feat(vex): retrieve VEX attestations from OCI registries

[knqyf263]

Description

Auto-discover VEX attestations in OCI registries.

$ docker run -d -p 10000:5000 --name registry registry:2 # macOS uses port 5000
$ crane copy ghcr.io/aquasecurity/trivy:0.50.0 localhost:10000/trivy:0.50.0 --platform linux/amd64
$ cosign attest --predicate oci.openvex.json --type openvex localhost:10000/trivy:0.50.0
$ trivy image --vex oci localhost:10000/trivy:0.50.0 --show-suppressed --pkg-types os -d
...
2024-07-29T17:54:44+04:00       DEBUG   [vex] VEX attestation found, taking the first one  type="oci" purl="pkg:oci/trivy@sha256%3A04204075ff274c3aa33108d7853b264540bb1036bfdde6eb78e76f6e2d0a7d7d?arch=amd64&repository_url=localhost%3A10000%2Ftrivy"


Suppressed Vulnerabilities (Total: 3)

┌───────────────┬────────────────┬──────────┬──────────────┬───────────────────────────────────────────────────┬──────────────────────────────────────────────────────────────┐
│    Library    │ Vulnerability  │ Severity │    Status    │                     Statement                     │                            Source                            │
├───────────────┼────────────────┼──────────┼──────────────┼───────────────────────────────────────────────────┼──────────────────────────────────────────────────────────────┤
│ busybox       │ CVE-2023-42363 │ MEDIUM   │ not_affected │ vulnerable_code_cannot_be_controlled_by_adversary │ VEX in OCI registry                                          │
│               │                │          │              │                                                   │ (pkg:oci/trivy@sha256%3A04204075ff274c3aa33108d7853b264540b- │
│               │                │          │              │                                                   │ b1036bfdde6eb78e76f6e2d0a7d7d?arch=amd64&repository_url=loc- │
│               │                │          │              │                                                   │ alhost%3A10000%2Ftrivy)                                      │
├───────────────┤                │          │              │                                                   │                                                              │
│ busybox-binsh │                │          │              │                                                   │                                                              │
│               │                │          │              │                                                   │                                                              │
│               │                │          │              │                                                   │                                                              │
│               │                │          │              │                                                   │                                                              │
├───────────────┤                │          │              │                                                   │                                                              │
│ ssl_client    │                │          │              │                                                   │                                                              │
│               │                │          │              │                                                   │                                                              │
│               │                │          │              │                                                   │                                                              │
│               │                │          │              │                                                   │                                                              │
└───────────────┴────────────────┴──────────┴──────────────┴───────────────────────────────────────────────────┴──────────────────────────────────────────────────────────────┘

Related issues

• Close feat(vex): retrieve VEX attestations from OCI registries #7254

Related PRs

• feat: take v1.Image as input testdocker#21
• fix: try other images when blob not found testdocker#20
• Fix OCI repository URL resolution to prevent duplicate name fragments openvex/discovery#40

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[DmitriyLewen]

LGTM