goharbor / goharbor/website

[Documentation] Document VEX OpenVEX accessory recognition

Open
#765 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
HTML
Stars
46
Forks
222
PR merge metrics
No merged PRs in 30d

Description

## Summary

Harbor now recognizes OCI artifacts with the `application/vnd.openvex+json` media type as a dedicated `vex.openvex` accessory type, instead of the generic `subject.accessory` type.
It also displays a dedicated icon and a new **VEX** tab on the artifact detail page, showing the attached VEX document content with a download button (that displays the JSON file).

Related Harbor PR: [https://github.com/goharbor/harbor/pull/23837](https://github.com/goharbor/harbor/pull/23837)

## Docs needed

- [ ] If it's possible, add OpenVEX to the list of recognized/supported accessory types (alongside Cosign signature, Notation signature, SBOM...), likely in the same page/section that documents accessories under "Working with Images" / "Managing Accessories".
- [ ] Document how to attach an OpenVEX document to an artifact, e.g. with
`oras attach` command:
```sh
oras attach $IMAGE@sha256:$HASH \
--artifact-type application/vnd.openvex+json \
my-app.vex.json:application/json
```
- [ ] Document the new **VEX** tab on the artifact detail page: it displays the raw OpenVEX JSON document and lets users download it.
- [ ] Mention the dedicated OpenVEX icon (OpenSSF) shown for this accessory type in the artifact list and referrers view.

## Screenshots

Screenshots are displayed in the PR of the new feature/update.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the documentation under "Working with Images" / "Managing Accessories" and review the related Harbor PR for the feature details. Document OpenVEX as a recognized accessory, the provided oras attach command, and the VEX tab, download behavior, and OpenSSF icon. Done means each requested item is covered with the relevant screenshots or references.

Written by the indexing model from the issue text.

Assessment

Tech stack
json
Domain
documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
76/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.