Add openvex format for our VEX statements.

build.sh

@@ -25,6 +25,7 @@ DOCKER_CMD="docker run --rm -ti -w /work -p 8000:8000 -v $(pwd):/work $SOLR_LOCA
 unset SERVE
 unset BUILD
 unset LOCK
+unset UPDATE_DEPS
 PELICAN_CMD="pelican content -o output"
 export SITEURL="https://solr.apache.org/"
 
@@ -35,6 +36,7 @@ OPTIONS=(
   "l:live:Live build and reload source changes on localhost:8000"
   "b:build:Force rebuild of the local Docker image"
   ":lock:Regenerate requirements.txt from requirements.in (use with -b to also rebuild image)"
+  ":update-deps:Regenerate solr-dependency-versions.json (needs python3; pass versions after --, default is all)"
   "h:help:Show this help message"
   ":pelican-help:Show all options accepted by Pelican"
 )
@@ -83,6 +85,20 @@ function regen_lockfile {
   echo "requirements.txt updated."
 }
 
+function update_dependency_versions {
+  if ! command -v python3 >/dev/null 2>&1; then
+    echo "ERROR: --update-deps requires python3 on the host (in addition to Docker)." >&2
+    exit 2
+  fi
+  echo "Downloading and syft-scanning each tracked Solr release's binary distribution..."
+  echo "(Pulls the 'anchore/syft:latest' image on first run; a full run downloads every"
+  echo " release's tarball, so it's slow and bandwidth-heavy. Pass specific versions"
+  echo " and/or flags (--slim, --verbose) after --, e.g.:"
+  echo "   ./build.sh --update-deps -- --slim 10.0.0"
+  echo " See 'python3 plugins/vex/update_dependency_versions.py --help' for details.)"
+  python3 plugins/vex/update_dependency_versions.py "$@"
+}
+
 function ensure_image {
   if ! docker inspect $SOLR_LOCAL_PELICAN_IMAGE >/dev/null 2>&1
   then
@@ -135,6 +151,7 @@ function handle_opt {
     -l|--live)      SERVE=true ;;
     -b|--build)     BUILD=true ;;
     --lock)         LOCK=true ;;
+    --update-deps)  UPDATE_DEPS=true ;;
     -h|--help)      usage; exit 0 ;;
     --pelican-help) ensure_image; $DOCKER_CMD pelican -h; exit 0 ;;
     --)             return 1 ;;
@@ -167,6 +184,11 @@ if [[ $LOCK ]]; then
   fi
 fi
 
+if [[ $UPDATE_DEPS ]]; then
+  update_dependency_versions "$@"
+  exit 0
+fi
+
 if [[ $BUILD ]]; then
   build_image
 else

content/pages/security-dependency-cves.md

@@ -13,12 +13,27 @@ VEX is an open standard that lets vendors state explicitly whether a CVE applies
 and why. A number of formats are under active development, including
 [CycloneDX](https://cyclonedx.org/capabilities/vex/) and
 [CSAF](https://github.com/oasis-tcs/csaf/blob/master/csaf_2.0/prose/csaf-v2-editor-draft.md#45-profile-5-vex).
-We currently publish in CycloneDX 1.6 JSON format.
+We publish this assessment in both **CycloneDX 1.6** and **OpenVEX** JSON formats (download links below).
 
 If your scanner supports VEX, download the file below and point your scanner at it to automatically
 suppress known non-applicable findings. If your scanner does not yet support VEX, you can use the
 table on this page to manually triage flagged CVEs.
 
+For example, [Docker Scout](https://docs.docker.com/scout/) can apply the OpenVEX file when scanning
+an official Solr image:
+
+```bash
+# Download the OpenVEX file, then have Docker Scout apply it to a scan.
+curl -sO https://solr.apache.org/solr.openvex.json
+docker scout cves solr:9.9.0 --vex-location solr.openvex.json --vex-author '.*'
+```
+
+CVEs marked `not_affected` are then dropped from the results, while those marked `affected` remain.
+(Solr's VEX is authored by the Apache Solr project, so `--vex-author '.*'` is required — by default
+Docker Scout only trusts VEX statements authored by `*@docker.com`.)
+
+
+
 We encourage feedback on VEX and tool support — join the discussion at
 [security-discuss@community.apache.org](mailto:security-discuss@community.apache.org)
 or contact [security@apache.org](mailto:security@apache.org).