Fail closed on newly disclosed image vulnerabilities; patch, rebuild, and prove exact provenance
A newly refreshed vulnerability database can invalidate an otherwise unchanged immutable image, so release gates should fail closed and teams should patch the smallest implicated dependency, rebuild the exact reviewed source, and rescan instead of weakening or bypassing the gate.…