.gitignore
.pre-commit-config.yaml
.python-version
.readthedocs.yaml
.secrets.baseline
.tool-versions
AGENTS.md
CONTRIBUTING.md
LICENSE
Makefile
README.md
SECURITY.md
pyproject.toml
uv.lock
.github/CODEOWNERS
.github/dependabot.yml
.github/workflows/ci.yml
.github/workflows/codeql.yml
.github/workflows/dependency-review.yml
.github/workflows/pages.yml
.github/workflows/pre-commit.yml
.github/workflows/pypi.yml
.github/workflows/release-validation.yml
.github/workflows/release.yml
.github/workflows/scorecard.yml
.github/workflows/sync-style-guide.yml
docs/conf.py
docs/index.md
docs/assets/vexcalibur-banner.png
docs/assets/badges/ci.svg
docs/assets/badges/codeql.svg
docs/assets/badges/dependency-review.svg
docs/assets/badges/scorecard.svg
docs/development/ci.md
docs/development/github-governance.md
docs/development/python-style.md
docs/explanation/architecture.md
docs/explanation/project-status.md
docs/external/README.md
docs/external/google-python-style-guide.md
docs/how-to/generate-csaf.md
docs/how-to/generate-cyclonedx-vex.md
docs/how-to/generate-openvex.md
docs/how-to/publish-to-pypi.md
docs/how-to/use-private-osv-mirror.md
docs/reference/cli.md
docs/reference/csaf-output.md
docs/reference/cyclonedx-vex-output.md
docs/reference/local-findings.md
docs/reference/openvex-output.md
docs/reference/provider-contract.md
docs/reference/python-api.rst
docs/tutorials/offline-local-findings.md
docs/tutorials/quickstart.md
scripts/check-installed-cli.sh
scripts/check-installed-csaf.sh
scripts/check_github_governance.py
scripts/install-locked-wheel.sh
scripts/next-release-tag.sh
scripts/verify-dist-metadata.py
src/vexcalibur/__init__.py
src/vexcalibur/_version.py
src/vexcalibur/cli.py
src/vexcalibur/csaf.py
src/vexcalibur/document.py
src/vexcalibur/domain.py
src/vexcalibur/errors.py
src/vexcalibur/generate.py
src/vexcalibur/github_sbom.py
src/vexcalibur/input_file.py
src/vexcalibur/json_boundary.py
src/vexcalibur/openvex.py
src/vexcalibur/py.typed
src/vexcalibur/render.py
src/vexcalibur/sbom.py
src/vexcalibur/source_options.py
src/vexcalibur/url_policy.py
src/vexcalibur/vex.py
src/vexcalibur.egg-info/PKG-INFO
src/vexcalibur.egg-info/SOURCES.txt
src/vexcalibur.egg-info/dependency_links.txt
src/vexcalibur.egg-info/entry_points.txt
src/vexcalibur.egg-info/requires.txt
src/vexcalibur.egg-info/scm_file_list.json
src/vexcalibur.egg-info/scm_version.json
src/vexcalibur.egg-info/top_level.txt
src/vexcalibur/compat/__init__.py
src/vexcalibur/compat/vexy.py
src/vexcalibur/sources/__init__.py
src/vexcalibur/sources/local.py
src/vexcalibur/sources/osv.py
tests/test_cli.py
tests/test_csaf.py
tests/test_document.py
tests/test_generate.py
tests/test_github_governance.py
tests/test_github_sbom.py
tests/test_input_file.py
tests/test_json_boundary.py
tests/test_local_findings.py
tests/test_openvex.py
tests/test_osv_client.py
tests/test_osv_output_safety.py
tests/test_output_limits.py
tests/test_release_version.py
tests/test_release_workflow_security.py
tests/test_sbom.py
tests/test_verify_dist_metadata.py
tests/test_vex.py
tests/test_vexy_compat.py
tests/fixtures/findings/all-analysis-states.json
tests/fixtures/governance/expected.json
tests/fixtures/sbom/cyclonedx-json-1.4-simple.json
tests/fixtures/sbom/cyclonedx-json-1.5-simple.json
tests/fixtures/sbom/cyclonedx-json-simple.json
tests/fixtures/sbom/cyclonedx-xml-1.4-simple.xml
tests/fixtures/sbom/cyclonedx-xml-1.5-simple.xml
tests/fixtures/sbom/cyclonedx-xml-simple.xml
tests/fixtures/schemas/README.md
tests/fixtures/schemas/csaf-2.0.schema.json
tests/fixtures/schemas/openvex-0.2.0.schema.json
tests/fixtures/vexy/legacy-config.yml
tests/golden/csaf-vex-all-analysis-states.json
tests/golden/cyclonedx-vex-all-analysis-states.json
tests/golden/cyclonedx-vex-simple.json
tests/golden/openvex-vex-all-analysis-states.json
tests/golden/vexy-compat-cli.json
tests/integration/check_installed_cli.py
tests/integration/check_installed_csaf.py
tests/integration/csaf-validator/.npmrc
tests/integration/csaf-validator/README.md
tests/integration/csaf-validator/package-lock.json
tests/integration/csaf-validator/package.json
tests/integration/csaf-validator/validate.mjs
tests/integration/openvex-go/go.mod
tests/integration/openvex-go/go.sum
tests/integration/openvex-go/main.go