Directories
¶
| Path | Synopsis |
|---|---|
|
Package analyze orchestrates the vexscan pipeline: prepare a target (extract an image, open a rootfs, or check out a source tree), ask each ecosystem plugin what it finds, resolve advisories for what the plugins inventory, and optionally overlay an LLM assessment on the genuinely-affected results.
|
Package analyze orchestrates the vexscan pipeline: prepare a target (extract an image, open a rootfs, or check out a source tree), ask each ecosystem plugin what it finds, resolve advisories for what the plugins inventory, and optionally overlay an LLM assessment on the genuinely-affected results. |
|
Package binscan inspects Go binaries on disk.
|
Package binscan inspects Go binaries on disk. |
|
Package buildinfo reports which build of vexscan is running.
|
Package buildinfo reports which build of vexscan is running. |
|
Package cvss scores CVSS v3 base vectors.
|
Package cvss scores CVSS v3 base vectors. |
|
Package debver compares Debian package version strings.
|
Package debver compares Debian package version strings. |
|
Package ecosystem defines the contract every language or OS package ecosystem implements so vexscan can triage it.
|
Package ecosystem defines the contract every language or OS package ecosystem implements so vexscan can triage it. |
|
golang
Package golang is the Go ecosystem plugin.
|
Package golang is the Go ecosystem plugin. |
|
maven
Package maven is the Java package ecosystem plugin.
|
Package maven is the Java package ecosystem plugin. |
|
npm
Package npm is the Node package ecosystem plugin.
|
Package npm is the Node package ecosystem plugin. |
|
ospkg
Package ospkg is the OS package ecosystem plugin: dpkg, apk and rpm.
|
Package ospkg is the OS package ecosystem plugin: dpkg, apk and rpm. |
|
pypi
Package pypi is the Python distribution ecosystem plugin.
|
Package pypi is the Python distribution ecosystem plugin. |
|
Package elfgraph answers one question about a container image: which shared libraries would the dynamic linker actually load?
|
Package elfgraph answers one question about a container image: which shared libraries would the dynamic linker actually load? |
|
Package envx resolves vexscan's own environment variables, honoring the legacy GOMODVEX_ names the tool used before it was renamed from gomod-vex.
|
Package envx resolves vexscan's own environment variables, honoring the legacy GOMODVEX_ names the tool used before it was renamed from gomod-vex. |
|
Package gist uploads a vexscan report to a GitHub gist so results can be shared with a single URL.
|
Package gist uploads a vexscan report to a GitHub gist so results can be shared with a single URL. |
|
Package image copies and flattens a container image's filesystem to a local directory using skopeo, and reports the image configuration.
|
Package image copies and flattens a container image's filesystem to a local directory using skopeo, and reports the image configuration. |
|
Package langdb reads the installed-package layouts of the language ecosystems that ship inside container images: Python's site-packages, Node's node_modules, and Java's jar, war and ear archives.
|
Package langdb reads the installed-package layouts of the language ecosystems that ship inside container images: Python's site-packages, Node's node_modules, and Java's jar, war and ear archives. |
|
Package llm asks a chat model two questions about a CVE that the deterministic analysis has already decided is genuinely present: whether it is plausibly exploitable in context (Assess), and which checkable identifiers the advisory text names (Mine).
|
Package llm asks a chat model two questions about a CVE that the deterministic analysis has already decided is genuinely present: whether it is plausibly exploitable in context (Assess), and which checkable identifiers the advisory text names (Mine). |
|
Package lockfile reads dependency lock files out of a source checkout.
|
Package lockfile reads dependency lock files out of a source checkout. |
|
Package lockmode is the repo-mode analyzer shared by the PyPI and npm plugins: inventory a checkout's lock files, then decide advisories against what they declare.
|
Package lockmode is the repo-mode analyzer shared by the PyPI and npm plugins: inventory a checkout's lock files, then decide advisories against what they declare. |
|
Package modgraph answers one question about an image: starting from what the container actually runs, which source modules can be imported?
|
Package modgraph answers one question about an image: starting from what the container actually runs, which source modules can be imported? |
|
Package osv resolves vulnerability advisories for a package version from the OSV database (https://osv.dev).
|
Package osv resolves vulnerability advisories for a package version from the OSV database (https://osv.dev). |
|
Package pkgdb reads the installed-package databases of the three OS package managers that show up in container images: dpkg, apk and rpm.
|
Package pkgdb reads the installed-package databases of the three OS package managers that show up in container images: dpkg, apk and rpm. |
|
Package rpmsrc resolves what --rpm names into parsed packages.
|
Package rpmsrc resolves what --rpm names into parsed packages. |
|
Package sbomsrc turns a CycloneDX bill of materials into the inventory the ecosystem plugins already consume.
|
Package sbomsrc turns a CycloneDX bill of materials into the inventory the ecosystem plugins already consume. |
|
Package source analyzes a Go project straight from its source repository rather than a shipped image.
|
Package source analyzes a Go project straight from its source repository rather than a shipped image. |
|
Package target models the two things vexscan can analyze — an extracted container image and a source checkout — behind a shared vocabulary the ecosystem plugins consume.
|
Package target models the two things vexscan can analyze — an extracted container image and a source checkout — behind a shared vocabulary the ecosystem plugins consume. |
|
Package triage answers a question a severity rating cannot: is anyone actually exploiting this?
|
Package triage answers a question a severity rating cannot: is anyone actually exploiting this? |
|
Package vex reads OpenVEX documents from a VEX Hub repository and matches their statements against findings.
|
Package vex reads OpenVEX documents from a VEX Hub repository and matches their statements against findings. |
|
Package vexpr writes OpenVEX documents recording the findings vexscan ruled out, laid out as a VEX Hub repository so they can be contributed to one.
|
Package vexpr writes OpenVEX documents recording the findings vexscan ruled out, laid out as a VEX Hub repository so they can be contributed to one. |
Click to show internal directories.
Click to hide internal directories.