Repository: anchore/grype (Go)

Issue:
vex documents from the --vex flag do get processed or applied to the output correctly
**What happened**:

When following the example [here](https://github.com/anchore/grype?tab=readme-ov-file#vex-support) using the vex document specified, the vulnerability is rendered in the outputted report. This happens in any format.

vex.json
```json
{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://openvex.dev/docs/public/vex-d4e9020b6d0d26f131d535e055902dd6ccf3e2088bce3079a8cd3588a4b14c78",
  "author": "A Grype User <jdoe@example.com>",
  "timestamp": "2023-07-17T18:28:47.696004345-06:00",
  "version": 1,
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2023-1255"
      },
      "products": [
        {
          "@id": "pkg:oci/alpine@sha256%3A124c7d2707904eea7431fffe91522a01e5a861a624ee31d03372cc1d138a3126",
          "subcomponents": [
            { "@id": "pkg:apk/alpine/libssl3@3.0.8-r3" },
            { "@id": "pkg:apk/alpine/libcrypto3@3.0.8-r3" }
          ]
        }
      ],
      "status": "fixed"
    }
  ]
}
```
command
```bash
docker run -it -v $PWD/vex.json:/vex.json  anchore/grype alpine@sha256:124c7d2707904eea7431fffe91522a01e5a861a624ee31d03372cc1d138a3126 --vex /vex.json
 ✔ Vulnerability DB                [updated]  
 ✔ Parsed image                                         sha256:51e60588ff2cd9f45792b23de89bfface0a7fbd711d17c5f5ce900a4f6b16260
 ✔ Cataloged contents                                          b5a5b7ce4eabc8414bf367761a28f4e8b16952ce5de537c15ed917b71b245f11
   ├── ✔ Packages                        [15 packages]  
   ├── ✔ File digests                    [78 files]  
   ├── ✔ File metadata                   [78 locations]  
   └── ✔ Executables                     [17 executables]  
 ✔ Scanned for vulnerabilities     [22 vulnerability matches]  
   ├── by severity: 0 critical, 2 high, 16 medium, 0 low, 0 negligible (4 unknown)
   └── by status:   22 fixed, 0 not-fixed, 0 ignored 
NAME        INSTALLED  FIXED-IN   TYPE  VULNERABILITY  SEVERITY 
...
libcrypto3  3.0.8-r3   3.0.8-r4   apk   CVE-2023-1255  Medium  
...
```

vexctl filter works
```grype alpine@sha256:124c7d2707904eea7431fffe91522a01e5a861a624ee31d03372cc1d138a3126 --output sarif | vexctl filter - vex.json | jq '.runs[].results[].ruleId'  | grep 1255; echo $?
1
```


**What you expected to happen**:

I do not expect the vulnerability to be reported.
Maybe I am missing something here?

**How to reproduce it (as minimally and precisely as possible)**:
see above
**Anything else we need to know?**:

**Environment**:
- Output of `grype version`: 0.77.1
- OS (e.g: `cat /etc/os-release` or similar): mac/linux - tested both




Discussion:
Hi @willejs, thank you for the report, we've reproduced this issue on the latest Grype, 0.77.2:

Without vex (CVE-2023-1255 shows up):

```
tgerla@Timothys-MacBook-Pro-2 grype-1836 % grype alpine@sha256:124c7d2707904eea7431fffe91522a01e5a861a624ee31d03372cc1d138a3126

 ✔ Vulnerability DB                [no update available]
 ✔ Parsed image                                        sha256:51e60588ff2cd9f45792b23de89bfface0a7fbd711d17c5f5ce900a4f6b16260
 ✔ Cataloged contents                                         b5a5b7ce4eabc8414bf367761a28f4e8b16952ce5de537c15ed917b71b245f11
   ├── ✔ Packages                        [15 packages]
   ├── ✔ File digests                    [78 files]
   ├── ✔ File metadata                   [78 locations]
   └── ✔ Executables                     [17 executables]
 ✔ Scanned for vulnerabilities     [22 vulnerability matches]
   ├── by severity: 0 critical, 2 high, 16 medium, 0 low, 0 negligible (4 unknown)
   └── by status:   22 fixed, 0 not-fixed, 0 ignored
NAME        INSTALLED  FIXED-IN   TYPE  VULNERABILITY  SEVERITY
libcrypto3  3.0.8-r3   3.0.12-r0  apk   CVE-2023-5363  High
libcrypto3  3.0.8-r3   3.0.12-r4  apk   CVE-2024-0727  Medium
libcrypto3  3.0.8-r3   3.0.12-r2  apk   CVE-2023-6129  Medium
libcrypto3  3.0.8-r3   3.0.12-r1  apk   CVE-2023-5678  Medium
libcrypto3  3.0.8-r3   3.0.10-r0  apk   CVE-2023-3817  Medium
libcrypto3  3.0.8-r3   3.0.9-r3   apk   CVE-2023-3446  Medium
libcrypto3  3.0.8-r3   3.0.9-r2   apk   CVE-2023-2975  Medium
libcrypto3  3.0.8-r3   3.0.9-r0   apk   CVE-2023-2650  Medium
libcrypto3  3.0.8-r3   3.0.8-r4   apk   CVE-2023-1255  Medium
libcrypto3  3.0.8-r3   3.0.12-r5  apk   CVE-2024-2511  Unknown
libcrypto3  3.0.8-r3   3.0.12-r3  apk   CVE-2023-6237  Unknown
libssl3     3.0.8-r3   3.0.12-r0  apk   CVE-2023-5363  High
libssl3     3.0.8-r3   3.0.12-r4  apk   CVE-2024-0727  Medium
libssl3     3.0.8-r3   3.0.12-r2  apk   CVE-2023-6129  Medium
libssl3     3.0.8-r3   3.0.12-r1  apk   CVE-2023-5678  Medium
libssl3     3.0.8-r3   3.0.10-r0  apk   CVE-2023-3817  Medium
libssl3     3.0.8-r3   3.0.9-r3   apk   CVE-2023-3446  Medium
libssl3     3.0.8-r3   3.0.9-r2   apk   CVE-2023-2975  Medium
libssl3     3.0.8-r3   3.0.9-r0   apk   CVE-2023-2650  Medium
libssl3     3.0.8-r3   3.0.8-r4   apk   CVE-2023-1255  Medium
libssl3     3.0.8-r3   3.0.12-r5  apk   CVE-2024-2511  Unknown
libssl3     3.0.8-r3   3.0.12-r3  apk   CVE-2023-6237  Unknown
```

With vex (CVE-2023-1255 shows up):

```
tgerla@Timothys-MacBook-Pro-2 grype-1836 % grype alpine@sha256:124c7d2707904eea7431fffe91522a01e5a861a624ee31d03372cc1d138a3126
--vex vex.json
 ✔ Vulnerability DB                [no update available]
 ✔ Parsed image                                        sha256:51e60588ff2cd9f45792b23de89bfface0a7fbd711d17c5f5ce900a4f6b16260
 ✔ Cataloged contents                                         b5a5b7ce4eabc8414bf367761a28f4e8b16952ce5de537c15ed917b71b245f11
   ├── ✔ Packages                        [15 packages]
   ├── ✔ File digests                    [78 files]
   ├── ✔ File metadata                   [78 locations]
   └── ✔ Executables                     [17 executables]
 ✔ Scanned for vulnerabilities     [22 vulnerability matches]
   ├── by severity: 0 critical, 2 high, 16 medium, 0 low, 0 negligible (4 unknown)
   └── by status:   22 fixed, 0 not-fixed, 0 ignored
NAME        INSTALLED  FIXED-IN   TYPE  VULNERABILITY  SEVERITY
libcrypto3  3.0.8-r3   3.0.12-r0  apk   CVE-2023-5363  High
libcrypto3  3.0.8-r3   3.0.12-r4  apk   CVE-2024-0727  Medium
libcrypto3  3.0.8-r3   3.0.12-r2  apk   CVE-2023-6129  Medium
libcrypto3  3.0.8-r3   3.0.12-r1  apk   CVE-2023-5678  Medium
libcrypto3  3.0.8-r3   3.0.10-r0  apk   CVE-2023-3817  Medium
libcrypto3  3.0.8-r3   3.0.9-r3   apk   CVE-2023-3446  Medium
libcrypto3  3.0.8-r3   3.0.9-r2   apk   CVE-2023-2975  Medium
libcrypto3  3.0.8-r3   3.0.9-r0   apk   CVE-2023-2650  Medium
libcrypto3  3.0.8-r3   3.0.8-r4   apk   CVE-2023-1255  Medium
libcrypto3  3.0.8-r3   3.0.12-r5  apk   CVE-2024-2511  Unknown
libcrypto3  3.0.8-r3   3.0.12-r3  apk   CVE-2023-6237  Unknown
libssl3     3.0.8-r3   3.0.12-r0  apk   CVE-2023-5363  High
libssl3     3.0.8-r3   3.0.12-r4  apk   CVE-2024-0727  Medium
libssl3     3.0.8-r3   3.0.12-r2  apk   CVE-2023-6129  Medium
libssl3     3.0.8-r3   3.0.12-r1  apk   CVE-2023-5678  Medium
libssl3     3.0.8-r3   3.0.10-r0  apk   CVE-2023-3817  Medium
libssl3     3.0.8-r3   3.0.9-r3   apk   CVE-2023-3446  Medium
libssl3     3.0.8-r3   3.0.9-r2   apk   CVE-2023-2975  Medium
libssl3     3.0.8-r3   3.0.9-r0   apk   CVE-2023-2650  Medium
libssl3     3.0.8-r3   3.0.8-r4   apk   CVE-2023-1255  Medium
libssl3     3.0.8-r3   3.0.12-r5  apk   CVE-2024-2511  Unknown
libssl3     3.0.8-r3   3.0.12-r3  apk   CVE-2023-6237  Unknown
tgerla@Timothys-MacBook-Pro-2 grype-1836 %
```

On Grype 0.74.7, the CVE was filtered out as expected. We will take a look and see where the regression occurred. Thanks again!
I'm trying to use the VEX feature and it's not working even with version 0.74.7 and 0.74.3...
Never mind, it seems that the issue I'm having is due to a matching issue. I'll work on a fix and submit a PR soon.
@tgerla thanks for investigating this and the swift reply! 
We are contemplating fixing this, but we were made aware of some other bugs around the format of the PURL, and also there are a couple of big PRs with large refactors waiting to be merged [over here ](https://github.com/anchore/grype/pulls?q=is%3Apr+is%3Aopen+vex) changing the implementation of vex support. Is there some wider context we are missing here and have you guys got some plans to overhaul the vex implimentation/support? If so we will hold off for a bit!

We were looking at a commercial offering, but we have fallen at the first hurdle with vex support...
I was investigating why Grype stopped processing VEX documents generated by Kubescape.
It boiled down to this line of code:
https://github.com/anchore/grype/blob/368fd73fc238492ecfe17eaee3b491cd89faf88c/grype/vex/openvex/implementation.go#L166
Based on my investigation, there are two problems here.
* Matcher uses `index.docker.io` as the registry name and the VEX document contains `docker.io` for the same field, therefore the comparison fails.
* The second problem is Kubescape uses standard URL encoding protocol in the pURL where according the the [RFC](https://datatracker.ietf.org/doc/html/rfc3986#section-7.3) one should encode the special characters in the query parameter contents. I suggest that either Grype or go-vex do a URL decode operation.

@puerco great keynote this morning BTW 😀 Go OpenVEX!
Is this still an issue? I can't get the vex file to be taken into account in any way.
A bit more on this: The only way I got it working was adding specific ignore rules on Grype configuration before running a scan with a VEX file.

Just modify the `ignore` rule with for example status `not_affected`, run the scan again and got it to work.
```
ignore:
  - vex-status: not_affected
```

Is this how is suppose to be used? A part from providing the VEX file, stating what should be ignored in Grype configuration?
@javirln, it is still an issue, see my comments above.
Im trying grype with vex and see same issue.
1.  Check Grype version
```
grype version
Application:         grype
Version:             0.92.2
BuildDate:           2025-05-21T00:41:41Z
GitCommit:           3f52c46d440ac17b2924c633826ce8fd30a5e16d
GitDescription:      v0.92.2
Platform:            darwin/arm64
GoVersion:           go1.24.3
Compiler:            gc
Syft Version:        v1.26.0
Supported DB Schema: 6
```
2. Check vexctl version
```
vexctl version
 _   _  _____ __   __ _____  _____  _
| | | ||  ___|\ \ / //  __ \|_   _|| |
| | | || |__   \ V / | /  \/  | |  | |
| | | ||  __|  /   \ | |      | |  | |
\ \_/ /| |___ / /^\ \| \__/\  | |  | |____
 \___/ \____/ \/   \/ \____/  \_/  \_____/
vexctl: A tool for working with VEX data

GitVersion:    0.3.0
GitCommit:     Homebrew
GitTreeState:  clean
BuildDate:     2024-09-10T01:45:26Z
GoVersion:     go1.23.4
Compiler:      gc
Platform:      darwin/arm64
```

3. scan with Grype  amazoncorretto:8u452-al2023-jre
```
grype amazoncorretto:8u452-al2023-jre
 ✔ Loaded image                                                                                                                     amazoncorretto:8u452-al2023-jre
 ✔ Parsed image                                                                             sha256:b3297d0f1801315845dd280ec88ac39e7cb0fc1a3c2f30c1b490a806ef1d33c8
 ✔ Cataloged contents                                                                              82153056ce0d08cf26e34018edefe97c4f4e3e53633c66ca5e0cc25a9b23ec3c
   ├── ✔ Packages                        [364 packages]
   ├── ✔ File metadata                   [17,943 locations]
   ├── ✔ File digests                    [17,943 files]
   └── ✔ Executables                     [1,275 executables]
 ✔ Scanned for vulnerabilities     [4 vulnerability matches]
   ├── by severity: 0 critical, 0 high, 4 medium, 0 low, 0 negligible
   └── by status:   4 fixed, 0 not-fixed, 0 ignored
NAME                    INSTALLED              FIXED-IN               TYPE  VULNERABILITY  SEVERITY  EPSS%  RISK
glibc                   2.34-117.amzn2023.0.1  2.34-181.amzn2023.0.1  rpm   ALAS-2025-988  Medium    52.26  < 0.1
glibc-common            2.34-117.amzn2023.0.1  2.34-181.amzn2023.0.1  rpm   ALAS-2025-988  Medium    52.26  < 0.1
glibc-minimal-langpack  2.34-117.amzn2023.0.1  2.34-181.amzn2023.0.1  rpm   ALAS-2025-988  Medium    52.26  < 0.1
libtasn1                4.19.0-1.amzn2023.0.4  4.19.0-1.amzn2023.0.5  rpm   ALAS-2025-989  Medium    29.45  < 0.1
```
4. Generate vex for one vuln
```
vexctl create \
  --product "pkg:oci/amazoncorretto@8u452-al2023-jre" \
  --subcomponents "pkg:rpm/amzn/glibc-common@2.34-117.amzn2023.0.1" \
  --vuln "ALAS-2025-988" \
  --status "not_affected" \
  --justification "inline_mitigations_already_exist" \
  > vex.json
```
5. scan by Grype with vex
```
grype amazoncorretto:8u452-al2023-jre --vex=vex.json

 ✔ Parsed image                                                                             sha256:4cdf2f1301fef9f9ad933a07148e3f8fbfdffd2c20ec82bf4c3be96cd75aa85e
 ✔ Cataloged contents                                                                              39be40107d3655ce7165ebfaa90f5d24b88af62cdd9c087026aed22a8b92dfaa
   ├── ✔ Packages                        [170 packages]
   ├── ✔ File metadata                   [6,238 locations]
   ├── ✔ File digests                    [6,238 files]
   └── ✔ Executables                     [436 executables]
 ✔ Scanned for vulnerabilities     [4 vulnerability matches]
   ├── by severity: 0 critical, 0 high, 4 medium, 0 low, 0 negligible
   └── by status:   4 fixed, 0 not-fixed, 0 ignored
NAME                    INSTALLED              FIXED-IN               TYPE  VULNERABILITY  SEVERITY  EPSS%  RISK
glibc                   2.34-117.amzn2023.0.1  2.34-181.amzn2023.0.1  rpm   ALAS-2025-988  Medium    52.26  < 0.1
glibc-common            2.34-117.amzn2023.0.1  2.34-181.amzn2023.0.1  rpm   ALAS-2025-988  Medium    52.26  < 0.1
glibc-minimal-langpack  2.34-117.amzn2023.0.1  2.34-181.amzn2023.0.1  rpm   ALAS-2025-988  Medium    52.26  < 0.1
libtasn1                4.19.0-1.amzn2023.0.4  4.19.0-1.amzn2023.0.5  rpm   ALAS-2025-989  Medium    29.45  < 0.1
```

`glibc-common`  is still in result.

Run with config like this one
```
ignore:
  - vulnerability: ALAS-2025-988
    fix-state: unknown
    # VEX fields apply when Grype reads vex data:
    vex-status: not_affected
    vex-justification: vulnerable_code_not_present
    package:
      name: glibc
      version: 2.34-117.amzn2023.0.1
      type: rpm
```
doesn't work either
```
grype amazoncorretto:8u452-al2023-jre -c=~/.grype.yaml
 ✔ Parsed image                                                                             sha256:4cdf2f1301fef9f9ad933a07148e3f8fbfdffd2c20ec82bf4c3be96cd75aa85e
 ✔ Cataloged contents                                                                              39be40107d3655ce7165ebfaa90f5d24b88af62cdd9c087026aed22a8b92dfaa
   ├── ✔ Packages                        [170 packages]
   ├── ✔ File metadata                   [6,238 locations]
   ├── ✔ File digests                    [6,238 files]
   └── ✔ Executables                     [436 executables]
 ✔ Scanned for vulnerabilities     [4 vulnerability matches]
   ├── by severity: 0 critical, 0 high, 4 medium, 0 low, 0 negligible
   └── by status:   4 fixed, 0 not-fixed, 0 ignored
NAME                    INSTALLED              FIXED-IN               TYPE  VULNERABILITY  SEVERITY  EPSS%  RISK
glibc                   2.34-117.amzn2023.0.1  2.34-181.amzn2023.0.1  rpm   ALAS-2025-988  Medium    52.26  < 0.1
glibc-common            2.34-117.amzn2023.0.1  2.34-181.amzn2023.0.1  rpm   ALAS-2025-988  Medium    52.26  < 0.1
glibc-minimal-langpack  2.34-117.amzn2023.0.1  2.34-181.amzn2023.0.1  rpm   ALAS-2025-988  Medium    52.26  < 0.1
libtasn1                4.19.0-1.amzn2023.0.4  4.19.0-1.amzn2023.0.5  rpm   ALAS-2025-989  Medium    29.45  < 0.1
``` 
but it works fine if to remove `vex` part from config
```
ignore:
  - vulnerability: ALAS-2025-988
    fix-state: unknown
    package:
      name: glibc
      version: 2.34-117.amzn2023.0.1
      type: rpm
```
result
```
grype amazoncorretto:8u452-al2023-jre -c=~/.grype.yaml
 ✔ Parsed image                                                                             sha256:4cdf2f1301fef9f9ad933a07148e3f8fbfdffd2c20ec82bf4c3be96cd75aa85e
 ✔ Cataloged contents                                                                              39be40107d3655ce7165ebfaa90f5d24b88af62cdd9c087026aed22a8b92dfaa
   ├── ✔ Packages                        [170 packages]
   ├── ✔ File metadata                   [6,238 locations]
   ├── ✔ File digests                    [6,238 files]
   └── ✔ Executables                     [436 executables]
 ✔ Scanned for vulnerabilities     [3 vulnerability matches]
   ├── by severity: 0 critical, 0 high, 4 medium, 0 low, 0 negligible
   └── by status:   4 fixed, 0 not-fixed, 1 ignored
NAME                    INSTALLED              FIXED-IN               TYPE  VULNERABILITY  SEVERITY  EPSS%  RISK
glibc-common            2.34-117.amzn2023.0.1  2.34-181.amzn2023.0.1  rpm   ALAS-2025-988  Medium    52.26  < 0.1
glibc-minimal-langpack  2.34-117.amzn2023.0.1  2.34-181.amzn2023.0.1  rpm   ALAS-2025-988  Medium    52.26  < 0.1
libtasn1                4.19.0-1.amzn2023.0.4  4.19.0-1.amzn2023.0.5  rpm   ALAS-2025-989  Medium    29.45  < 0.1
```
Hi all,

It looks like there was a bug where default default ignore rules were were causing us not to enter the if statement at 

https://github.com/anchore/grype/blob/34304db156ac304beaa8cd02e8c37ee18384433c/cmd/grype/cli/commands/root.go#L405-L407

#2741 changes this if statement so that default vex ignore rules (that is, suppressing anything vex documents show as "fixed" or "not_affected") will be added even if other ignore rules are configured.
Hi

i still see the same with scenario

```
grype --version
grype 0.96.0

 grype amazoncorretto:8u452-al2023-jre
 ✔ Parsed image                                                                                                                  sha256:079c8a6b3899bf68eef6850bb264397423bad47dca741a01efe3e59c3ad69838
 ✔ Cataloged contents                                                                                                                   ed481be3da4c9b96d05b682dd0ffe0439214866a158012a83ba50c49854ec4e0
   ├── ✔ Packages                        [170 packages]
   ├── ✔ Executables                     [436 executables]
   ├── ✔ File metadata                   [6,243 locations]
   └── ✔ File digests                    [6,243 files]
 ✔ Scanned for vulnerabilities     [2 vulnerability matches]
   ├── by severity: 0 critical, 1 high, 1 medium, 0 low, 0 negligible
   └── by status:   2 fixed, 0 not-fixed, 0 ignored
NAME               INSTALLED               FIXED IN                TYPE  VULNERABILITY       SEVERITY  EPSS           RISK
glib2              2.82.2-765.amzn2023     2.82.2-766.amzn2023     rpm   ALAS2023-2025-1069  High      < 0.1% (24th)  < 0.1
python3-pip-wheel  21.3.1-2.amzn2023.0.11  21.3.1-2.amzn2023.0.12  rpm   ALAS2023-2025-1058  Medium    < 0.1% (1st)   < 0.1
```
create vex
```
vexctl create \
  --product "pkg:oci/amazoncorretto@8u452-al2023-jre" \
  --subcomponents "pkg:rpm/amzn/glib2@2.82.2-765.amzn2023" \
  --vuln "ALAS2023-2025-1069" \
  --status "not_affected" \
  --justification "inline_mitigations_already_exist" \
  > vex.json
```
run grype with vex
```
grype amazoncorretto:8u452-al2023-jre --vex=vex.json
 ✔ Parsed image                                                                                                                  sha256:079c8a6b3899bf68eef6850bb264397423bad47dca741a01efe3e59c3ad69838
 ✔ Cataloged contents                                                                                                                   ed481be3da4c9b96d05b682dd0ffe0439214866a158012a83ba50c49854ec4e0
   ├── ✔ Packages                        [170 packages]
   ├── ✔ Executables                     [436 executables]
   ├── ✔ File metadata                   [6,243 locations]
   └── ✔ File digests                    [6,243 files]
 ✔ Scanned for vulnerabilities     [2 vulnerability matches]
   ├── by severity: 0 critical, 1 high, 1 medium, 0 low, 0 negligible
   └── by status:   2 fixed, 0 not-fixed, 0 ignored
NAME               INSTALLED               FIXED IN                TYPE  VULNERABILITY       SEVERITY  EPSS           RISK
glib2              2.82.2-765.amzn2023     2.82.2-766.amzn2023     rpm   ALAS2023-2025-1069  High      < 0.1% (24th)  < 0.1
python3-pip-wheel  21.3.1-2.amzn2023.0.11  21.3.1-2.amzn2023.0.12  rpm   ALAS2023-2025-1058  Medium    < 0.1% (1st)   < 0.1
```

what am i doing wrong ?
Thank you in advance
Thanks for the report @ViacheslavKudinov!

Can you re-test with the output from this vexctl command?

``` sh
vexctl create \
  --product "pkg:oci/amazoncorretto@sha256:59559500a04f0a0a27db0e9ae9be7c854cc799bfda954769a20594ff2fd64791" \
  --subcomponents "pkg:rpm/amzn/glib2@2.82.2-765.amzn2023" \
  --vuln "ALAS2023-2025-1069" \
  --status "not_affected" \
  --justification "inline_mitigations_already_exist" > vex-sha.json
```

If you wish to provide only a tag, the resulting PURL is not technically spec compliant I think (lacks required `version` component) but seems to work with grype as well. 

``` sh
vexctl create \
    --product "pkg:oci/amazoncorretto?tag=8u452-al2023-jre" \
    --subcomponents "pkg:rpm/amzn/glib2@2.82.2-765.amzn2023" \
    --vuln "ALAS2023-2025-1069" \
    --status "not_affected" \
    --justification "inline_mitigations_already_exist" \
    > ./vex-tag.json
```

both the resulting vex documents work for me: 

``` sh
# no vex doc, suppressed vuln is found, as expected
$ grype -q amazoncorretto:8u452-al2023-jre | grep ALAS2023-2025-1069
glib2                     2.82.2-765.amzn2023     2.82.2-766.amzn2023     rpm   ALAS2023-2025-1069  High      < 0.1% (24th)  < 0.1
# no output with vex tag or vex sha
$ grype -q amazoncorretto:8u452-al2023-jre --vex vex-tag.json | grep ALAS2023-2025-1069
$ grype -q amazoncorretto:8u452-al2023-jre --vex vex-sha.json | grep ALAS2023-2025-1069
```

If this still does not work for you, please open a new issue - OP's vex document works fine, so this issue should stay closed. Thanks!


Thanks for the reply.
I will create another issue as i still got same result and vex file is "ignored".
Oh, it is odd but while was creating the new issue i couldn't reproduce.
But i started from deletion of the local image.
Seems, it works.
Sorry for disturbance, probably something was wrong on my side when i done it 40 minutes ago.

Thank you for the fix!
@willmurphyscode I have opened another issue regarding the registry naming issue since it was not solved: https://github.com/anchore/grype/issues/2818



Patch:
diff --git a/.github/workflows/validations.yaml b/.github/workflows/validations.yaml
index 75c3340bff5..a13771538c4 100644
--- a/.github/workflows/validations.yaml
+++ b/.github/workflows/validations.yaml
@@ -280,6 +280,6 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
 
       - name: Delete snapshot cache
-        run: gh cache delete "snapshot-build-${{ github.run_id }}"
+        run: gh cache delete "snapshot-build-${{ github.run_id }}" || echo "Cache deletion failed or cache not found - continuing"
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/cmd/grype/cli/commands/root.go b/cmd/grype/cli/commands/root.go
index 937797e04c5..8d845197ebf 100644
--- a/cmd/grype/cli/commands/root.go
+++ b/cmd/grype/cli/commands/root.go
@@ -173,7 +173,6 @@ func runGrype(app clio.Application, opts *options.Grype, userInput string) (errs
 			return nil
 		},
 	)
-
 	if err != nil {
 		return err
 	}
@@ -402,7 +401,9 @@ func validateRootArgs(cmd *cobra.Command, args []string) error {
 }
 
 func applyVexRules(opts *options.Grype) error {
-	if len(opts.Ignore) == 0 && len(opts.VexDocuments) > 0 {
+	// If any vex documents are provided, assume the user intends to ignore vulnerabilities that those
+	// vex documents list as "fixed" or "not_affected".
+	if len(opts.VexDocuments) > 0 {
 		opts.Ignore = append(opts.Ignore, ignoreVEXFixedNotAffected...)
 	}
 


Test patch:
diff --git a/cmd/grype/cli/commands/root_test.go b/cmd/grype/cli/commands/root_test.go
index e50d3408908..edfa10dcfc7 100644
--- a/cmd/grype/cli/commands/root_test.go
+++ b/cmd/grype/cli/commands/root_test.go
@@ -6,10 +6,13 @@ import (
 	"github.com/google/go-cmp/cmp"
 	"github.com/google/go-cmp/cmp/cmpopts"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 
 	"github.com/anchore/clio"
 	"github.com/anchore/grype/cmd/grype/cli/options"
+	"github.com/anchore/grype/grype/match"
 	"github.com/anchore/grype/grype/pkg"
+	"github.com/anchore/grype/grype/vex"
 	"github.com/anchore/stereoscope/pkg/image"
 	"github.com/anchore/syft/syft"
 	"github.com/anchore/syft/syft/cataloging"
@@ -86,3 +89,118 @@ func Test_getProviderConfig(t *testing.T) {
 		})
 	}
 }
+
+func Test_applyVexRules(t *testing.T) {
+	tests := []struct {
+		name                   string
+		initialIgnoreRules     []match.IgnoreRule
+		vexDocuments           []string
+		vexAdd                 []string
+		expectedIgnoreRules    []match.IgnoreRule
+		expectError            bool
+		expectedErrorSubstring string
+	}{
+		{
+			name:                "no VEX documents provided - no rules added",
+			initialIgnoreRules:  []match.IgnoreRule{},
+			vexDocuments:        []string{},
+			vexAdd:              []string{},
+			expectedIgnoreRules: []match.IgnoreRule{},
+			expectError:         false,
+		},
+		{
+			name:               "VEX documents provided with empty ignore rules - automatic rules added",
+			initialIgnoreRules: []match.IgnoreRule{},
+			vexDocuments:       []string{"path/to/vex.json"},
+			vexAdd:             []string{},
+			expectedIgnoreRules: []match.IgnoreRule{
+				{VexStatus: string(vex.StatusNotAffected)},
+				{VexStatus: string(vex.StatusFixed)},
+			},
+			expectError: false,
+		},
+		{
+			name: "VEX documents provided with existing ignore rules - automatic rules still added",
+			initialIgnoreRules: []match.IgnoreRule{
+				{Vulnerability: "CVE-2023-1234"},
+			},
+			vexDocuments: []string{"path/to/vex.json"},
+			vexAdd:       []string{},
+			expectedIgnoreRules: []match.IgnoreRule{
+				{Vulnerability: "CVE-2023-1234"},
+				{VexStatus: string(vex.StatusNotAffected)},
+				{VexStatus: string(vex.StatusFixed)},
+			},
+			expectError: false,
+		},
+		{
+			name:               "vex-add with valid statuses",
+			initialIgnoreRules: []match.IgnoreRule{},
+			vexDocuments:       []string{"path/to/vex.json"},
+			vexAdd:             []string{"affected", "under_investigation"},
+			expectedIgnoreRules: []match.IgnoreRule{
+				{VexStatus: string(vex.StatusNotAffected)},
+				{VexStatus: string(vex.StatusFixed)},
+				{VexStatus: string(vex.StatusAffected)},
+				{VexStatus: string(vex.StatusUnderInvestigation)},
+			},
+			expectError: false,
+		},
+		{
+			name:                   "vex-add with invalid status",
+			initialIgnoreRules:     []match.IgnoreRule{},
+			vexDocuments:           []string{"path/to/vex.json"},
+			vexAdd:                 []string{"invalid_status"},
+			expectedIgnoreRules:    nil,
+			expectError:            true,
+			expectedErrorSubstring: "invalid VEX status in vex-add setting: invalid_status",
+		},
+		{
+			name:                   "vex-add attempting to use fixed status",
+			initialIgnoreRules:     []match.IgnoreRule{},
+			vexDocuments:           []string{"path/to/vex.json"},
+			vexAdd:                 []string{"fixed"},
+			expectedIgnoreRules:    nil,
+			expectError:            true,
+			expectedErrorSubstring: "invalid VEX status in vex-add setting: fixed",
+		},
+		{
+			name: "multiple VEX documents with existing rules",
+			initialIgnoreRules: []match.IgnoreRule{
+				{Vulnerability: "CVE-2023-1234"},
+				{FixState: "unknown"},
+			},
+			vexDocuments: []string{"vex1.json", "vex2.json"},
+			vexAdd:       []string{"affected"},
+			expectedIgnoreRules: []match.IgnoreRule{
+				{Vulnerability: "CVE-2023-1234"},
+				{FixState: "unknown"},
+				{VexStatus: string(vex.StatusNotAffected)},
+				{VexStatus: string(vex.StatusFixed)},
+				{VexStatus: string(vex.StatusAffected)},
+			},
+			expectError: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			opts := &options.Grype{
+				Ignore:       append([]match.IgnoreRule{}, tt.initialIgnoreRules...),
+				VexDocuments: tt.vexDocuments,
+				VexAdd:       tt.vexAdd,
+			}
+
+			err := applyVexRules(opts)
+
+			if tt.expectError {
+				require.Error(t, err)
+				assert.Contains(t, err.Error(), tt.expectedErrorSubstring)
+				return
+			}
+
+			require.NoError(t, err)
+			assert.Equal(t, tt.expectedIgnoreRules, opts.Ignore)
+		})
+	}
+}