Building a Trivy-consumable VEX repository with vexctl: scripts, repo spec, and edge cases

Short summary

This tutorial demonstrates building a VEX (Vulnerability Exploitability eXchange) workflow using vexctl to suppress false-positive CVE findings in Trivy container scans, reducing 70 findings to zero through digest-pinned OpenVEX statements. It covers packaging statements into a Trivy-consumable VEX repository, documents critical edge cases like purl qualifier matching quirks and derived-image digest mismatches, and compares consumption paths for Trivy versus Wiz via OCI registry attestations. A full demo repo automates the end-to-end pipeline from baseline scan through suppression.

• •Generate per-CVE OpenVEX statements with vexctl, pinned to image digests, then merge and feed to Trivy via --vex file or --vex repo
• •Key gotcha: Trivy's VEX repo index expects repository_url qualifier in purl IDs — omitting it causes silent no-match
• •Derived images need their own VEX for their digest; base-image VEX won't suppress findings on rebuilt layers

Generated with AI, which can make mistakes.