# VEX Manual Collection Verification Sheet (2026-08-25 export)
AI Summary
Purpose:
- Preserve the manual-collection verification sheet used as the requirement
and regression baseline for the RHEL VEX v4 collector. The raw export is 2026-08-25-vex-manual-collection-verification.csv beside this note.
Key points:
- 15 columns matching the v4 design's column mapping; 424 data rows across
8 CVE documents (grown from the 2-CVE / 335-row version the design was originally checked against): CVE-2021-33198 (381 rows, container-tools modules), CVE-2022-21607, CVE-2024-22020, CVE-2022-29901 (kernel-rt, realtime), CVE-2019-8325 (rhel_tus:7.4::server), CVE-2017-5504 (RHEL 5, .src), CVE-2020-10699, CVE-2024-42472 (bubblewrap).
- Full-row comparison against the v4 design on 2026-08-25: 420 of 424 rows
covered. 2 rows (rhel_tus:7.4::server, ruby) depended on the RHEL 4–7 server-stream decision — decided INCLUDE on 2026-08-25, so they are now in scope. 2 rows (enterprise_linux:7::client, bpftool-debuginfo) are intended exclusions (desktop; the sheet's own header note also excludes client).
- The comparison surfaced subscription versions missing from the Confluence
page table: rhel_tus:7.4, rhel_aus:8.4, rhel_aus:8.6 — the page's version column is now labeled as examples, since collection keys off the CPE product name, not a version list.
- Sheet data-quality quirks a verification script must handle: CVE cell holds
the document URL and only on each block's first row (normalize to CVE id); 5 rows have empty CPE cells (merged-cell export — forward-fill; they continue enterprise_linux:8::appstream, mysql:8.0); 13 rows have the 상태/remediation columns swapped (상태=vendor_fix, remediation=fixed).
Relevant when:
- Building the collector regression (the 8-CVE golden set), writing the
sheet-vs-collector comparison script, or auditing scope decisions.
Do not read full document unless:
- Row-level values are needed; the CSV itself is the data.
Linked documents:
ai/wiki/projects/rhel-vex-vuln-collection.mdai/sources/confluence/2026-08-20-rhel-vex-redesign.mdai/worklog/2026/2026-W35.md
Open Questions
- Whether the sheet will keep growing; re-export and re-compare before the
W36 bootstrap load if so.
Details
- Exported CSV preserved verbatim; no rows were edited.
- The 2026-08-25 comparison method: parse with Python csv, forward-fill CVE
and CPE cells, profile CPE product/stream/status/module distributions, and check each against the v4 design's product and stream allowlists and column mapping.