Investigation of VEX Usage in OpenSource Repositories

Sammanfattning

In this thesis we explore how VEX is used in open source software projects. We created our own dataset from GitHub to get a complete picture of how the usage of VEX manifests in open source software. Our findings show that CycloneDX is the most widespread specification but CSAF has the greatest number of files. We also explore how VEX files are maintained over time by looking at their commit history determining that the specifications vary between weeks to multiple months between updates, and metadata being one of the common factors that is maintained across all the specifications. Our conclusions are that VEX usage is not widespread as of yet outside of certain large repositories and that vulnerabilities are distributed across multiple files instead of being consolidated.