The last few months I have experimented with the available tools in the ecosystem to triage vulnerabilities in NixOS. Initially just for my homelab, last week, I open sourced the relevant pieces as: GitHub - datosh/nixos-vex: OpenVEX feed and NixOS module to manage NixOS CVEs, evaluated against your system's configuration. · GitHub
What I do is to create VEX statements from your system configuration, so the triage feed is not static, but based on your configuration. I have written about the approach here: DaTosh | The unreasonable effectiveness of VEX in NixOS
I would be super grateful for any feedback!
At the same time, I am very much still figuring out how to put together a high quality VEX feed. So if you have any experience in that space I would love to share experiences on what works.
Right now it is a mix of deterministic scripts to derive at decisions using public data sources like vulnerability databases and source code, and LLM supported triage flow to gather source code, config and other configuration to support a human decision.