Vex
OpenVEX (Vulnerability Exploitability eXchange) implementation for Crystal.
Conforms to OpenVEX specification v0.2.0: https://github.com/openvex/spec/blob/main/OPENVEX-SPEC.md
Constants
CONTEXT = "https://openvex.dev/ns/v#{SPEC_VERSION}"
CONTEXT_PATTERN = /\Ahttps:\/\/openvex\.dev\/ns(?:\/v\d+(?:\.\d+)*)?\z/
Spec: @context is structured as https://openvex.dev/ns/v[version],
with the version optional (defaulting to v0.0.1 when omitted).
DEFAULT_AUTHOR = "Unknown Author"
KNOWN_HASH_LABELS = ["md5", "sha1", "sha-256", "sha-384", "sha-512", "sha3-224", "sha3-256", "sha3-384", "sha3-512", "blake2s-256", "blake2b-256", "blake2b-512"] of ::String
Spec Appendix A: Hash Names Table.
KNOWN_IDENTIFIER_LABELS = ["purl", "cpe22", "cpe23"] of ::String
Spec Appendix B: Software Identifier Types Table.
PUBLIC_NAMESPACE = "https://openvex.dev/docs"
SPEC_VERSION = "0.2.0"
VERSION = "0.2.0"
Class methods
Pragmatic IRI check: a non-empty value whose URI form parses with a non-empty scheme. We don't validate the full RFC 3987 grammar — that would over-reject legitimate values. The scheme check catches the common producer mistake of dropping a bare CVE name, package version, or hash into a field that the spec says is an IRI.