Overview
vg evidence is Vibgrate Evidence: signed, reproducible regulatory evidence for products with digital elements. Register your products, freeze each shipped release into an immutable component manifest, and answer the question a regulator asks after a vulnerability lands — which shipped products contain it, at which versions, in which markets, still in support? — as evidence a third party can verify offline.
Evidence, not compliance. Vibgrate Evidence produces evidence to support your obligations under a reporting regime. It does not determine compliance, is not a certification, and is not legal advice. The scope determination, the "actively exploited" determination, and the filing decision are yours.
Jurisdiction-neutral: regimes
Reporting duties are modelled as regimes. The EU Cyber Resilience Act (CRA) (--regime cra) is the first; DORA incident reporting (--regime dora-incident) ships too. A new jurisdiction is a regime profile, not a new command — so the command set stays open as other jurisdictions introduce similar reporting duties. Run vg evidence regimes to list them.
Usage
# One-time setup: org, coordinator CSIRT, and the person with filing authority
vg evidence init --coordinator NCSC-NL --responsible "Jordan Alvarez" --filing-authority
# Register a product with digital elements (PDE)
vg evidence product add "Acme Edge Gateway" --markets DE,FR,NL --in-scope --until 2031-01-01
# Freeze a shipped release into an immutable manifest (from an SBOM or a scan)
vg evidence release acme-edge-gateway 4.2.0 --from .vibgrate/scan_result.json
# The flagship: which shipped products contain this vulnerability?
vg evidence exposure CVE-2026-48282 --offline --advisory advisory.json
# A deterministic readiness gap report
vg evidence readiness
The flagship: exposure
vg evidence exposure <vuln> matches the advisory against the components in your frozen release manifests — what you actually shipped, not what is in main today. It is deterministic (identical inputs give a byte-identical answer) and never guesses: a bound product with no frozen manifest returns undetermined with a reason, never a false "not affected".
| Exit code | Meaning |
|---|---|
0 | No exposure in any shipped release |
2 | Exposure found — fail the build |
3 | Undetermined — manual review required |
1 | Operational error |
Advisories come from OSV (online) or a local --advisory file (OSV- or Vibgrate-shaped), so the whole path runs --offline. Add --bundle <dir> to emit a signed evidence bundle.
Signed, offline-verifiable evidence
An evidence bundle wraps the deterministic answer in a DSSE / in-toto envelope signed with Ed25519 — the same signing spine as vg build --attest. vg evidence verify <bundle> checks it offline with honest trust states:
| State | Meaning |
|---|---|
verified | Signature checks, signer is trusted (--pub), and the result digest matches |
unverified | Cryptographically intact but the signer is not pinned |
failed | Bad signature, or the result no longer matches its signed digest |
No language model touches any figure in the evidence path, and there is no telemetry in it.
Command reference
| Command | Description |
|---|---|
vg evidence init | Set org, coordinator CSIRT, and the person with filing authority |
vg evidence regimes | List available reporting regimes and their clocks |
vg evidence product add | Register a product with digital elements (PDE) |
vg evidence release | Freeze a shipped release into an immutable component manifest |
vg evidence exposure | Which shipped products contain a vulnerability — with signed evidence |
vg evidence readiness | Deterministic gap report against the regime's obligations |
vg evidence drill | Timed dry-run of the determination against a simulated advisory |
vg evidence pack | Build the submission pack a human pastes into the reporting platform |
vg evidence verify | Verify an evidence bundle offline — no account, no network |
vg evidence export | Air-gap bundle of all evidence state |