Create OpenVEX statements using vexctl to mark a CVE as not exploitable and merge VEX documents

Steps

1. Install vexctl; run vexctl create with the --product flag (PURL of the product), --vuln flag (CVE identifier), and --status not_affected and --justification flags to generate an OpenVEX JSON document.
2. Review the generated OpenVEX document structure: a statements array with subject (your product PURL), vulnerability, status, and optionally a justification and impact_statement field.
3. To add a second statement or update an existing one, use vexctl add or re-run vexctl create and merge the resulting documents with vexctl merge to produce a canonical merged VEX file (verify subcommand names in current vexctl docs).
4. Sign the merged VEX document using cosign sign-blob or attach it as an attestation to the container image so consumers can verify its authenticity.
5. Provide the OpenVEX file to Trivy using --vex to filter scan results and confirm that the CVE is suppressed from the output.