feat(vex): native discovery of VEX documents stored as OCI artifacts#10807

Closed

mvanhorn wants to merge 26 commits into

aquasecurity:mainfrom

mvanhorn:fix/10750-vex-oci-native-discovery

Commits on Jun 7, 2026

feat(vex): discover VEX documents as OCI artifacts

mvanhorn
and
claude
committed

Commits on Jun 24, 2026

chore(vex): run go mod tidy
DmitriyLewen
committed
fix(vex): do not derive transport from repository_url scheme
DmitriyLewen
committed
refactor(vex): reuse pkg/attestation for VEX attestation decoding
DmitriyLewen
committed
fix(vex): iterate legacy .att layers instead of requiring a single layer
DmitriyLewen
committed
refactor(vex): simplify registry error-code helpers
DmitriyLewen
committed
docs(vex): add TODO to pass RegistryOptions for registry auth
DmitriyLewen
committed
refactor(vex): reuse media-type constants from pkg/oci
DmitriyLewen
committed
test(vex): consolidate OCI VEX discovery tests into a table
DmitriyLewen
committed
docs(vex): document isOpenVEXPredicateType matching
DmitriyLewen
committed
Merge branch 'main' of github.com:aquasecurity/trivy into fix/10750-vex-oci-native-discovery
DmitriyLewen
committed
fix(vex): reject legacy .att with too many layers
DmitriyLewen
committed
test(vex): cover registry error helpers and resolveDigest/legacy edge cases
DmitriyLewen
committed

Commits on Jun 25, 2026

test(vex): satisfy linters in oci_test.go
DmitriyLewen
committed

Commits on Jun 30, 2026