# Adding Ignore Filters for Vex Entries

**URL:** <https://anchorecommunity.discourse.group/t/adding-ignore-filters-for-vex-entries/537>\
**Category:** Grype\
**Created:** [August 20, 2025, 5:49pm UTC](https://anchorecommunity.discourse.group/t/adding-ignore-filters-for-vex-entries/537 "2025-08-20T17:49:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![CrosleyZack](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/crosleyzack/32/343_2.png) [@CrosleyZack](https://anchorecommunity.discourse.group/u/CrosleyZack)\
**Post date:** [August 20, 2025, 5:49pm UTC](https://anchorecommunity.discourse.group/t/adding-ignore-filters-for-vex-entries/537/1 "2025-08-20T17:49:54Z")

</div>

I am working on adding an OpenVEX feed from Chainguard to help filter out false positive vulnerability results in Chainguard Libraries. So far, I have PRs adding OpenVEX parsing to vunnel and store as data.Entry’s in grype-db. The next step, as discussed with @wagoodman via email the next step appears to be updated [MatchPackageByEcosystemPackageName](https://github.com/anchore/grype/blob/16595a4140b9d522dff5d5bf582f632991a8d2bb/grype/matcher/internal/language.go#L30) to return this information in the `match.IgnoreFilter`. Looking at my database, I can see the information being stored across blobs, affected\_package\_handles, packages, and vulnerability\_handles. However, when I run grype on a directory with just a python virutalenv with urllib3 installed, I don’t see [the entry from the vex feed](https://storage.googleapis.com/chainguard-upstream-mapping/vex/pypi/urllib3.openvex.json). I set `GRYPE_DB_CACHE_DIR` to point to the directory containing my locally compiled grype-db. What am I missing?

---

<div class="post-metadata">

**Author:** ![CrosleyZack](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/crosleyzack/32/343_2.png) [@CrosleyZack](https://anchorecommunity.discourse.group/u/CrosleyZack)\
**Post date:** [August 20, 2025, 6:21pm UTC](https://anchorecommunity.discourse.group/t/adding-ignore-filters-for-vex-entries/537/2 "2025-08-20T18:21:10Z")

</div>

Even after changing the query to just:

```auto
	vulns, err := provider.FindVulnerabilities(
		search.ByEcosystem(p.Language, p.Type),
		search.ByPackageName("urllib3"),
	)

```

I don’t see anything corresponding to the vex feed. Is there some other query I need to do?

---

<div class="post-metadata">

**Author:** ![willmurphy](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/willmurphy/32/12_2.png) [@willmurphy](https://anchorecommunity.discourse.group/u/willmurphy)\
**Post date:** [August 21, 2025, 4:05pm UTC](https://anchorecommunity.discourse.group/t/adding-ignore-filters-for-vex-entries/537/3 "2025-08-21T16:05:10Z")

</div>

> [@CrosleyZack](#):
>
> GRYPE\_DB\_CACHE\_DIR

I don’t have a ton of context on what you’re doing, but the way to get a locally built database to be used by grype is to run `grype db import /path/to/vulnerability.db`. You can use `GRYPE_DB_CACHE_DIR` to point to a directory where you want it stored and to avoid overriding the normal grype db stored in the user’s cache directory. (The import step rebuilds some indexes and things, so it’s how you should manually pull in a database even if it’s already close to where it goes.)

If you’re working in a Vunnel development shell (you ran `make dev provider=wolfi` or similar in the Vunnel directory), then the make target `make update-db` will re-run the configured vunnel providers, rebuild the grype database, and have the locally built grype import the new database.

---

<div class="post-metadata">

**Author:** ![CrosleyZack](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/crosleyzack/32/343_2.png) [@CrosleyZack](https://anchorecommunity.discourse.group/u/CrosleyZack)\
**Post date:** [August 21, 2025, 8:57pm UTC](https://anchorecommunity.discourse.group/t/adding-ignore-filters-for-vex-entries/537/4 "2025-08-21T20:57:29Z")

</div>

It appears for some reason it only would ever refer to `~/.cache/grype/vunlerability.db`, so I had to copy my local database there and set `GRYPE_DB_VALIDATE_BY_HASH_ON_START="false"` so it would use the database