Skip to main content

Use the VEX file with your scanner

When your scanner checks a Putki image, it reports findings we have already assessed: a library that is present but never reached, a fix that is in the image under another version number. The VEX file carries our assessment in the OpenVEX format, which Trivy and Grype read, so those findings stop coming back to your team. The same assessments, in readable form, are on the vulnerability scans page.

Each edition has its own file, vex-<edition>.json, on the release page of the latest patch of each line. It describes what that edition receives, and it is updated when an assessment changes, so download it again before each scan rather than keeping a copy.

Before you start​

  • A forge.putki.io account with access to your edition's downloads, and an access token with repository: Read (see Install Putki plugins).
  • curl and jq, and Trivy or Grype.

1. Download the file​

Set your edition (basic, professional or enterprise) and the release you run, then ask the release page for its VEX file. From 2026.09, each edition has its own release repository, putki/putki-dist-<edition>. The 2026.03 and 2026.06 lines were released before the editions, on putki/putki-dist; their file is vex-legacy.json and describes everything that release shipped.

EDITION=professional
RELEASE=2026.09.02
REPO=putki-dist-${EDITION}        # 2026.03 and 2026.06: REPO=putki-dist
curl -sS -u "<forgejo-username>:<token>" \
  "https://forge.putki.io/api/v1/repos/putki/${REPO}/releases/tags/v${RELEASE}" \
  | jq -r '.assets[] | select(.name|startswith("vex-")) | .browser_download_url' \
  | xargs -n1 curl -sS -L -u "<forgejo-username>:<token>" -o vex.json

vex.json is a JSON document with a statements list. If the command writes nothing, check the release: the file is on the latest patch of each line, so ask for 2026.09.02 rather than 2026.09.

2. Scan with it​

Scan the image by the same tag you run.

Trivy

trivy image --vex vex.json forge.putki.io/putki/putki:2026.09.02

Grype

grype forge.putki.io/putki/putki:2026.09.02 --vex vex.json

Findings we have assessed as not affecting the image are left out of the report. Trivy can list them with --show-suppressed, so you can see what was dropped and why.

If a finding is not dropped​

  • The finding is not in the file. We have not assessed it yet, or it affects the image. Check the vulnerability scans page for its status.
  • You scanned another tag. The file names each image by release and digest. Scan the image tag of the release you downloaded the file for.
  • You use another scanner. It needs OpenVEX support. Otherwise read the assessments on the vulnerability scans page.