Dockerfile line attribution

[jeff-cook]

Has there been any discussion of attributing the source of the vulnerability to how/where it was added to the image?

As I have been tracking back the source of vulnerabilities, so I know where to fix the issue I have found it can be hard to know where it was installed from/at.

An example would be to help determine that a vulnerability was existing in the base (FROM) image or added somewhere from a RUN command, such as it was added as a dependency of something else. If I didn't install curl in an image was it installed because it was in the FROM image or did installing packagex have it as a dependency?

We have the layer digest. How hard would it be to attribute that layer to the command and then to the Dockerfile line?