The Unreasonable Effectiveness of VEX in NixOS
Summary
The Unreasonable Effectiveness of VEX in NixOS analyzes how SBOM-based vulnerability scanning and the Vulnerability Exploitability eXchange (VEX) workflow can be automated to triage CVEs at scale. It demonstrates practical tooling (SBOM generation with Syft, vulnerability scanning with Grype, and govulncheck for reachability) and introduces nixos-vex to codify not-affected CVEs within a NixOS configuration. The article combines theory with concrete examples, showing how to reduce manual triage effort across systems and OS configurations.