feat(tool): Add VEX file validation tool

cve_bin_tool/cli.py

@@ -79,6 +79,7 @@
 from cve_bin_tool.version import VERSION
 from cve_bin_tool.version_scanner import VersionScanner
 from cve_bin_tool.vex_manager.parse import VEXParse
+from cve_bin_tool.vex_manager.validate import validate_vex_file
 
 sys.excepthook = excepthook  # Always install excepthook for entrypoint module.
 
@@ -394,6 +395,13 @@ def main(argv=None):
         default=False,
         help="Filter cves based on triage data from Vex file",
     )
+    vex_output_group.add_argument(
+        "--vex-file-to-validate",
+        action="store",
+        help="VEX file path to validate (used with vex-validate command)",
+        default="",
+    )
+
     parser.add_argument(
         "-e",
         "--exclude",
@@ -567,11 +575,37 @@ def main(argv=None):
         default=False,
     )
 
+    parser.add_argument(
+        "command",
+        nargs="?",
+        choices=["vex-validate"],
+        help="Command to run: vex-validate to validate VEX files",
+    )
+
+    # Change directory to be optional when using commands
+    input_group.add_argument(
+        "directory", help="directory to scan", nargs="?", default=""
+    )
+
     with ErrorHandler(mode=ErrorMode.NoTrace):
         raw_args = parser.parse_args(argv[1:])
         args = {key: value for key, value in vars(raw_args).items() if value}
         defaults = {key: parser.get_default(key) for key in vars(raw_args)}
 
+    # Handle vex-validate command early
+    if raw_args.command == "vex-validate":
+        if not raw_args.vex_file_to_validate and not raw_args.directory:
+            parser.error(
+                "vex-validate command requires either --vex-file-to-validate or a VEX file path as directory argument"
+            )
+
+        # Use directory as file path if vex_file_to_validate not provided
+        vex_file_path = raw_args.vex_file_to_validate or raw_args.directory
+
+        # Import and run validation
+        exit_code = validate_vex_file(vex_file_path, offline=args.get("offline", False))
+        return exit_code
+
     configs = {}
     if args.get("config"):
         conf = ConfigParser(args["config"])
@@ -741,6 +775,26 @@ def main(argv=None):
 
         return 0
 
+    # Handle vex-validate command
+    if args.get("command") == "vex-validate":
+        from cve_bin_tool.vex_manager.validate import validate_vex_file
+
+        # Determine VEX file path
+        vex_file_path = args.get("vex_file_to_validate") or args.get("directory")
+
+        if not vex_file_path:
+            LOGGER.error(
+                "Please provide a VEX file path using --vex-file-to-validate or as a positional argument"
+            )
+            parser.print_usage()
+            return ERROR_CODES[InsufficientArgs]
+
+        # Validate the VEX file
+        exit_code = validate_vex_file(
+            vex_file_path, LOGGER, offline=args.get("offline", False)
+        )
+        return exit_code
+
     # Offline processing
     if args["offline"]:
         # Override version check and database update arguments
@@ -967,11 +1021,12 @@ def main(argv=None):
         and not args["merge"]
         and not args["sbom_file"]
         and not args["vex_file"]
+        and not raw_args.command
     ):
         parser.print_usage()
         with ErrorHandler(logger=LOGGER, mode=ErrorMode.NoTrace):
             raise InsufficientArgs(
-                "Please specify a directory to scan or an input file required"
+                "Please specify a directory to scan, an input file, or use vex-validate command"
             )
 
     # Output validation

cve_bin_tool/schemas/README.txt

@@ -1,3 +1,21 @@
+CVE Binary Tool Local Schema Files
+==================================
+
+This directory contains local schema files for various formats supported by CVE Binary Tool.
+These schemas enable offline validation and faster processing by avoiding network downloads.
+
+Schema Files:
+- bom-1.4.schema.json: CycloneDX BOM format schema
+- csaf_json_schema.json: CSAF VEX format schema  
+- openvex_json_schema.json: OpenVEX format schema
+- cyclonedx_gen.xsd: CycloneDX XML schema (generated)
+- Various other XSD files for XML validation
+
+To update schemas, download the latest versions from official sources:
+- CycloneDX: https://github.com/CycloneDX/specification/master/schema/
+- CSAF: https://github.com/oasis-tcs/csaf/master/csaf_2.0/json_schema/
+- OpenVEX: https://github.com/openvex/spec/main/.schemas/
+
 The cyclconedx_gen.xsd is an amalgamation of cyclonedx.xsd and cyclonedx_spdx.xsd. References
 to spdx namespace in the cyclonedx.xsd is changed to bom.