Skip to content

feat(vex): integrate lib4vex for VEX document management #5124

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 4 commits into
base: main
Choose a base branch
from

Conversation

JigyasuRajput
Copy link
Contributor

Integrate lib4vex for VEX document handling

This PR introduces a centralized VexHandler class that leverages lib4vex for parsing, validation, generation, and conversion of VEX documents across multiple formats (CSAF, CycloneDX, and OpenVEX).

Changes

  • Created VexHandler class to provide a unified interface for all VEX operations
  • Refactored VEX module to use lib4vex APIs instead of manual JSON handling
  • Added comprehensive unit tests for the new functionality
  • Implemented support for multiple VEX formats with consistent handling

Testing

Unit tests cover:

  • Parsing different VEX formats
  • Validation of VEX documents
  • Generation of VEX documents
  • Format conversion between different VEX types

It is a draft PR and the code still needs changes before merging it

@JigyasuRajput JigyasuRajput marked this pull request as draft June 6, 2025 17:08
Copy link
Contributor

@anthonyharrison anthonyharrison left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking good.

Be careful using logger.info as this can become very noisey very quickly. Suggest that you change this to debug.

@JigyasuRajput JigyasuRajput marked this pull request as ready for review June 9, 2025 09:22
@JigyasuRajput
Copy link
Contributor Author

Hey! I've implemented the suggested changes and fixed the tests for Week 1 tasks. However, CI on my fork is acting up a bit (even after a re-run) ...waiting for the CI here. Let me know if there's any changes required.
Thanks!
cc @anthonyharrison @terriko

@terriko
Copy link
Contributor

terriko commented Jun 9, 2025

I've approved CI to run, and I've also submitted a ticket to get you added to the "cve-bin-tool-read" group so you shouldn't have to wait for me to trigger CI runs. You'll get an invite in the next day or so when our ops team gets time to send them out, please accept it!

Copy link
Member

@mastersans mastersans left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good to me, Some Vex and Vex Handler Tests are failing, I'll make another pass once they are fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants