VEX of false-positives is apparently broken

[macedogm]

Description

Apparently the PR #7985 broke the identification and suppression of false-positives with VEX.

When using a VEX report of any type in Trivy v0.57.1, the identified false-positives are properly suppressed. After updating to Trivy v0.58.0, I noticed that the false-positives are no longer being identified. I tested with VEX reports from https://github.com/rancher/vexhub/ and they work in v0.57.1, but not in v0.58.0.

I was able to pinpoint the faulty change to #7985 and https://github.com/aquasecurity/trivy/blob/v0.58.0/pkg/sbom/io/encode.go, but I wasn't able yet to find the exact logic that is broken.

Desired Behavior

False-positives from VEX reports should be suppressed.

Actual Behavior

False-positives from VEX reports are not being identified and neither suppressed.

Reproduction Steps

1. Use Trivy v0.58.0
2. Download the VEX report https://raw.githubusercontent.com/rancher/vexhub/refs/heads/main/pkg/golang/github.com/rancher/fleet/scan.openvex.json.
3. Execute `trivy i -s HIGH,CRITICAL --vex scan.openvex.json --show-suppressed rancher/fleet:v0.10.2`
4. See that 2 instances of CVE-2024-45337 are marked as vulnerable.
5. Repeat the same test, after clearing Trivy's cache, with Trivy v0.57.1.
6. See that the 2 instances of CVE-2024-45337 are properly marked as false-positives.

...

Target

Container Image

Scanner

Vulnerability

Output Format

Table

Mode

Standalone

Debug Output

Is showed above.

Operating System

OpenSUSE Slowroll

Version

v0.58.0

Checklist

• Run trivy clean --all
• Read the troubleshooting

[macedogm]

Sorry for the ping @knqyf263, but this might be a bad bug.

[macedogm]

Or I'm doing something really wrong 😬

[knqyf263]

Thanks. We'll take a look next week.

[knqyf263]

@DmitriyLewen I have less capacity this week. Can you please take a look?

[DmitriyLewen]

@macedogm thanks for your report!
This is bug. I created #8102

I will work on this today.

[macedogm]

Thanks Dmitriy and Teppei for the quick solution.

[DmitriyLewen]

Created #8102