply-chain

── GITHUB TOPICS ──

go golang supply-chain vex

── DEPENDENCY GRAPH ──

github.com/carabiner-dev/attestation (go) v0.2.1

github.com/carabiner-dev/collector (go) v0.3.17

github.com/carabiner-dev/signer (go) v0.6.2

github.com/google/go-containerregistry (go) v0.22.1

github.com/in-toto/attestation (go) v1.2.0

github.com/openvex/go-vex (go) v0.2.10-0.20260921184924-c6d860997ec4

github.com/owenrumney/go-sarif (go) v1.1.1

github.com/package-url/packageurl-go (go) v0.1.7

github.com/regclient/regclient (go) v0.11.6

github.com/sigstore/protobuf-specs (go) v0.5.2

github.com/sigstore/sigstore-go (go) v1.3.0

github.com/sirupsen/logrus (go) v1.10.2

github.com/spf13/cobra (go) v1.10.2

github.com/stretchr/testify (go) v1.12.1

golang.org/x/sync (go) v0.23.0

google.golang.org/protobuf (go) v1.36.12

sigs.k8s.io/release-utils (go) v0.12.5-0.20260825061901-4f1f891011bb

buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go (go) v1.36.12-20260825204119-511051f7f437.2

cloud.google.com/go (go) v0.123.0

cloud.google.com/go/auth (go) v0.20.0

cloud.google.com/go/auth/oauth2adapt (go) v0.2.8

cloud.google.com/go/compute/metadata (go) v0.9.0

cloud.google.com/go/iam (go) v1.13.0

cloud.google.com/go/kms (go) v1.33.0

cloud.google.com/go/longrunning (go) v1.2.0

dario.cat/mergo (go) v1.0.2

filippo.io/edwards25519 (go) v1.2.0

github.com/Azure/azure-sdk-for-go/sdk/azcore (go) v1.22.0

github.com/Azure/azure-sdk-for-go/sdk/azidentity (go) v1.14.0

github.com/Azure/azure-sdk-for-go/sdk/internal (go) v1.12.0

github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys (go) v1.5.0

github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal (go) v1.2.0

github.com/Azure/go-ansiterm (go) v0.0.0-20250102033503-faa5f7b0171c

github.com/AzureAD/microsoft-authentication-library-for-go (go) v1.7.2

github.com/CycloneDX/cyclonedx-go (go) v0.12.0

github.com/Microsoft/go-winio (go) v0.6.2

github.com/ProtonMail/go-crypto (go) v1.4.1

github.com/anchore/go-struct-converter (go) v0.1.0

github.com/apparentlymart/go-textseg/v15 (go) v15.0.0

github.com/asaskevich/govalidator (go) v0.0.0-20230301143203-a9d515a09cc2

github.com/avast/retry-go/v4 (go) v4.7.0

github.com/aws/aws-sdk-go-v2 (go) v1.43.0

github.com/aws/aws-sdk-go-v2/config (go) v1.32.31

github.com/aws/aws-sdk-go-v2/credentials (go) v1.19.30

github.com/aws/aws-sdk-go-v2/feature/ec2/imds (go) v1.18.31

github.com/aws/aws-sdk-go-v2/internal/configsources (go) v1.4.31

github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 (go) v2.7.31

github.com/aws/aws-sdk-go-v2/internal/v4a (go) v1.4.32

github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding (go) v1.13.13

github.com/aws/aws-sdk-go-v2/service/internal/presigned-url (go) v1.13.31

github.com/aws/aws-sdk-go-v2/service/kms (go) v1.55.0

github.com/aws/aws-sdk-go-v2/service/signin (go) v1.5.0

github.com/aws/aws-sdk-go-v2/service/sso (go) v1.33.0

github.com/aws/aws-sdk-go-v2/service/ssooidc (go) v1.38.0

github.com/aws/aws-sdk-go-v2/service/sts (go) v1.45.0

github.com/aws/smithy-go (go) v1.27.3

github.com/blang/semver/v4 (go) v4.0.0

github.com/carabiner-dev/command (go) v0.3.2

github.com/carabiner-dev/deadrop (go) v0.0.0-20260228173914-d95e9ea2877d

github.com/carabiner-dev/ghrfs (go) v0.3.7

github.com/carabiner-dev/github (go) v0.2.3

github.com/carabiner-dev/hasher (go) v0.2.4

github.com/carabiner-dev/jsonl (go) v0.2.2

github.com/carabiner-dev/openeox (go) v1.0.0

github.com/carabiner-dev/osv (go) v0.1.2

github.com/carabiner-dev/policy (go) v0.5.6

github.com/carabiner-dev/predicates (go) v0.5.4

github.com/carabiner-dev/sbomfs (go) v0.2.0

github.com/carabiner-dev/spdx3 (go) v0.1.0

github.com/carabiner-dev/stash (go) v0.0.0-20260914181612-673fcf191e49

github.com/carabiner-dev/vcslocator (go) v0.5.0

github.com/cenkalti/backoff/v4 (go) v4.3.0

github.com/cenkalti/backoff/v5 (go) v5.0.3

github.com/cespare/xxhash/v2 (go) v2.3.0

github.com/chainguard-dev/clog (go) v1.8.1

github.com/clipperhouse/displaywidth (go) v0.11.0

github.com/clipperhouse/uax29/v2 (go) v2.7.0

github.com/cloudflare/circl (go) v1.6.5

github.com/common-nighthawk/go-figure (go) v0.0.0-20210622060536-734e95fb86be

github.com/coreos/go-oidc/v3 (go) v3.20.0

github.com/cyberphone/json-canonicalization (go) v0.0.0-20241213102144-19d51d7fe467

github.com/cyphar/filepath-securejoin (go) v0.6.1

github.com/digitorus/pkcs7 (go) v0.0.0-20250730155240-ffadbf3f398c

github.com/digitorus/timestamp (go) v0.0.0-20250524132541-c45532741eea

github.com/docker/cli (go) v29.7.2+incompatible

github.com/docker/docker-credential-helpers (go) v0.9.8

github.com/docker/libtrust (go) v0.0.0-20160708172513-aabc10ec26b7

github.com/dustin/go-humanize (go) v1.0.1

github.com/emirpasic/gods (go) v1.18.1

github.com/fatih/color (go) v1.19.0

github.com/felixge/httpsnoop (go) v1.1.0

github.com/github/smimesign (go) v0.2.0

github.com/go-chi/chi/v5 (go) v5.3.1

github.com/go-git/gcfg (go) v1.5.1-0.20230307220236-3a3c6141e376

github.com/go-git/go-billy/v5 (go) v5.9.1

github.com/go-git/go-git/v5 (go) v5.19.2

github.com/go-jose/go-jose/v4 (go) v4.1.5

github.com/go-logr/logr (go) v1.4.4

github.com/go-logr/stdr (go) v1.2.2

github.com/go-openapi/analysis (go) v0.26.0

── FILE BREAKDOWN ──

Files by Type (count)

JSON

YAML

Markdown

Text

Other (no ext)

Shell

Git Ignore

Makefile

Other (.mod)

Other (.sum)

Files by Type (size)

JSON

1MB

135KB

Other (.sum)

70KB

Markdown

15KB

Other (.mod)

12KB

YAML

12KB

Other (no ext)

11KB

Shell

3KB

Makefile

2KB

Git Ignore

2KB

Text

323B

── KEY FINDINGS: REUSABLE CODE ──

The LLM identified 4 files worth highlighting for reuse:

Default implementation of the `Implementation` interface containing all core business logic: SARIF filtering, attestation creation, document merging, product normalization. It is self-contained and can be extracted to provide VEX processing capabilities in other Go projects by implementing the same interface.

file: pkg/ctl/implementation.go ↗ | tags: #interface-based-design #dependency-injection #business-logic

Standalone package for creating and signing in-toto attestations with Sigstore. Supports two output formats (bundle and DSSE). It is independent of the CLI layer and can be reused in any Go project needing to produce signed attestations for software artifacts.

file: pkg/attestation/attestation.go ↗ | tags: #attestation #sigstore #in-toto

Self-contained VEX document validator that checks fields, types, and allowed status/justification combinations against the OpenVEX specification. It can be embedded in other tools or used as a library for validating VEX documents without the full CLI.

file: internal/cmd/validate.go ↗ | tags: #validation #vex-spec

Centralizes CLI flag definitions using a struct-based options pattern with `AddFlags()` and `Validate()` methods. This pattern is reusable across any Cobra-based CLI project to keep flag handling clean and testable.

file: internal/cmd/options.go ↗ | tags: #options-pattern #cli-design

── HISTORY ──

Last analyzed: 2026-09-28 20:19:32.401653

Next check: 2026-10-05 20:19:32.389334