# Advisories Integration with Vuln Explorer (Md.XI draft)

> Status: DRAFT — waiting on export bundle spec + provenance notes; keep TODO.

## Scope
- Describe advisory normalization, withdrawn handling, provenance, and export bundle linkage for Vuln Explorer.
- Deterministic examples with hashes in `docs/assets/vuln-explorer/SHA256SUMS`.

## Dependencies
- Export bundle spec/provenance notes (in progress).
- GRAP0101 identifiers.

## Outline
- Advisory ingestion flow and key normalization.
- Withdrawn/updated advisory handling.
- Provenance: DSSE/Rekor optional; bundle manifests.
- Cross-links to findings ledger and VEX decisions.

### Hash Capture Checklist (when spec arrives)
- `assets/vuln-explorer/advisory-normalized.json`
- `assets/vuln-explorer/advisory-withdrawn.json`
- `assets/vuln-explorer/advisory-bundle-manifest.json`

_Last updated: 2025-12-05 (UTC)_