# vexctl mit Homebrew, Nix, zypper installieren Prüfe Installationswege, Executables, Metadaten und Sicherheitshinweise für vexctl in AI-Agent-Workflows. ## Installation ```sh sudo av install brew:vexctl ``` Weitere Installationsbefehle: ### macOS - Homebrew (100%): ```sh brew install vexctl ``` Evidenz: local Homebrew formula metadata ### Linux - Nix (92%): ```sh nix profile install nixpkgs#vexctl ``` Evidenz: nixpkgs package indexes: pkgs/by-name/ve/vexctl/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - zypper (92%): ```sh sudo zypper install vexctl ``` Evidenz: openSUSE Tumbleweed package metadata: vexctl from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst ## Paketfakten - **Paketschlüssel:** brew:vexctl - **Paketmanager:** Homebrew - **Paketmanager-Seite:** - **Version:** 0.4.4 - **Quellzusammenfassung:** Tool to create, transform and attest VEX metadata - **Homepage:** - **Repository:** - **Upstream-Dokumentation:** - **Lizenz:** Apache-2.0 - **Quellarchiv:** - **Zuletzt aktualisiert:** 2026-07-26T00:30:01+02:00 - **Generiert:** 2026-08-04T22:13:35+00:00 ## Executables - vexctl (cli) - vexctl (Alias) ## Build-Abhängigkeiten - go ## Installationsverhalten - Post-install-Hook: nicht definiert - Bottle: verfügbar auf arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Version und Aktualität - Seite generiert: 2026-08-04 - Manager-Version: 0.4.4 - Manager aktualisiert: 2026-07-26 - lokale Daten: OK - Upstream-Repository: https://github.com/openvex/vexctl - neueste erkannte Version: v0.4.4 (aktuell) ## Projektgeschichte und Nutzung vexctl is the command-line tool of the OpenVEX project, a security-supply-chain effort for producing and consuming Vulnerability Exploitability eXchange metadata. Its practical role is to let maintainers create, merge, apply, and attest VEX documents so scanners can distinguish exploitable vulnerabilities from findings that are known not to affect a particular product. ### Projektgeschichte The vexctl repository was created in January 2023, the same month Chainguard publicly introduced OpenVEX as a lightweight specification, library, and tool suite aligned with the VEX minimum requirements work associated with NTIA and CISA. The project later became part of OpenSSF's OpenVEX home, where OpenSSF describes vexctl as the flagship CLI for creating, merging, and attesting OpenVEX documents. OpenVEX sits among several VEX encodings and security-advisory formats. OpenSSF documentation frames OpenVEX as an interoperable and embeddable implementation intended to work independently of a particular SBOM format, alongside CSAF, CycloneDX, and SPDX-based VEX approaches. ### Adoptionsgeschichte By late 2023, OpenSSF described OpenVEX as having a growing community of adopters, with support from companies including Anchore, Chainguard, Intel, and Microsoft. The adoption story is tied less to vexctl as a standalone utility and more to the need for machine-readable vulnerability-status signals that can reduce scanner noise in SBOM-driven workflows. Canonical's Ubuntu VEX data feed later chose the OpenVEX specification maintained by OpenSSF, citing its clarity, minimalism, compliance, interoperability, and embeddability. That kind of downstream use makes vexctl relevant as a reference CLI for generating and manipulating the same class of documents. ### Wie es verwendet wird Typical vexctl usage is in supply-chain security and vulnerability-management pipelines: creating OpenVEX statements for products and CVEs, applying those statements to scanner output, merging documents, and producing attestations. Tutorials commonly pair it with scanners such as Trivy to suppress or explain false-positive vulnerability findings without discarding the underlying scan data. ### Warum Paket-Nerds sich dafür interessieren For package maintainers, vexctl is a small but important glue tool in the SBOM/VEX ecosystem. It gives open-source producers a way to publish negative security advisories in a machine-readable format, and gives consumers a command-line path to feed that context into automated vulnerability triage. ### Zeitleiste - 2023-01: The openvex/vexctl GitHub repository was created, and Chainguard introduced OpenVEX as an open-source VEX specification and tool suite. - 2023-07: OpenSSF's Vulnerability Disclosures Working Group discussed planned updates to both the OpenVEX specification and vexctl tooling after OpenVEX's first months as an OpenSSF project. - 2023-12: OpenSSF described OpenVEX as housed in OpenSSF and supported by a growing community of adopters. - 2026-06: GitHub releases show vexctl continuing with v0.4.x releases. ### Quellen - - - - - - - - ## Sicherheitshinweise narrow executable package without higher-risk signals. - **Geiger-Risiko:** grün / niedrig - narrow executable package without higher-risk signals ## Details aus der Quelldatenbank - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** vexctl - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Andere Paketmanager-Einträge - Nix - vexctl: normalized package name match | nixpkgs package indexes: pkgs/by-name/ve/vexctl/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - zypper - vexctl - 0.4.4+git20.5d61136-1.2: normalized package name match | openSUSE Tumbleweed package metadata: vexctl from https://download.opensuse.org/tumbleweed/repo/oss/repodata/50b07339cb64c8ed4091bdbabddadc1ff5737b090e478818a195b40d8a3292861a879139b4a3987c31109699fde9fbf4a716367ddf4eef77da75f96e3193d6ed-primary.xml.zst | CLI tool to create, transform and attest VEX metadata | https://github.com/openvex/vexctl ## Verwandte Links - [Terminal utility packages](https://pkg.so/de/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://pkg.so/de/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://pkg.so/de/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [Homebrew utility packages](https://pkg.so/de/brew-utility-packages/) - Matched Homebrew package provider. - [go](https://pkg.so/de/brew/go/) - Build dependency declared by Homebrew. - [chainloop-cli](https://pkg.so/de/brew/chainloop-cli/) - Shares pkgdb curated category or tags: attestation, cli, security. - [witness](https://pkg.so/de/brew/witness/) - Shares pkgdb curated category or tags: attestation, cli, security. - [openssl@3](https://pkg.so/de/brew/openssl-3/) - Shares pkgdb curated category or tags: cli, security. - [gnutls](https://pkg.so/de/brew/gnutls/) - Shares pkgdb curated category or tags: cli, security. - [p11-kit](https://pkg.so/de/brew/p11-kit/) - Shares pkgdb curated category or tags: cli, security. - [gnupg](https://pkg.so/de/brew/gnupg/) - Shares pkgdb curated category or tags: cli, security. - [krb5](https://pkg.so/de/brew/krb5/) - Shares pkgdb curated category or tags: cli, security. - [nettle](https://pkg.so/de/brew/nettle/) - Shares pkgdb curated category or tags: cli, security. - [copa](https://pkg.so/de/brew/copa/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, management, security, vulnerability, vulnerability-management. ## Combined YAML source View the package source record on GitHub. [combined/vexctl.yml](https://github.com/mxcl/pkgdb/blob/main/combined/vexctl.yml) ## Quellen - pkg.so package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - pkgdb category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph