.gitignore
.pre-commit-config.yaml
.python-version
.readthedocs.yaml
.secrets.baseline
.tool-versions
AGENTS.md
CONTRIBUTING.md
LICENSE
Makefile
README.md
SECURITY.md
pyproject.toml
renovate.json
uv.lock
.github/CODEOWNERS
.github/workflows/ci.yml
.github/workflows/codeql.yml
.github/workflows/dependency-review.yml
.github/workflows/fuzz.yml
.github/workflows/pages.yml
.github/workflows/pre-commit.yml
.github/workflows/pypi.yml
.github/workflows/release-validation.yml
.github/workflows/release.yml
.github/workflows/scorecard.yml
.github/workflows/sync-style-guide.yml
docs/conf.py
docs/index.md
docs/assets/vexcalibur-banner.png
docs/assets/badges/ci.svg
docs/assets/badges/codeql.svg
docs/assets/badges/dependency-review.svg
docs/assets/badges/scorecard.svg
docs/development/ci.md
docs/development/fuzzing.md
docs/development/github-governance.md
docs/development/python-style.md
docs/examples/use_python_api.py
docs/explanation/architecture.md
docs/explanation/project-status.md
docs/explanation/self-release-evidence.md
docs/external/README.md
docs/external/google-python-style-guide.md
docs/how-to/build-release-evidence.md
docs/how-to/generate-csaf.md
docs/how-to/generate-cyclonedx-vex.md
docs/how-to/generate-openvex.md
docs/how-to/publish-to-pypi.md
docs/how-to/use-private-osv-mirror.md
docs/how-to/use-python-api.md
docs/reference/cli.md
docs/reference/csaf-output.md
docs/reference/cyclonedx-vex-output.md
docs/reference/local-findings.md
docs/reference/openvex-output.md
docs/reference/provider-contract.md
docs/reference/python-api.rst
docs/reference/release-evidence.md
docs/reference/renderer-contract.md
docs/tutorials/offline-local-findings.md
docs/tutorials/quickstart.md
release-evidence/README.md
release-evidence/findings.json
release-evidence/review.json
scripts/check-installed-cli.sh
scripts/check-installed-csaf.sh
scripts/check-release-evidence.sh
scripts/check_github_governance.py
scripts/generate-release-evidence.sh
scripts/install-locked-wheel.sh
scripts/next-release-tag.sh
scripts/normalize-sdist.py
scripts/prepare-local-release-tag.sh
scripts/release_evidence.py
scripts/run-atheris.sh
scripts/select-pypi-release-files.py
scripts/verify-dist-metadata.py
src/vexcalibur/__init__.py
src/vexcalibur/_version.py
src/vexcalibur/api.py
src/vexcalibur/cli.py
src/vexcalibur/csaf.py
src/vexcalibur/document.py
src/vexcalibur/domain.py
src/vexcalibur/errors.py
src/vexcalibur/generate.py
src/vexcalibur/github_sbom.py
src/vexcalibur/input_file.py
src/vexcalibur/json_boundary.py
src/vexcalibur/openvex.py
src/vexcalibur/py.typed
src/vexcalibur/render.py
src/vexcalibur/sbom.py
src/vexcalibur/source_options.py
src/vexcalibur/url_policy.py
src/vexcalibur/vex.py
src/vexcalibur.egg-info/PKG-INFO
src/vexcalibur.egg-info/SOURCES.txt
src/vexcalibur.egg-info/dependency_links.txt
src/vexcalibur.egg-info/entry_points.txt
src/vexcalibur.egg-info/requires.txt
src/vexcalibur.egg-info/scm_file_list.json
src/vexcalibur.egg-info/scm_version.json
src/vexcalibur.egg-info/top_level.txt
src/vexcalibur/compat/__init__.py
src/vexcalibur/compat/vexy.py
src/vexcalibur/sources/__init__.py
src/vexcalibur/sources/local.py
src/vexcalibur/sources/osv.py
tests/__init__.py
tests/test_cli.py
tests/test_csaf.py
tests/test_document.py
tests/test_generate.py
tests/test_github_governance.py
tests/test_github_sbom.py
tests/test_input_file.py
tests/test_json_boundary.py
tests/test_local_findings.py
tests/test_normalize_sdist.py
tests/test_openvex.py
tests/test_osv_client.py
tests/test_osv_output_safety.py
tests/test_output_limits.py
tests/test_prepare_local_release_tag.py
tests/test_public_api.py
tests/test_release_evidence.py
tests/test_release_version.py
tests/test_release_workflow_security.py
tests/test_renovate_configuration.py
tests/test_sbom.py
tests/test_select_pypi_release_files.py
tests/test_verify_dist_metadata.py
tests/test_vex.py
tests/test_vexy_compat.py
tests/fixtures/findings/all-analysis-states.json
tests/fixtures/governance/expected.json
tests/fixtures/release-evidence/findings.json
tests/fixtures/release-evidence/review.json
tests/fixtures/sbom/cyclonedx-json-1.4-simple.json
tests/fixtures/sbom/cyclonedx-json-1.5-simple.json
tests/fixtures/sbom/cyclonedx-json-simple.json
tests/fixtures/sbom/cyclonedx-xml-1.4-simple.xml
tests/fixtures/sbom/cyclonedx-xml-1.5-simple.xml
tests/fixtures/sbom/cyclonedx-xml-simple.xml
tests/fixtures/schemas/README.md
tests/fixtures/schemas/csaf-2.0.schema.json
tests/fixtures/schemas/openvex-0.2.0.schema.json
tests/fixtures/vexy/legacy-config.yml
tests/fuzz/__init__.py
tests/fuzz/boundaries.py
tests/fuzz/conftest.py
tests/fuzz/fuzz_boundaries.py
tests/fuzz/test_boundaries.py
tests/fuzz/corpus/github/valid-spdx.json
tests/fuzz/corpus/identity/unicode.txt
tests/fuzz/corpus/json/deep-nesting.json
tests/fuzz/corpus/json/duplicate-key.json
tests/fuzz/corpus/local/valid-findings.json
tests/fuzz/corpus/osv/multi-page-query.json
tests/fuzz/corpus/osv/safe-query.json
tests/fuzz/corpus/osv/terminal-control.json
tests/fuzz/corpus/osv/valid-batch.json
tests/fuzz/corpus/osv/valid-get.json
tests/fuzz/corpus/osv/valid-gzip-query.json
tests/fuzz/corpus/sbom/forbidden-entity.xml
tests/fuzz/corpus/sbom/non-string-spec-version.json
tests/fuzz/corpus/sbom/valid-json.json
tests/fuzz/corpus/sbom/valid-xml.xml
tests/golden/csaf-vex-all-analysis-states.json
tests/golden/cyclonedx-vex-all-analysis-states.json
tests/golden/cyclonedx-vex-simple.json
tests/golden/openvex-vex-all-analysis-states.json
tests/golden/vexy-compat-cli.json
tests/integration/check_installed_cli.py
tests/integration/check_installed_csaf.py
tests/integration/csaf-validator/.npmrc
tests/integration/csaf-validator/README.md
tests/integration/csaf-validator/package-lock.json
tests/integration/csaf-validator/package.json
tests/integration/csaf-validator/validate.mjs
tests/integration/openvex-go/go.mod
tests/integration/openvex-go/go.sum
tests/integration/openvex-go/main.go