@poddingue This can be handled quite cleanly by including a simple package inventory (via dpkg -l) for the XVA, saved as a JSON file, along with a "built-on" date within the download portal to accompany the standard checksum.
Can this please be developed and implemented on the download portal where we grab the XVA, and/or where the Security Advisories are held?
Providing this metadata upfront would solve a major visibility gap for two critical reasons:
Pre-Boot Compliance & SBOMs: Many enterprise security teams require an asset and package review before an image is ever imported or booted in a production cluster. Having a verifiable JSON manifest alongside the download allows admins to satisfy compliance and Software Bill of Materials (SBOM) requirements without forcing a "blind" deployment.
First-Boot Vulnerability Window: Because the XVA acts as a snapshot frozen in time until it hooks into the Vates update servers and Debian repos, it inherently contains a window of unpatched packages upon its very first boot. A build date and package list give engineers immediate clarity on what baseline versions (like OpenSSH or the kernel) are active during that initial setup window.
This wouldn't require changing how the appliance itself updates, but it would provide immense public clarity and enterprise readiness for the deployment process.
