A topic brought up in 3-22-21 comm dev meeting.
rhn-support-ibazulic has made us aware of customers complaints around Quay 3.5's inability to inform the client that a particular container is "not supported".
The solution is not so simple in Clair V4. Since Clair V4 supports language packages, we can't simply say "this CentOS container is not supported" as the CentOS container may have python packages on it.
Instead, Quay can look at the vulnerability report and determine if a "Distribution" was identified. If there wasn't the Distributions map in the vulnerability report will simply be empty.
// all discovered distributions in this manifest keyed by distribution id Distributions map[string]*Distribution `json:"distributions"`
If Quay encounters this, a message should be presented informing the client, "We could not determine the distribution of this container, no OS vulnerabilities will be present".
Currently, the Quay UI would show the container as "OK". With these changes the Quay UI will show the container is "Unidentified".