How do I export SBOMs from Vibgrate scans?

Answer

Use vg sbom export to emit CycloneDX or SPDX SBOMs from scan artifacts. Example: vg sbom export --format cyclonedx --out sbom.cdx.json. Use vg sbom delta --from old.json --to new.json to compare dependencies between two scans, showing packages added, removed, or changed. Use vg sbom vex --product <ref> --statement '{...}' --out openvex.json to generate a spec-compliant OpenVEX document of exploitability statements you can attach as a signed attestation.