That is incredibly damaging to the trust that coordinated vulnerability disclosure depends upon. The obvious consequence is that Chainguard should never again receive embargoed fixes in advance. You don’t get invited back into the room after demonstrating that you can’t be trusted with the information.
They didn’t get to unilaterally decide that the embargo was inconvenient and publish early.
They didn’t get to unilaterally decide that the embargo was inconvenient and publish early.