Two decisions from sorb: narrow the target set to what is actually operated
rather than tidying the registry, and start with Authentik. The narrowing stays
derived — a registry repository counts only while one of its tags is running,
which drops the two build artefacts and 61 of the 62 critical findings with
them, without turning the target set back into something anyone maintains.
Scanning the target image before upgrading turns a guess into a number. The
running 2026.2.3 carries 27 critical and 477 high; 2026.8.0 carries 5 and 21.
One upgrade removes twelve percent of all critical findings in running images
and seventeen percent of the high ones — the largest single lever in the
backlog. What remains is perl-base and libxml2, neither of which has a fix.
A correction travels with it. I claimed Authentik's backup had never been
restored because the monthly drill does not carry it. #0030 did restore it,
325,149 rows, and its exclusion from the automated run is a reasoned decision
written into the manifest. Partial measurement, then assertion — the same class
of error as that morning.
Thore Cimbal
27c3579743