bitvex 0.2.7

Automate CRA compliance: generate OpenVEX reports from Yocto SBOMs by filtering CVEs with kernel config and device tree analysis
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34

//! # BitVex
//!
//! Automated CRA (Cyber Resilience Act) compliance tool for embedded Linux.
//!
//! BitVex generates spec-compliant OpenVEX reports from Yocto build artifacts
//! by filtering CVEs against actual hardware configuration.
//!
//! ## Features
//!
//! - **Hardware-aware CVE filtering** — kernel config, device tree, U-Boot filters
//! - **EPSS integration** — exploit prediction scoring from FIRST.org
//! - **Rules engine** — custom filtering via `bitvex.toml`
//! - **Offline mode** — scan without internet using local databases
//! - **Multi-format output** — OpenVEX JSON-LD and SARIF 2.1.0
//!
//! ## Quick Start
//!
//! ```rust,no_run
//! use bitvex::sbom::parse_spdx_sbom;
//!
//! let data = std::fs::read("path/to/spdx.json").unwrap();
//! let packages = parse_spdx_sbom(&data).unwrap();
//! println!("Found {} packages", packages.len());
//! ```

pub mod cli;
pub mod epss;
pub mod filters;
pub mod osv;
pub mod output;
pub mod pipeline;
pub mod rules;
pub mod sbom;
pub mod vex;