## Chapter 14 — A year-old image is not a vulnerability count ### Lesson map Lesson 14. Map, example, EX060. ```mermaid flowchart TD Y["Developer: last rebuilt a year ago"] --> A["Monthly rebuild was agreed"] C["One-line confirmation"] --> E["Evidence that a message arrived"] Y --> Q{"Is the year a vulnerability count?"} C --> Q Q -->|No| K["No identifier was copied"] ``` Age is a sentence. A count would be a measurement. ### Logical drawing ```text recorded: older base, last rebuilt a year ago agreement: monthly rebuild, one-line confirmation not recorded: digest, tag, registry, CVE, EPSS, image name ``` ### Learning outcomes After this chapter, you should be able to: 1. Keep the image age as the developer's sentence. 2. Say what a one-line confirmation does not prove. 3. Refuse an imported vulnerability count. ### 14.1 No identifier enters the booking note. The developer said the booking image was an older base last rebuilt a year ago. Fixes published for that base during the year did not arrive, even though the clinic had not changed the application's own code. The agreement that followed is a monthly rebuild from a maintained base, plus a one-line confirmation. The confirmation shows that a message was received. It is not a digest comparison, not a signature check, and not a registry allow-list. Shu, Gu, and Enck (2017) report known vulnerabilities in many public images. Their study is not this clinic's registry, and none of their counts is copied here. Jacobs and colleagues (2021) define EPSS for a known vulnerability identifier. This file has no such identifier, so the score is undefined. Rahman, Parnin, and Williams (2019) discuss smells in infrastructure-as-code scripts. No such script is in either lab, so those smells are not results for the booking app. SP 800-190 recommends maintained bases and trusted registries. The email does not perform those checks. Burns and colleagues (2016) and Verma and colleagues (2015) describe cluster managers. Oakfield's platform is the simpler host already named, not a Borg cell and not a Kubernetes cluster. No node count is recorded. Oakfield's month-end sentence remains in chapter 4, and this lesson does not reprint it as a new result. ### 14.2 Worked example | Added figure | Source that would be required | Decision | |---|---|---| | Last rebuilt a year ago | The developer's answer | May stay | | A confirmation email was the check | The agreement | May stay, as a message | | "Shu's percentage applies to this image." | No count was imported | Reject | | "EPSS for the base is attached." | No identifier | Reject | > **Synthetic case.** The developer stays unnamed. The image stays unnamed. ### Errors and limits A year without a rebuild is a lag. It is not a table of flaws. ### Apply - **EX060 — Age versus count.** A classmate attaches a vulnerability total, an EPSS value, a digest, and a cluster size to the year-old image. What can the note keep? *Rubric:* 3 = keep the year-old base and the monthly confirmation; reject the total, the score, the digest, and the cluster size; the platform is not Kubernetes;; 2 = keep the age and reject the measurements;; 1 = one item;; 0 = none. ### Continue studying — lesson 14 (chapter 14 of 20) [← Chapter 13](#ch-13) · [Course chapter index](../SUBJECTS.md) · [Chapter 15 →](#ch-15) Continue to the next authored lesson. ## Worked answers **EX060.** Keep the year-old base and the monthly one-line confirmation. Reject a vulnerability total, an EPSS value, a digest, and a cluster size. The booking platform is not a Kubernetes cluster.