Weaving a VEX Feed Through the Kubernetes Project
Talkat KubeCon + CloudNativeCon Europe 2025 · on Thursday, 2025-04-03· at 17:30· Level 1 | Hall Entrance S10 | Room C·
summary
Kubernetes publishes a machine-readable VEX feed that combines three sources: maintainer assessments turned into signed OpenVEX attestations via a Vexflow GitHub issue bot, automated go v check openvex output, and advisories/OSV-backed data; tooling assembles these statements into a single feed and can attach attestations to GitHub and registries. Demo shows Vexflow opening issues, capturing maintainer slash-command assessments, signing attestations and assembling documents; most steps run end-to-end though live demo timing and network steps require care.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:08What is VEX
- 5:21VEX flavors and OpenVEX
- 6:24Why VEX matters with CRA
- 8:11Challenges in Kubernetes
- 10:02Kubernetes VEX plan
- 15:03Introducing Vexflow
- 18:13Demo: Insult Connector 2000
- 20:48Demo: Vexflow for CRA compliance
- 24:17Demo: VEX with Go Vuln
- 25:45Summary
related talks
27mWeaving a VEX Feed Through the Kubernetes Project
19mFinally! Automated End-to-End VEX Streams You Can Trust
12mKeynote: We’re VEXing the Cloud Native Landscape. Bring Your Code!
24mEmbracing the Era of Transparency: Automating VEX Application for Scalable, Context-Aware Security
45mVEXing Open Source Security: Vulnerability Data for Everything
50mDemocratizing Exploitability Data with OpenVEX
30mDistribution Builders Meet VEX
48m5 Steps to VEX Success: Managing the End-to-End Workflow