Yes — k2gl/openvex reads, writes and canonicalizes OpenVEX documents, with the same content-addressable @id as the go-vex reference.

OpenVEX in PHP?

Yes. k2gl/openvex models OpenVEX documents as typed PHP — statements, vulnerabilities, products and subcomponents — and produces the canonical, go-vex compatible document @id. No dependencies beyond ext-json.

VEX (Vulnerability Exploitability eXchange) answers what a scanner can’t: a CVE shows up in your SBOM, but does it actually affect the artifact you ship? An OpenVEX statement records that judgement — not_affected, affected, fixed or under_investigation — with a machine-readable justification, so a consumer can suppress the noise with an audit trail.

Where it fits

VEX is one layer of the supply-chain story:

SBOM lists what’s inside; a scanner maps it to CVEs.
VEX — k2gl/openvex — states which of those CVEs actually affect the artifact, and why.
Attest it (optional) — wrap the document in an in-toto Statement (predicateType https://openvex.dev/ns) and sign it with a DSSE envelope, the same way SLSA provenance is attested.

Install

composer require k2gl/openvex

See the VEX in PHP guide for authoring and signing, and the supply-chain overview for how the pieces compose.