feat: add VEX Hub certifier

[Abhishek9639]

Description of the PR

This PR adds a new certifier to support VEX Hub integration, as discussed in the linked issue.

The vexhub certifier queries repositories conforming to the VEX Repo Spec. It fetches the manifest (vex-repository.json), downloads the tar.gz archive, and uses index.json to map package PURLs to their corresponding OpenVEX documents. The manifest URL is configurable via the --vexhub-manifest-url flag (defaults to the Aqua Security VEX Hub).

Both guacone and guaccollect CLI commands have been added.

Fixes #2296

PR Checklist

• All commits have a Developer Certificate of Origin (DCO) -- they are generated using -s flag to git commit.
• All new changes are covered by tests
• All CI checks are passing (tests and formatting)

[Abhishek9639]

Hi @funnelfiasco or @jeffmendoza,
I've opened the PR for the VEX Hub certifier implementation. The CI checks are passing locally.
Could you please take a look when you have some time? Let me know if any changes are needed.
Thanks

[mlieberman85]

Good scope and the tests aren't trivial, the end-to-end with httptest is the right shape. A few things need to land before this is mergeable.

Blockers (P0):

1. downloadAndIndex reads the whole archive into memory with no size cap. Tar bomb territory and an OOM as soon as the hub grows past a small set. Two-pass it: parse index.json first, then only buffer files referenced by the index. Or set explicit per-entry and total-size limits with io.LimitReader.
2. NewVEXHubCertifier builds an http.Client with no Timeout. If the archive endpoint hangs, the certifier goroutine pins forever. Combined with #1 this is hang-then-OOM.

Should fix before merge (P1):

3. PURL matching in emitVEXDocuments is direct string lookup, fallback to a hand-rolled stripPurlVersion. Different valid spellings of the same PURL (qualifier order, namespace casing, default vs explicit type, percent-encoding) will silently miss matches. I ran into this recently while working on PURL conformance testing across SBOM generators, where two SBOMs describing the same package routinely produced PURL strings that did not compare equal. Use packageurl-go to canonicalize both sides before lookup.
4. getArchiveURL walks manifest.Versions and grabs the first one with a location, ignoring spec_version. If Aqua publishes a spec bump and lists it first, this will happily download a manifest format it can't parse. Match against known-compatible spec versions.

Nits:

5. Copyright headers on the five new files say 2024.
6. stripPurlVersion should not exist. packageurl-go already parses these.
7. Test coverage skips: malformed manifest, missing index.json, oversized archive, network errors, multi-version manifest, stripped-version-still-misses.

What I like: configurable manifest URL, rate limiter wired up, pkg:guac/* skip, dedupe via seen, the // subdir hack from the VEX Repo Spec parsed correctly in getArchiveURL.

Happy to look again once 1 and 2 are addressed.

[Abhishek9639]

Hi @mlieberman85,
I've addressed all the feedback from your review. All P0, P1, and nits have been fixed including the two-pass archive parsing with io.LimitReader, HTTP client timeout, PURL canonicalization via packageurl-go, spec_version filtering, copyright year updates, and the additional test cases.
Would love your re-review when you get a chance.
Thanks!

[stale]

This pull request has been automatically marked as stale because it has not had recent activity (60 days of inactivity).
It will be closed in 30 days if no further activity occurs.
Thank you for your contribution!