OpenVEX Spec Adds Clarity to Supply Chain Vulnerability Warnings