We might want to collect the list of available rpms we COULD update in any given container build:

Step 1: add this to the dockerfiles:

yum updateinfo list cves

Step 2: get the brew build log, search for updateinfo lines

cd /tmp
wget http://download.eng.bos.redhat.com/brewroot/work/tasks/7092/21307092/x86_64.log
egrep "removed \(updateinfo\)|packages available" x86_64.log | sed -e "s#.\+ - DEBUG - ##g" -e "s# from .\+##" | sort -V

Step 3: integrate this into the overall PST manifest using a new parser to compute updates available by container.