> There is absolutely nothing malicious or suspicious about deciding not to provide docker images or binaries. Doing so does not hide or guard you against CVE's, which are entirely unrelated to such optional processes.

Agree. But that's not my point. If you start an oss project from scratch and you don't want to provide builds that's fine.

If you start your oss project, provide public docker images since the beginning, start getting traction, create a commercial scheme for you to monetize the project and then suddenly make a rug pull on the public builds; that is indeed irresponsible, and borderline malicious when you do it without: 1. sufficient warning time. 2. after a recent cve.

Is it malicious? I don't know. I prefer to believe in Hanlon's razor. Is it irresponsible? 100% yes.