Menu

📰
0

Reddit - Please wait for verification

MongoDB·/u/MuchAd8862·3 days ago
#vHAFaplU
Reading 0:00
15s threshold

Hi MongoDB team, We use the official MongoDB Search Community image: mongodb/mongodb-community-search:0.65.1 The image correctly reports the product version at runtime: mongotVersion: "0.65.1" The remaining gap is source provenance. For security, SBOM generation, vulnerability management, and downstream image attestation, consumers need to know which source revision produced a published image tag or digest. Today, we do not see a reliable way to map: mongodb/mongodb-community-search:0.65.1 sha256:9173d2cbc5bf730d55227415c75d8e51a4b91f7a8f101465bc60675d49547492 to the exact Git commit or authoritative source revision used to build it. This is increasingly important for downstream consumers because image version alone is not enough to establish source-to-artifact traceability.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.

Read More