Deployed by sorb, then measured rather than assumed: 56 targets, coverage at a
hundred percent, no orphaned report, and the round completing in about two
minutes. Every blind spot named in the issue now carries a report and both stale
entries are gone.
The news is not that the pipeline was broken. It answered reliably for the
twenty-nine images it knew about. The other twenty-seven had never been asked,
and they carry a hundred and twenty-seven additional critical findings —
including the public wiki, both Traefik layers, Prometheus, Grafana, Alertmanager
and the scanner's own image. That belongs to #0051, which is updated with the
new baseline; one of its candidates is not fixable but removable, since an
unused registry tag only entered the set because its repository has fewer tags
than the selection depth.
Three of my own numbers were wrong and are corrected in place: sixty-five
targets became fifty-six, up to sixty-five messages became thirty-nine, and the
normalisation changed every alert fingerprint so all known findings reported
once more. The last one was foreseeable from Gate 2, where normalisation is
already listed as mandatory; I did not follow it through to the alerting layer.
The shakiest call of Gate 3 measured better than feared. cAdvisor sees all eight
images the compose file declares and four more that appear in no compose file of
ours — the registry itself among them. Deriving from the running host beats
deriving from its description.
A new stolperstein carries the cheapest lesson of the day: a test that rebuilds
the unit under test proves the rebuild. Loading the real function exposed within
one run that the shipped file ignored its environment entirely.
Thore Cimbal
e342229823