[{"slug":"airflow","docker_tag":"3.3.2-CE-ubuntu24.04-r4","available":true,"staging_path":"airflow/3.3.2-CE-ubuntu24.04-r4","product_name":"Apache Airflow","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T03:32:46.000Z","built_from":{"kind":"artifact","label":"Built from upstream's published release package, not its source tree"},"release_notes":true,"version":"3.3.2","category":"Open Source","description":"Single container running `airflow standalone`, which supervises the API server, scheduler, DAG processor and triggerer in one foreground process against a self-contained SQLite metadata database. Workflows are Python files placed in /opt/airflow/dags.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4713,"type":"other"},{"path":"ReadyStack-airflow-3.3.2-CE-ubuntu24.04-r4.rebuild.json","size_bytes":1169,"type":"other"},{"path":"ReadyStack-airflow-3.3.2-CE-ubuntu24.04-r4.rebuild.json.sigstore","size_bytes":2757,"type":"other"},{"path":"ReadyStack-airflow-3.3.2-CE-ubuntu24.04-r4.tar.gz","size_bytes":492544229,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2903,"type":"other"}],"promoted_at":"2026-10-27T03:32:46+00:00","promoted_by":"KitForge v3 (chain 649)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:09d259520e69c44153e703e5a6ad75cee7a46887ebd527b07dc7d6fa8ff25439","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 104 packages with copyleft licences (GPL, LGPL, MPL), 101 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"airflow","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T02:33:00.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:09d259520e69c44153e703e5a6ad75cee7a46887ebd527b07dc7d6fa8ff25439","first_failure":null,"detail":"published sha256:09d259520e69c44153e703e5a6ad75cee7a46887ebd527b07dc7d6fa8ff25439 rebuilt sha256:09d259520e69c44153e703e5a6ad75cee7a46887ebd527b07dc7d6fa8ff25439"},"evidence_at":"2026-10-27T05:18:12.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 104 packages with copyleft licences (GPL, LGPL, MPL), 101 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"argocd","docker_tag":"v3.5.5-CE-ubuntu24.04-r1","available":true,"staging_path":"argocd/v3.5.5-CE-ubuntu24.04-r1","product_name":"Argo CD","scout_grade":"A","grade_basis":null,"released_at":"2026-10-21T09:34:09.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v3.5.5","category":"Open Source","description":"SINGLE self-contained container. The Argo CD components (argocd-server, argocd-repo-server, argocd-application-controller) and redis run INSIDE this one image under supervisord, next to an embedded k3s that serves as the Kubernetes API and datastore. There is no argocd-dex-server in this image (no dex process; /api/dex answers 404). This is NOT a Kubernetes deployment / Helm install / kubectl apply of the install manifests — the image IS the complete running instance. Argo CD can manage external clusters once you register them, but the control plane itself is this one container.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4534,"type":"other"},{"path":"ReadyStack-argocd-v3.5.5-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1434,"type":"other"},{"path":"ReadyStack-argocd-v3.5.5-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2805,"type":"other"},{"path":"ReadyStack-argocd-v3.5.5-CE-ubuntu24.04-r1.tar.gz","size_bytes":693134340,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4201,"type":"other"}],"promoted_at":"2026-10-21T09:34:09+00:00","promoted_by":"KitForge v3 (chain 414)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:a839c35b4f2f97e8cb783848232b6bf34e3373a3717c0397d028b0545d276248","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":83,"grade_at":"2026-10-27","grade_reasons":["Base image docker.io/library/ubuntu:24.04 has been updated since this image was built: it was built on sha256:a2d43bffc466…, and the tag's current linux/amd64 image is sha256:78d4744ead1f….","Docker Scout counts 123 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"999","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-21T05:23:42.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:a839c35b4f2f97e8cb783848232b6bf34e3373a3717c0397d028b0545d276248","first_failure":null,"detail":"published sha256:a839c35b4f2f97e8cb783848232b6bf34e3373a3717c0397d028b0545d276248 rebuilt sha256:a839c35b4f2f97e8cb783848232b6bf34e3373a3717c0397d028b0545d276248"},"evidence_at":"2026-10-27T05:20:05.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-21","reasons":["Docker Scout counts 123 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-21).","Docker Scout counts 123 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-21)."}]}},{"slug":"authentik","docker_tag":"2026.8.5-CE-ubuntu24.04-r2","available":true,"staging_path":"authentik/2026.8.5-CE-ubuntu24.04-r2","product_name":"authentik","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T04:28:27.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"2026.8.5","category":"Open Source","description":"ONE product container (the upstream Rust `authentik` binary runs `ak allinone`: it serves the UI/API on :9000 (HTTPS on :9443) itself, runs the embedded proxy outpost and spawns the gunicorn ASGI app plus Python task workers on a Postgres-backed dramatiq broker) PLUS one required datastore sidecar the customer provides: PostgreSQL. NO REDIS — authentik 2026.5 moved cache/channels/sessions/broker to Postgres. NOT a single self-contained image: Postgres is a hard external dependency.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4373,"type":"other"},{"path":"ReadyStack-authentik-2026.8.5-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1217,"type":"other"},{"path":"ReadyStack-authentik-2026.8.5-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":3001,"type":"other"},{"path":"ReadyStack-authentik-2026.8.5-CE-ubuntu24.04-r2.tar.gz","size_bytes":672594632,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2905,"type":"other"}],"promoted_at":"2026-10-27T04:28:27+00:00","promoted_by":"KitForge v3 (chain 658)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:a7954f9f76be5caac84b1ebda469ac905d552397b3ad174bc8a83267acf51462","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 114 packages with copyleft licences (GPL, LGPL, MPL), 108 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"1000","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T03:43:44.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:a7954f9f76be5caac84b1ebda469ac905d552397b3ad174bc8a83267acf51462","first_failure":null,"detail":"published sha256:a7954f9f76be5caac84b1ebda469ac905d552397b3ad174bc8a83267acf51462 rebuilt sha256:a7954f9f76be5caac84b1ebda469ac905d552397b3ad174bc8a83267acf51462"},"evidence_at":"2026-10-27T05:22:53.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 114 packages with copyleft licences (GPL, LGPL, MPL), 108 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"bookstack","docker_tag":"v26.09.2-CE-ubuntu24.04-r3","available":true,"staging_path":"bookstack/v26.09.2-CE-ubuntu24.04-r3","product_name":"BookStack","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T03:34:52.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v26.09.2","category":"Open Source","description":"Single container (Apache + mod_php, one foreground process) running the BookStack Laravel/PHP application. It REQUIRES an EXTERNAL MySQL 8.0+ / MariaDB 10.6+ database the operator provisions and points the container at via DB_HOST/DB_PORT/DB_DATABASE/DB_USERNAME/DB_PASSWORD env vars — there is NO embedded/SQLite database. BookStack creates and migrates its own schema (`php artisan migrate`) on first start. NOT a multi-service cluster and NOT docker-compose/Kubernetes-only, but it is NOT self-contained: a MySQL/MariaDB server is a hard external dependency.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4262,"type":"other"},{"path":"ReadyStack-bookstack-v26.09.2-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1217,"type":"other"},{"path":"ReadyStack-bookstack-v26.09.2-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":2953,"type":"other"},{"path":"ReadyStack-bookstack-v26.09.2-CE-ubuntu24.04-r3.tar.gz","size_bytes":205934442,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2910,"type":"other"}],"promoted_at":"2026-10-27T03:34:52+00:00","promoted_by":"KitForge v3 (chain 650)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:a649f1eb980bbf47ef8db89e20124a3f9a13a9834872256c4a81d54a50565b94","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 139 packages with copyleft licences (GPL, LGPL, MPL), 133 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"bookstack","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T02:17:10.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:a649f1eb980bbf47ef8db89e20124a3f9a13a9834872256c4a81d54a50565b94","first_failure":null,"detail":"published sha256:a649f1eb980bbf47ef8db89e20124a3f9a13a9834872256c4a81d54a50565b94 rebuilt sha256:a649f1eb980bbf47ef8db89e20124a3f9a13a9834872256c4a81d54a50565b94"},"evidence_at":"2026-10-27T05:25:19.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 139 packages with copyleft licences (GPL, LGPL, MPL), 133 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"caddy","docker_tag":"v2.11.7-CE-ubuntu24.04-r4","available":true,"staging_path":"caddy/v2.11.7-CE-ubuntu24.04-r4","product_name":"Caddy","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T03:43:36.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v2.11.7","category":"Open Source","description":"Single container, single static binary, foreground process. No sidecars, no DB.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4911,"type":"other"},{"path":"ReadyStack-caddy-v2.11.7-CE-ubuntu24.04-r4.rebuild.json","size_bytes":1431,"type":"other"},{"path":"ReadyStack-caddy-v2.11.7-CE-ubuntu24.04-r4.rebuild.json.sigstore","size_bytes":2709,"type":"other"},{"path":"ReadyStack-caddy-v2.11.7-CE-ubuntu24.04-r4.tar.gz","size_bytes":453755048,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2068,"type":"other"}],"promoted_at":"2026-10-27T03:43:36+00:00","promoted_by":"KitForge v3 (chain 659)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:23e269346861a0eb7932c84a1abf48a96b06c4b929518ad66a835b1efc7ae044","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 97 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"caddy","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T03:33:53.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:23e269346861a0eb7932c84a1abf48a96b06c4b929518ad66a835b1efc7ae044","first_failure":null,"detail":"published sha256:23e269346861a0eb7932c84a1abf48a96b06c4b929518ad66a835b1efc7ae044 rebuilt sha256:23e269346861a0eb7932c84a1abf48a96b06c4b929518ad66a835b1efc7ae044"},"evidence_at":"2026-10-27T05:26:32.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 97 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"canvas","docker_tag":"2026-05-20.143-CE-ubuntu24.04-r1","available":true,"staging_path":"canvas/2026-05-20.143-CE-ubuntu24.04-r1","product_name":"Canvas LMS","scout_grade":"A","grade_basis":null,"released_at":"2026-10-22T19:37:47.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"2026-05-20.143","category":"Open Source","description":"Two containers from this one image, plus your PostgreSQL and Redis, as upstream's own docker-compose runs Canvas (services web and jobs): the web server (default command `web`: Puma on port 3000, non-root user canvas, uid 9999) and the background job worker (command `jobs`: `script/delayed_job run`). Both are required: without the jobs container, notifications, course imports and copies, file and thumbnail processing, grade exports and the scheduled (periodic) jobs are queued in PostgreSQL and never run. No PostgreSQL, Redis, nginx or Passenger inside the image; put your own TLS reverse proxy in front.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":6520,"type":"other"},{"path":"ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1227,"type":"other"},{"path":"ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":3045,"type":"other"},{"path":"ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r1.tar.gz","size_bytes":1007270672,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4278,"type":"other"}],"promoted_at":"2026-10-22T19:37:47+00:00","promoted_by":"KitForge v3 (chain 617)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:2b0596a737951dc92946f018e7dc6437cacc471eb62426a31d4ddd480fc1517c","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":83,"grade_at":"2026-10-27","grade_reasons":["Base image docker.io/library/ubuntu:24.04 has been updated since this image was built: it was built on sha256:a2d43bffc466…, and the tag's current linux/amd64 image is sha256:78d4744ead1f….","Docker Scout counts 119 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 111 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: academic_benchmarks."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"canvas","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-22T17:54:30.000Z","host":"prep5","network":"egress-blocked","rebuilt_digest":"sha256:2b0596a737951dc92946f018e7dc6437cacc471eb62426a31d4ddd480fc1517c","first_failure":null,"detail":"published sha256:2b0596a737951dc92946f018e7dc6437cacc471eb62426a31d4ddd480fc1517c rebuilt sha256:2b0596a737951dc92946f018e7dc6437cacc471eb62426a31d4ddd480fc1517c"},"evidence_at":"2026-10-27T05:28:13.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-22","reasons":["Docker Scout counts 119 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 111 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: academic_benchmarks."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-22).","Docker Scout counts 119 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 111 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: academic_benchmarks."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-22)."}]}},{"slug":"changedetection","docker_tag":"0.60.9-CE-ubuntu24.04-r3","available":true,"staging_path":"changedetection/0.60.9-CE-ubuntu24.04-r3","product_name":"changedetection.io","scout_grade":"A","grade_basis":null,"released_at":"2026-10-24T07:50:28.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"0.60.9","category":"Open Source","description":"Single container. A Python (Flask) self-hosted web-page change-monitoring + notification service. State is JSON (changedetection.json/watch.json) + text history snapshots (brotli-compressed when larger than 20 KB) under /datastore — there is NO SQL database. The image IS the complete running instance (no external DB, no sidecar). The default html_requests fetcher (plain HTTP requests) is the only fetcher that works in this hermetic CE image: Playwright is not installed, and the WebDriver Chrome/Javascript fetch method that the UI offers fails every check with `No module named 'PIL'`, even with a WebDriver server set in WEBDRIVER_URL.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5810,"type":"other"},{"path":"ReadyStack-changedetection-0.60.9-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1170,"type":"other"},{"path":"ReadyStack-changedetection-0.60.9-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":2901,"type":"other"},{"path":"ReadyStack-changedetection-0.60.9-CE-ubuntu24.04-r3.tar.gz","size_bytes":395343853,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4248,"type":"other"}],"promoted_at":"2026-10-24T07:50:28+00:00","promoted_by":"KitForge v3 (chain 641)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:e46e6c23cbbce47705c265064c80cbc7178a37e78575ea04ac431213ba67c01a","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":83,"grade_at":"2026-10-27","grade_reasons":["Base image docker.io/library/ubuntu:24.04 has been updated since this image was built: it was built on sha256:a2d43bffc466…, and the tag's current linux/amd64 image is sha256:78d4744ead1f….","Docker Scout counts 120 packages with copyleft licences (EPL, GPL, LGPL, MPL), 116 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"changedetection","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-24T07:45:04.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:e46e6c23cbbce47705c265064c80cbc7178a37e78575ea04ac431213ba67c01a","first_failure":null,"detail":"published sha256:e46e6c23cbbce47705c265064c80cbc7178a37e78575ea04ac431213ba67c01a rebuilt sha256:e46e6c23cbbce47705c265064c80cbc7178a37e78575ea04ac431213ba67c01a"},"evidence_at":"2026-10-27T05:30:45.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-24","reasons":["Docker Scout counts 120 packages with copyleft licences (EPL, GPL, LGPL, MPL), 116 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-24).","Docker Scout counts 120 packages with copyleft licences (EPL, GPL, LGPL, MPL), 116 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-24)."}]}},{"slug":"cloudflared","docker_tag":"2026.10.5-CE-ubuntu24.04-r1","available":true,"staging_path":"cloudflared/2026.10.5-CE-ubuntu24.04-r1","product_name":"cloudflared","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T04:05:08.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"2026.10.5","category":"Open Source","description":"A single container running cloudflared (one static Go binary) as the non-root cloudflared user. It needs a Cloudflare account with a tunnel, and outbound Internet access to Cloudflare (port 7844, QUIC/UDP, falling back to HTTP/2 over TCP). There is no database, no web UI and no data directory; a tunnel run with a token keeps no state on disk.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5308,"type":"other"},{"path":"ReadyStack-cloudflared-2026.10.5-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1618,"type":"other"},{"path":"ReadyStack-cloudflared-2026.10.5-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2805,"type":"other"},{"path":"ReadyStack-cloudflared-2026.10.5-CE-ubuntu24.04-r1.tar.gz","size_bytes":449439790,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2082,"type":"other"}],"promoted_at":"2026-10-28T04:05:08+00:00","promoted_by":"KitForge v3 (chain 746)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:7c25045344936c216eaaf0e41c22c009ab3307280049205a811640608b008770","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"cloudflared","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-28T02:54:41.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:7c25045344936c216eaaf0e41c22c009ab3307280049205a811640608b008770","first_failure":null,"detail":"published sha256:7c25045344936c216eaaf0e41c22c009ab3307280049205a811640608b008770 rebuilt sha256:7c25045344936c216eaaf0e41c22c009ab3307280049205a811640608b008770"},"evidence_at":"2026-10-28T04:09:34.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"coder","docker_tag":"v2.38.3-CE-ubuntu24.04-r1","available":true,"staging_path":"coder/v2.38.3-CE-ubuntu24.04-r1","product_name":"Coder","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T18:57:36.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v2.38.3","category":"Open Source","description":"Single container, single static Go binary (CGO-free) with the React web UI embedded — a self-hosted cloud development environment / workspace platform. REQUIRES an EXTERNAL PostgreSQL database the customer provisions and points the container at via CODER_PG_CONNECTION_URL — there is NO embedded database (without that env, coder downloads a built-in PostgreSQL into the container, where its data is lost when the container is re-created). coder creates + migrates its own schema on first start. The image bundles no terraform or OpenTofu binary and none needs to be supplied: the server's built-in provisioners download HashiCorp Terraform 1.16.7 at startup, so the container needs internet access; without it the server shuts itself down shortly after starting unless started with -e CODER_PROVISIONER_DAEMONS=0 (it then runs without built-in provisioners and cannot build workspaces) or given a terraform binary of version 1.1.0 or later mounted read-only onto the container's PATH, which it then uses instead of downloading. Always set CODER_ACCESS_URL: without it the server publishes itself on the internet through a public *.try.coder.app tunnel.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":6265,"type":"other"},{"path":"ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1493,"type":"other"},{"path":"ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":3093,"type":"other"},{"path":"ReadyStack-coder-v2.38.3-CE-ubuntu24.04-r1.tar.gz","size_bytes":997801081,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2069,"type":"other"}],"promoted_at":"2026-10-27T18:57:36+00:00","promoted_by":"KitForge v3 (chain 702)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:f5d9061edeaa06b75d93e3866978a3a9711b23ff8e809a74d89f82f6d053ad54","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 106 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"coder","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T16:06:43.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:f5d9061edeaa06b75d93e3866978a3a9711b23ff8e809a74d89f82f6d053ad54","first_failure":null,"detail":"published sha256:f5d9061edeaa06b75d93e3866978a3a9711b23ff8e809a74d89f82f6d053ad54 rebuilt sha256:f5d9061edeaa06b75d93e3866978a3a9711b23ff8e809a74d89f82f6d053ad54"},"evidence_at":"2026-10-27T19:04:03.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 106 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"consul","docker_tag":"v1.16.4-CE-ubuntu24.04-r4","available":true,"staging_path":"consul/v1.16.4-CE-ubuntu24.04-r4","product_name":"Consul","scout_grade":"B","grade_basis":null,"released_at":"2026-10-27T07:42:53.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v1.16.4","category":"Open Source","description":"Single container, single static Go binary (CGO-free), foreground `consul agent`. Consul IS its own datastore (embedded raft + boltdb under -data-dir). Service discovery + health checking + KV store + DNS (:8600) + HTTP API (:8500). NO SQL DB, NO sidecar. The web UI is in the binary (the UI build upstream committed to the v1.16.4 tree) and is served at http://<host>:8500/ui/ when the agent runs with -ui or -dev (this image's default command uses -dev).","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":6151,"type":"other"},{"path":"ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r4.rebuild.json","size_bytes":1446,"type":"other"},{"path":"ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r4.rebuild.json.sigstore","size_bytes":3141,"type":"other"},{"path":"ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r4.tar.gz","size_bytes":518457639,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":3021,"type":"other"},{"path":"VEX.openvex.json","size_bytes":3028,"type":"other"}],"promoted_at":"2026-10-27T07:42:53+00:00","promoted_by":"KitForge v3 (chain 651)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:fdea79b7adb1831de9729f877a759538a2efda4384d1df88b423cd0643bfe49d","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":72,"grade_at":"2026-10-27","grade_reasons":["1 fixable critical/high vulnerability (1 high) in 1 package, e.g. github.com/hashicorp/consul 1.18.0 (fixed in 1.20.1).","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"consul","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T02:36:31.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:fdea79b7adb1831de9729f877a759538a2efda4384d1df88b423cd0643bfe49d","first_failure":null,"detail":"published sha256:fdea79b7adb1831de9729f877a759538a2efda4384d1df88b423cd0643bfe49d rebuilt sha256:fdea79b7adb1831de9729f877a759538a2efda4384d1df88b423cd0643bfe49d"},"evidence_at":"2026-10-27T07:47:17.000Z","at_release":{"basis":"scout-policy","grade":"B","grade_percent":72,"passed":null,"at":"2026-10-27","reasons":["1 fixable critical/high vulnerability (1 high) in 1 package, e.g. github.com/hashicorp/consul 1.18.0 (fixed in 1.20.1).","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"crowdsec","docker_tag":"v1.8.1-CE-ubuntu24.04-r2","available":true,"staging_path":"crowdsec/v1.8.1-CE-ubuntu24.04-r2","product_name":"CrowdSec","scout_grade":"A","grade_basis":null,"released_at":"2026-10-20T18:58:02.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v1.8.1","category":"Open Source","description":"A single container running the CrowdSec Local API (LAPI) only (`crowdsec -c /etc/crowdsec/config.yaml -no-cs`), with the cscli tool beside it. The LAPI stores decisions and alerts and answers the security bouncers that ask for ban decisions and the log-processing agents that send alerts. Its database is an embedded SQLite file, /var/lib/crowdsec/data/crowdsec.db, so there is no separate database, sidecar or web UI.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5804,"type":"other"},{"path":"ReadyStack-crowdsec-v1.8.1-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1435,"type":"other"},{"path":"ReadyStack-crowdsec-v1.8.1-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":3093,"type":"other"},{"path":"ReadyStack-crowdsec-v1.8.1-CE-ubuntu24.04-r2.tar.gz","size_bytes":505210181,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4206,"type":"other"}],"promoted_at":"2026-10-20T18:58:02+00:00","promoted_by":"KitForge v3 (chain 559)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:430ac2cc02ba331f2c2139165c6c1eb898246c392d39e1ceee06085c69b74d30","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":83,"grade_at":"2026-10-27","grade_reasons":["Base image docker.io/library/ubuntu:24.04 has been updated since this image was built: it was built on sha256:a2d43bffc466…, and the tag's current linux/amd64 image is sha256:78d4744ead1f….","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"crowdsec","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-20T09:30:21.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:430ac2cc02ba331f2c2139165c6c1eb898246c392d39e1ceee06085c69b74d30","first_failure":null,"detail":"published sha256:430ac2cc02ba331f2c2139165c6c1eb898246c392d39e1ceee06085c69b74d30 rebuilt sha256:430ac2cc02ba331f2c2139165c6c1eb898246c392d39e1ceee06085c69b74d30"},"evidence_at":"2026-10-27T05:36:01.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-20","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-20).","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-20)."}]}},{"slug":"discourse","docker_tag":"v2026.9.1-CE-ubuntu24.04-r1","available":true,"staging_path":"discourse/v2026.9.1-CE-ubuntu24.04-r1","product_name":"Discourse","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T05:27:01.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v2026.9.1","category":"Open Source","description":"Requires PostgreSQL 13 or newer WITH the pgvector extension 0.8.0 or newer, and Redis 7: the core Discourse AI plugin's migrations create the vector extension, so a PostgreSQL without pgvector fails the first start. One container runs Discourse's own web server (Pitchfork) as a non-root user on port 3000; its master process also starts and supervises one Sidekiq background worker (UNICORN_SIDEKIQS=1). PostgreSQL and Redis are external and provided by you. No nginx: put your own TLS reverse proxy in front.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5186,"type":"other"},{"path":"ReadyStack-discourse-v2026.9.1-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1225,"type":"other"},{"path":"ReadyStack-discourse-v2026.9.1-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2761,"type":"other"},{"path":"ReadyStack-discourse-v2026.9.1-CE-ubuntu24.04-r1.tar.gz","size_bytes":850465235,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4285,"type":"other"}],"promoted_at":"2026-10-28T05:27:01+00:00","promoted_by":"KitForge v3 (chain 712)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:ac5369835d0a1705eae615e4cf1bb2ae8c14974ca63e7fb8aacb244d2a4bec11","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 162 packages with copyleft licences (AGPL, CDDL, GPL, LGPL, MPL), 153 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: fonts-urw-base35."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 162 packages with copyleft licences (AGPL, CDDL, GPL, LGPL, MPL), 153 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: fonts-urw-base35."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"discourse","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T19:20:33.000Z","host":"prep3","network":"egress-blocked","rebuilt_digest":"sha256:ac5369835d0a1705eae615e4cf1bb2ae8c14974ca63e7fb8aacb244d2a4bec11","first_failure":null,"detail":"published sha256:ac5369835d0a1705eae615e4cf1bb2ae8c14974ca63e7fb8aacb244d2a4bec11 rebuilt sha256:ac5369835d0a1705eae615e4cf1bb2ae8c14974ca63e7fb8aacb244d2a4bec11"},"evidence_at":"2026-10-28T05:51:14.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 162 packages with copyleft licences (AGPL, CDDL, GPL, LGPL, MPL), 153 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: fonts-urw-base35."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 162 packages with copyleft licences (AGPL, CDDL, GPL, LGPL, MPL), 153 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: fonts-urw-base35."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}]}},{"slug":"docker","docker_tag":"29.9.2-CE-ubuntu24.04-r3","available":true,"staging_path":"docker/29.9.2-CE-ubuntu24.04-r3","product_name":"Docker","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T05:22:53.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"29.9.2","category":"Open Source","description":"One container that is a Docker host: dockerd, containerd and runc run as the non-root user rootless (uid 1000) inside a rootlesskit user namespace (root inside it is uid 1000 outside, the other ids are the subordinate ids 100000-165535), with slirp4netns for networking. The container needs --privileged, as docker-library's docker:dind-rootless does. Inner containers, images and volumes live under /home/rootless/.local/share/docker (the image's volume). The docker CLI is in the image; clients elsewhere connect over TLS on port 2376.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5081,"type":"other"},{"path":"ReadyStack-docker-29.9.2-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1475,"type":"docker"},{"path":"ReadyStack-docker-29.9.2-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":2805,"type":"docker"},{"path":"ReadyStack-docker-29.9.2-CE-ubuntu24.04-r3.tar.gz","size_bytes":513576365,"type":"docker"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2072,"type":"other"}],"promoted_at":"2026-10-28T05:22:53+00:00","promoted_by":"KitForge v3 (chain 747)","chain_price_cents":1000,"runtime_privileges":{"privileges":["--privileged"],"why":"Docker-in-Docker: the inner Docker engine needs the host's cgroup, mount and network facilities that a normal container is denied. The engine itself runs in rootless mode as the unprivileged user rootless.","optional":false,"to_remove":"None while the product is a container engine; it already runs rootless inside the container."},"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:f97b1b29d0c0da6df421b790650defe2e2f890540092bc44def0d166398d429b","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 101 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"rootless","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-28T03:30:27.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:f97b1b29d0c0da6df421b790650defe2e2f890540092bc44def0d166398d429b","first_failure":null,"detail":"published sha256:f97b1b29d0c0da6df421b790650defe2e2f890540092bc44def0d166398d429b rebuilt sha256:f97b1b29d0c0da6df421b790650defe2e2f890540092bc44def0d166398d429b"},"evidence_at":"2026-10-28T05:30:51.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 101 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"docuseal","docker_tag":"3.3.3-CE-alpine-r3","available":true,"staging_path":"docuseal/3.3.3-CE-alpine-r3","product_name":"DocuSeal","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T00:17:08.000Z","built_from":{"kind":"source","label":"Built from upstream's source; the PDFium library (docusealco/pdfium-binaries, sha256-checked) and the field-detection ONNX model (docusealco/fields-detection) are DocuSeal's own prebuilt releases, downloaded by the vendor stage; the WordCraft library that converts Word documents to PDF (libwordcraft.so) is the prebuilt x86_64-linux-musl build inside DocuSeal's wordcraft gem (MIT, docusealco/wordcraft-ruby; the engine is storytold/wordcraft, Apache-2.0 or MIT), installed by Bundler from the version upstream's Gemfile.lock pins (0.8.0)"},"release_notes":true,"version":"3.3.3","category":"Open Source","description":"Single container, Ruby on Rails (Puma) with embedded Redis+Sidekiq — NO sidecars. Default DB is embedded SQLite at /data/docuseal/db.sqlite3 (mount /data/docuseal to persist). Optional external Postgres/MySQL via DATABASE_URL (not used in the CE demo). HTTP on :3000.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4901,"type":"other"},{"path":"ReadyStack-docuseal-3.3.3-CE-alpine-r3.rebuild.json","size_bytes":1156,"type":"other"},{"path":"ReadyStack-docuseal-3.3.3-CE-alpine-r3.rebuild.json.sigstore","size_bytes":2857,"type":"other"},{"path":"ReadyStack-docuseal-3.3.3-CE-alpine-r3.tar.gz","size_bytes":366799684,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":3432,"type":"other"}],"promoted_at":"2026-10-28T00:17:08+00:00","promoted_by":"KitForge v3 (chain 732)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:170e4c988261fc9c066f02094fb0060885450920ba28aa8f78ad7cd81d257c5a","base_os":{"segment":"alpine","label":"Alpine Linux"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 44 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 41 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: hexapdf, redis."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:f48938e9ae72…) with the platform digest it records for the base (sha256:ad5e348f76fd…), which never match. This image's base is docker.io/library/ruby:4.0.5-alpine's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 44 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 41 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: hexapdf, redis."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:f48938e9ae72…) with the platform digest it records for the base (sha256:ad5e348f76fd…), which never match. This image's base is docker.io/library/ruby:4.0.5-alpine's current linux/amd64 image (checked on the registry 2026-10-28)."}],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"docuseal","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T23:06:37.000Z","host":"prep3","network":"egress-blocked","rebuilt_digest":"sha256:170e4c988261fc9c066f02094fb0060885450920ba28aa8f78ad7cd81d257c5a","first_failure":null,"detail":"published sha256:170e4c988261fc9c066f02094fb0060885450920ba28aa8f78ad7cd81d257c5a rebuilt sha256:170e4c988261fc9c066f02094fb0060885450920ba28aa8f78ad7cd81d257c5a"},"evidence_at":"2026-10-28T00:20:58.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 44 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 41 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: hexapdf, redis."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:f48938e9ae72…) with the platform digest it records for the base (sha256:ad5e348f76fd…), which never match. This image's base is docker.io/library/ruby:4.0.5-alpine's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 44 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 41 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: hexapdf, redis."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:f48938e9ae72…) with the platform digest it records for the base (sha256:ad5e348f76fd…), which never match. This image's base is docker.io/library/ruby:4.0.5-alpine's current linux/amd64 image (checked on the registry 2026-10-28)."}]}},{"slug":"drupal","docker_tag":"11.4.11-CE-ubuntu24.04-r2","available":true,"staging_path":"drupal/11.4.11-CE-ubuntu24.04-r2","product_name":"Drupal","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T03:44:11.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"11.4.11","category":"Open Source","description":"A single container: Apache 2.4 with mod_php (Ubuntu 24.04's PHP 8.3) serving Drupal from /opt/drupal/web on port 8080, as the non-root www-data user. The default database is an embedded SQLite file, /var/lib/drupal/drupal.sqlite, so one container is the whole site; MySQL/MariaDB or PostgreSQL are supported through DRUPAL_DB_* variables. The site is installed at the first start (standard profile), before Apache starts, so the web installer is never served.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4412,"type":"other"},{"path":"ReadyStack-drupal-11.4.11-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1213,"type":"other"},{"path":"ReadyStack-drupal-11.4.11-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2949,"type":"other"},{"path":"ReadyStack-drupal-11.4.11-CE-ubuntu24.04-r2.tar.gz","size_bytes":197441289,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2073,"type":"other"}],"promoted_at":"2026-10-27T03:44:11+00:00","promoted_by":"KitForge v3 (chain 652)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:750301160d1fd55bdaacc55dd64a4b1efa06b4dba7dbabf03d02de3b2d3e1ed3","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 143 packages with copyleft licences (GPL, LGPL, MPL), 138 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"www-data","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T02:28:44.000Z","host":"prep5","network":"egress-blocked","rebuilt_digest":"sha256:750301160d1fd55bdaacc55dd64a4b1efa06b4dba7dbabf03d02de3b2d3e1ed3","first_failure":null,"detail":"published sha256:750301160d1fd55bdaacc55dd64a4b1efa06b4dba7dbabf03d02de3b2d3e1ed3 rebuilt sha256:750301160d1fd55bdaacc55dd64a4b1efa06b4dba7dbabf03d02de3b2d3e1ed3"},"evidence_at":"2026-10-27T06:08:32.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 143 packages with copyleft licences (GPL, LGPL, MPL), 138 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"erpnext","docker_tag":"v16.52.1-CE-ubuntu24.04-r2","available":true,"staging_path":"erpnext/v16.52.1-CE-ubuntu24.04-r2","product_name":"ERPNext","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T14:21:11.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v16.52.1","category":"Open Source","description":"ONE product container (supervisord runs the Frappe web backend [gunicorn], the Socket.IO realtime node process, one RQ background worker for the long, default and short queues, the scheduler, and the nginx desk frontend on :8080) PLUS two required datastore sidecars the customer provides: a MariaDB 11.x server and Redis (a cache instance + a queue instance; the queue instance also backs Socket.IO). NOT a single self-contained image — Frappe/ERPNext is fundamentally multi-service. The image has neither wkhtmltopdf nor Chromium: PDFs of the Standard and classic print formats fail, while Print Format Builder formats whose PDF Renderer is Typst, or WeasyPrint for a format already stored on it, render to PDF inside the image.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5147,"type":"other"},{"path":"ReadyStack-erpnext-v16.52.1-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1241,"type":"other"},{"path":"ReadyStack-erpnext-v16.52.1-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2997,"type":"other"},{"path":"ReadyStack-erpnext-v16.52.1-CE-ubuntu24.04-r2.tar.gz","size_bytes":777297581,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2905,"type":"other"}],"promoted_at":"2026-10-27T14:21:11+00:00","promoted_by":"KitForge v3 (chain 661)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:a955c0bef09c95a21964181dfffb93f1faaef9b56aca8a09c7aab5b44c8ad97f","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 161 packages with copyleft licences (GPL, LGPL, MPL), 155 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"frappe","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T14:00:41.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:a955c0bef09c95a21964181dfffb93f1faaef9b56aca8a09c7aab5b44c8ad97f","first_failure":null,"detail":"published sha256:a955c0bef09c95a21964181dfffb93f1faaef9b56aca8a09c7aab5b44c8ad97f rebuilt sha256:a955c0bef09c95a21964181dfffb93f1faaef9b56aca8a09c7aab5b44c8ad97f"},"evidence_at":"2026-10-27T14:28:46.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 161 packages with copyleft licences (GPL, LGPL, MPL), 155 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"etcd","docker_tag":"v3.7.3-CE-ubuntu24.04-r1","available":true,"staging_path":"etcd/v3.7.3-CE-ubuntu24.04-r1","product_name":"etcd","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T15:05:19.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v3.7.3","category":"Open Source","description":"A single container running a single-member etcd cluster as the non-root etcd user (uid 999). etcd is its own datastore: an embedded bbolt key-value store under /data (the --data-dir), so there is no separate database, sidecar or web UI. The image contains three static Go binaries: etcd (the server), etcdctl (the client) and etcdutl (offline data tools).","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":6148,"type":"other"},{"path":"ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1484,"type":"other"},{"path":"ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2805,"type":"other"},{"path":"ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r1.tar.gz","size_bytes":467470481,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2065,"type":"other"}],"promoted_at":"2026-10-27T15:05:19+00:00","promoted_by":"KitForge v3 (chain 698)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:b21b8089f1957b35bfaf54647f871c1e9e56d36d20af32a2fdb9b2b6483d62f6","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"etcd","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T14:52:16.000Z","host":"prep5","network":"egress-blocked","rebuilt_digest":"sha256:b21b8089f1957b35bfaf54647f871c1e9e56d36d20af32a2fdb9b2b6483d62f6","first_failure":null,"detail":"published sha256:b21b8089f1957b35bfaf54647f871c1e9e56d36d20af32a2fdb9b2b6483d62f6 rebuilt sha256:b21b8089f1957b35bfaf54647f871c1e9e56d36d20af32a2fdb9b2b6483d62f6"},"evidence_at":"2026-10-27T15:08:49.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"fluentbit","docker_tag":"v5.1.5-CE-ubuntu24.04-r1","available":true,"staging_path":"fluentbit/v5.1.5-CE-ubuntu24.04-r1","product_name":"Fluent Bit","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T03:15:00.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v5.1.5","category":"Open Source","description":"Single container running one C binary, /fluent-bit/bin/fluent-bit, compiled from the upstream source with every bundled library built in. It is a log, metrics and traces processor and forwarder: it reads from the inputs you configure, filters, and sends to the outputs you configure. It has no database, no web UI and no user accounts. It runs as the non-root user fluentbit.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5621,"type":"other"},{"path":"ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1164,"type":"other"},{"path":"ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2853,"type":"other"},{"path":"ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r1.tar.gz","size_bytes":346057721,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":3376,"type":"other"}],"promoted_at":"2026-10-28T03:15:00+00:00","promoted_by":"KitForge v3 (chain 711)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:bd3c6947d6a7f8b76e2bccc19ddbf3d53f92bc834f2bf5a7a1e17efe624af8c4","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 85 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 85 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"fluentbit","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T18:16:50.000Z","host":"prep5","network":"egress-blocked","rebuilt_digest":"sha256:bd3c6947d6a7f8b76e2bccc19ddbf3d53f92bc834f2bf5a7a1e17efe624af8c4","first_failure":null,"detail":"published sha256:bd3c6947d6a7f8b76e2bccc19ddbf3d53f92bc834f2bf5a7a1e17efe624af8c4 rebuilt sha256:bd3c6947d6a7f8b76e2bccc19ddbf3d53f92bc834f2bf5a7a1e17efe624af8c4"},"evidence_at":"2026-10-28T03:19:26.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 85 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 85 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}]}},{"slug":"frappecrm","docker_tag":"v1.89.0-CE-ubuntu24.04-r1","available":true,"staging_path":"frappecrm/v1.89.0-CE-ubuntu24.04-r1","product_name":"Frappe CRM","scout_grade":"A","grade_basis":null,"released_at":"2026-10-24T01:20:14.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v1.89.0","category":"Open Source","description":"ONE product container (supervisord runs the Frappe web backend [gunicorn], the Socket.IO realtime node process, one RQ worker process for the long, default and short queues, the scheduler, and the nginx frontend on :8080) PLUS two required datastore sidecars the customer provides: a MariaDB 11.x server and Redis (a cache instance + a queue instance; the queue instance also backs Socket.IO). NOT a single self-contained image — Frappe is fundamentally multi-service. The image has neither wkhtmltopdf nor Chromium: PDFs of the Standard and classic print formats fail, while Print Format Builder formats whose PDF Renderer is Typst, or WeasyPrint for a format already stored on it, render to PDF inside the image.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":7688,"type":"other"},{"path":"ReadyStack-frappecrm-v1.89.0-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1242,"type":"other"},{"path":"ReadyStack-frappecrm-v1.89.0-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2905,"type":"other"},{"path":"ReadyStack-frappecrm-v1.89.0-CE-ubuntu24.04-r1.tar.gz","size_bytes":743180667,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2074,"type":"other"}],"promoted_at":"2026-10-24T01:20:14+00:00","promoted_by":"KitForge v3 (chain 640)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:807b13e33ecdab7f275a718daf36cd71bdca6bbb32e15a35d606ddb310819c0f","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":83,"grade_at":"2026-10-27","grade_reasons":["Base image docker.io/library/ubuntu:24.04 has been updated since this image was built: it was built on sha256:a2d43bffc466…, and the tag's current linux/amd64 image is sha256:78d4744ead1f….","Docker Scout counts 160 packages with copyleft licences (GPL, LGPL, MPL), 155 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"frappe","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-24T00:03:58.000Z","host":"prep3","network":"egress-blocked","rebuilt_digest":"sha256:807b13e33ecdab7f275a718daf36cd71bdca6bbb32e15a35d606ddb310819c0f","first_failure":null,"detail":"published sha256:807b13e33ecdab7f275a718daf36cd71bdca6bbb32e15a35d606ddb310819c0f rebuilt sha256:807b13e33ecdab7f275a718daf36cd71bdca6bbb32e15a35d606ddb310819c0f"},"evidence_at":"2026-10-27T06:15:19.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-24","reasons":["Docker Scout counts 160 packages with copyleft licences (GPL, LGPL, MPL), 155 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"ghost","docker_tag":"v6.72.0-CE-ubuntu24.04-r4","available":true,"staging_path":"ghost/v6.72.0-CE-ubuntu24.04-r4","product_name":"Ghost","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T05:00:20.000Z","built_from":{"kind":"artifact","label":"Built from upstream's published release package, not its source tree"},"release_notes":true,"version":"v6.72.0","category":"Open Source","description":"Single container (Node.js, `node index.js`, one foreground process) running Ghost. It REQUIRES an EXTERNAL MySQL 8 database the operator provisions and points the container at via database__connection__host/port/user/password/database env vars — there is NO embedded/SQLite database in production (SQLite is dev-only and unsupported in production; Ghost starts on it without any warning, so configure MySQL 8). On first start Ghost auto-runs knex-migrator to create its schema. NOT a multi-service cluster, but NOT self-contained: a MySQL 8 server is a hard external dependency; the content/ dir + DB must persist.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":3982,"type":"other"},{"path":"ReadyStack-ghost-v6.72.0-CE-ubuntu24.04-r4.rebuild.json","size_bytes":1212,"type":"other"},{"path":"ReadyStack-ghost-v6.72.0-CE-ubuntu24.04-r4.rebuild.json.sigstore","size_bytes":2905,"type":"other"},{"path":"ReadyStack-ghost-v6.72.0-CE-ubuntu24.04-r4.tar.gz","size_bytes":467924540,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2898,"type":"other"}],"promoted_at":"2026-10-27T05:00:20+00:00","promoted_by":"KitForge v3 (chain 662)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:2c1ec7dc13a59ae85e2a08b8da999913600d9298d521da6bff5826cc78882640","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 99 packages with copyleft licences (GPL, LGPL, MPL), 96 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"node","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T04:50:24.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:2c1ec7dc13a59ae85e2a08b8da999913600d9298d521da6bff5826cc78882640","first_failure":null,"detail":"published sha256:2c1ec7dc13a59ae85e2a08b8da999913600d9298d521da6bff5826cc78882640 rebuilt sha256:2c1ec7dc13a59ae85e2a08b8da999913600d9298d521da6bff5826cc78882640"},"evidence_at":"2026-10-27T06:17:52.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 99 packages with copyleft licences (GPL, LGPL, MPL), 96 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"gitea","docker_tag":"v28.2.0-CE-ubuntu24.04-r2","available":true,"staging_path":"gitea/v28.2.0-CE-ubuntu24.04-r2","product_name":"Gitea","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T09:04:48.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v28.2.0","category":"Open Source","description":"SINGLE self-contained container. The gitea Go binary runs with an EMBEDDED sqlite database — no external Postgres/MySQL. The image IS the complete running instance. Web UI + Git over HTTP on :3000; Git over SSH on :2222, served by Gitea's built-in SSH server (the image has no sshd).","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4349,"type":"other"},{"path":"ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1438,"type":"other"},{"path":"ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2805,"type":"other"},{"path":"ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.tar.gz","size_bytes":542132588,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2901,"type":"other"}],"promoted_at":"2026-10-27T09:04:48+00:00","promoted_by":"KitForge v3 (chain 653)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:2ed51d5a2ab0feeb0e392b90c626c027da93feaf15fa63770a2c41ed7d909a45","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 122 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"gitea","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T02:30:16.000Z","host":"prep3","network":"egress-blocked","rebuilt_digest":"sha256:2ed51d5a2ab0feeb0e392b90c626c027da93feaf15fa63770a2c41ed7d909a45","first_failure":null,"detail":"published sha256:2ed51d5a2ab0feeb0e392b90c626c027da93feaf15fa63770a2c41ed7d909a45 rebuilt sha256:2ed51d5a2ab0feeb0e392b90c626c027da93feaf15fa63770a2c41ed7d909a45"},"evidence_at":"2026-10-27T09:09:11.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 122 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"grafana","docker_tag":"v13.2.4-CE-ubuntu24.04-r2","available":true,"staging_path":"grafana/v13.2.4-CE-ubuntu24.04-r2","product_name":"Grafana","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T06:13:25.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v13.2.4","category":"Open Source","description":"Single container, single static Go binary (CGO-free) + on-disk web frontend (public/) served from --homepath, foreground process. Observability/dashboards platform. State lives in an EMBEDDED SQLite database at /var/lib/grafana/grafana.db that grafana creates + migrates itself on first boot — NO external/relational DB, no docker-compose, no Kubernetes. The image holds the complete Grafana server but not its data-source and app plugins: on its first start Grafana downloads them (Prometheus, Loki, PostgreSQL, MySQL, Elasticsearch and others, about 500 MB) from grafana.com into /var/lib/grafana/plugins, and without internet access it starts with only its built-in data sources (Alertmanager, Azure Monitor, CloudWatch, Graphite and TestData). (Grafana CAN be pointed at an external Postgres/MySQL via GF_DATABASE_* env, but the default + this image's self-contained shape is embedded SQLite.)","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5558,"type":"other"},{"path":"ReadyStack-grafana-v13.2.4-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1441,"type":"other"},{"path":"ReadyStack-grafana-v13.2.4-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2997,"type":"other"},{"path":"ReadyStack-grafana-v13.2.4-CE-ubuntu24.04-r2.tar.gz","size_bytes":804264750,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2904,"type":"other"}],"promoted_at":"2026-10-27T06:13:25+00:00","promoted_by":"KitForge v3 (chain 654)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:c45e7a2d37439c2045583444b0b6e9c40cb2cdb900b111f4d578f411b229fecd","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"grafana","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T04:21:04.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:c45e7a2d37439c2045583444b0b6e9c40cb2cdb900b111f4d578f411b229fecd","first_failure":null,"detail":"published sha256:c45e7a2d37439c2045583444b0b6e9c40cb2cdb900b111f4d578f411b229fecd rebuilt sha256:c45e7a2d37439c2045583444b0b6e9c40cb2cdb900b111f4d578f411b229fecd"},"evidence_at":"2026-10-27T06:22:56.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"haproxy","docker_tag":"3.4.6-CE-ubuntu24.04-r4","available":true,"staging_path":"haproxy/3.4.6-CE-ubuntu24.04-r4","product_name":"HAProxy","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T21:56:08.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"3.4.6","category":"Open Source","description":"Single container. HAProxy runs in master-worker mode in the foreground (`haproxy -W -db`; doc/management.txt: -W starts a master that monitors the workers, -db disables background mode): the master is the container's main process and starts the worker that handles traffic. Compiled from source by this image's build (make TARGET=linux-glibc ...). No database, no sidecar, nothing stored on disk. The shipped configuration is a placeholder that proxies nothing: it answers on port 8080 and serves statistics and metrics inside the container. To load-balance your services, mount a directory holding your haproxy.cfg over /usr/local/etc/haproxy (for example `-v \"$PWD/haproxy\":/usr/local/etc/haproxy:ro`; see Config reload in the handbooks).","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5303,"type":"other"},{"path":"ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r4.rebuild.json","size_bytes":1155,"type":"other"},{"path":"ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r4.rebuild.json.sigstore","size_bytes":3001,"type":"other"},{"path":"ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r4.tar.gz","size_bytes":240252335,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2070,"type":"other"}],"promoted_at":"2026-10-27T21:56:08+00:00","promoted_by":"KitForge v3 (chain 725)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:2ccdcd3294917901aef07b97f1b8036a6da2f889a9b76dcfa68265478ec29887","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"haproxy","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T21:03:26.000Z","host":"prep3","network":"egress-blocked","rebuilt_digest":"sha256:2ccdcd3294917901aef07b97f1b8036a6da2f889a9b76dcfa68265478ec29887","first_failure":null,"detail":"published sha256:2ccdcd3294917901aef07b97f1b8036a6da2f889a9b76dcfa68265478ec29887 rebuilt sha256:2ccdcd3294917901aef07b97f1b8036a6da2f889a9b76dcfa68265478ec29887"},"evidence_at":"2026-10-27T21:59:01.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"harbor","docker_tag":"v2.15.4-CE-ubuntu24.04-r3","available":true,"staging_path":"harbor/v2.15.4-CE-ubuntu24.04-r3","product_name":"Harbor","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T11:01:03.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v2.15.4","category":"Open Source","description":"One non-root container running Harbor's own processes under supervisord: core (API, auth, token service, /v2 proxy), jobservice (replication, garbage collection, retention and other jobs), registryctl, the registry, and nginx serving the web portal on port 8080. PostgreSQL and Redis are NOT inside the image: point it at your own PostgreSQL database and Redis server. No vulnerability scanner is bundled; register an external scanner (for example a Trivy adapter) in Administration > Interrogation Services if you want scanning.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":6093,"type":"other"},{"path":"ReadyStack-harbor-v2.15.4-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1501,"type":"other"},{"path":"ReadyStack-harbor-v2.15.4-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":2805,"type":"other"},{"path":"ReadyStack-harbor-v2.15.4-CE-ubuntu24.04-r3.tar.gz","size_bytes":518901446,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2903,"type":"other"}],"promoted_at":"2026-10-27T11:01:03+00:00","promoted_by":"KitForge v3 (chain 655)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:4c0f840b4590cbb6b71d30f635d9263b036b6450f59a4f5db40bf8fab41ed2e0","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 115 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"harbor","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T03:46:33.000Z","host":"prep5","network":"egress-blocked","rebuilt_digest":"sha256:4c0f840b4590cbb6b71d30f635d9263b036b6450f59a4f5db40bf8fab41ed2e0","first_failure":null,"detail":"published sha256:4c0f840b4590cbb6b71d30f635d9263b036b6450f59a4f5db40bf8fab41ed2e0 rebuilt sha256:4c0f840b4590cbb6b71d30f635d9263b036b6450f59a4f5db40bf8fab41ed2e0"},"evidence_at":"2026-10-27T11:05:16.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 115 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"homeassistant","docker_tag":"2026.10.2-CE-ubuntu24.04-r1","available":true,"staging_path":"homeassistant/2026.10.2-CE-ubuntu24.04-r1","product_name":"Home Assistant","scout_grade":"A","grade_basis":null,"released_at":"2026-10-22T15:51:09.000Z","built_from":{"kind":"artifact","label":"Built from upstream's published release package, not its source tree"},"release_notes":true,"version":"2026.10.2","category":"Open Source","description":"Single container running Home Assistant Core in the foreground against a self-contained SQLite recorder database. This is Home Assistant CORE — not Home Assistant OS and not the Supervisor, so there are no add-ons and no supervisor-managed updates.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":8301,"type":"other"},{"path":"ReadyStack-homeassistant-2026.10.2-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1171,"type":"other"},{"path":"ReadyStack-homeassistant-2026.10.2-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2949,"type":"other"},{"path":"ReadyStack-homeassistant-2026.10.2-CE-ubuntu24.04-r1.tar.gz","size_bytes":704526895,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":3389,"type":"other"}],"promoted_at":"2026-10-22T15:51:09+00:00","promoted_by":"KitForge v3 (chain 623)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:249c732b4ddc02aed1cc68715d1d2af088f40d5bd6d06404e14a293f9663461f","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":83,"grade_at":"2026-10-27","grade_reasons":["Base image docker.io/library/ubuntu:24.04 has been updated since this image was built: it was built on sha256:a2d43bffc466…, and the tag's current linux/amd64 image is sha256:78d4744ead1f….","Docker Scout counts 207 packages with copyleft licences (GPL, LGPL, MPL), 203 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"homeassistant","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-22T14:15:32.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:249c732b4ddc02aed1cc68715d1d2af088f40d5bd6d06404e14a293f9663461f","first_failure":null,"detail":"published sha256:249c732b4ddc02aed1cc68715d1d2af088f40d5bd6d06404e14a293f9663461f rebuilt sha256:249c732b4ddc02aed1cc68715d1d2af088f40d5bd6d06404e14a293f9663461f"},"evidence_at":"2026-10-27T06:29:04.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-22","reasons":["Docker Scout counts 207 packages with copyleft licences (GPL, LGPL, MPL), 203 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-22).","Docker Scout counts 207 packages with copyleft licences (GPL, LGPL, MPL), 203 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-22)."}]}},{"slug":"influxdb","docker_tag":"v3.12.1-CE-ubuntu24.04-r2","available":true,"staging_path":"influxdb/v3.12.1-CE-ubuntu24.04-r2","product_name":"InfluxDB","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T09:15:10.000Z","built_from":{"kind":"source","label":"Built from upstream's source; the Python UDF runtime (datafusion_udf_wasm_python, an x86_64 ELF) is InfluxData's prebuilt release from github.com/influxdata/datafusion-udf-wasm, downloaded by the vendor stage and checked against the sha256 upstream pins in core/iox_query_udf/build.rs, as upstream's own build does"},"release_notes":true,"version":"v3.12.1","category":"Open Source","description":"Single container running one Rust binary, influxdb3 serve, compiled from the upstream source. A single-node time-series database: it accepts writes in line protocol, answers SQL and InfluxQL queries, and stores its catalog, write-ahead log and Parquet files in a local-disk object store under /var/lib/influxdb3/data (INFLUXDB3_OBJECT_STORE=file; the server also accepts the s3, google and azure object stores, which this release's handbooks do not cover). No external database, no web UI. It runs as the non-root user influxdb3.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5005,"type":"other"},{"path":"ReadyStack-influxdb-v3.12.1-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1432,"type":"other"},{"path":"ReadyStack-influxdb-v3.12.1-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2661,"type":"other"},{"path":"ReadyStack-influxdb-v3.12.1-CE-ubuntu24.04-r2.tar.gz","size_bytes":953585960,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2075,"type":"other"}],"promoted_at":"2026-10-27T09:15:10+00:00","promoted_by":"KitForge v3 (chain 656)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:064edd31c1ee792f060f21f21783d7990113250ad89444128c20bf35e13d97d7","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 90 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"influxdb3","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T07:19:58.000Z","host":"prep3","network":"egress-blocked","rebuilt_digest":"sha256:064edd31c1ee792f060f21f21783d7990113250ad89444128c20bf35e13d97d7","first_failure":null,"detail":"published sha256:064edd31c1ee792f060f21f21783d7990113250ad89444128c20bf35e13d97d7 rebuilt sha256:064edd31c1ee792f060f21f21783d7990113250ad89444128c20bf35e13d97d7"},"evidence_at":"2026-10-27T09:20:15.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 90 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"jenkins","docker_tag":"2.580.1-CE-ubuntu24.04-r4","available":true,"staging_path":"jenkins/2.580.1-CE-ubuntu24.04-r4","product_name":"Jenkins","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T02:39:10.000Z","built_from":{"kind":"source","label":"Built from upstream's source; the 63 bundled plugins are upstream's prebuilt releases, unmodified"},"release_notes":true,"version":"2.580.1","category":"Open Source","description":"Single container running jenkins.war on its embedded Winstone/Jetty container, with state under JENKINS_HOME. No external database.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4459,"type":"other"},{"path":"ReadyStack-jenkins-2.580.1-CE-ubuntu24.04-r4.rebuild.json","size_bytes":1539,"type":"other"},{"path":"ReadyStack-jenkins-2.580.1-CE-ubuntu24.04-r4.rebuild.json.sigstore","size_bytes":2805,"type":"other"},{"path":"ReadyStack-jenkins-2.580.1-CE-ubuntu24.04-r4.tar.gz","size_bytes":1151062691,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4309,"type":"other"}],"promoted_at":"2026-10-28T02:39:10+00:00","promoted_by":"KitForge v3 (chain 681)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:dd9187881e65045afdac952266c3af43160a799f940c058738f37028f9d1b476","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 129 packages with copyleft licences (CDDL, EPL, GPL, LGPL, MPL), 127 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:cd35bb338596…) with the platform digest it records for the base (sha256:de07a7c89a94…), which never match. This image's base is docker.io/library/eclipse-temurin:21-jre-noble's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 129 packages with copyleft licences (CDDL, EPL, GPL, LGPL, MPL), 127 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:cd35bb338596…) with the platform digest it records for the base (sha256:de07a7c89a94…), which never match. This image's base is docker.io/library/eclipse-temurin:21-jre-noble's current linux/amd64 image (checked on the registry 2026-10-28)."}],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"jenkins","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-28T02:29:25.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:dd9187881e65045afdac952266c3af43160a799f940c058738f37028f9d1b476","first_failure":null,"detail":"published sha256:dd9187881e65045afdac952266c3af43160a799f940c058738f37028f9d1b476 rebuilt sha256:dd9187881e65045afdac952266c3af43160a799f940c058738f37028f9d1b476"},"evidence_at":"2026-10-28T02:45:07.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 129 packages with copyleft licences (CDDL, EPL, GPL, LGPL, MPL), 127 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:cd35bb338596…) with the platform digest it records for the base (sha256:de07a7c89a94…), which never match. This image's base is docker.io/library/eclipse-temurin:21-jre-noble's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 129 packages with copyleft licences (CDDL, EPL, GPL, LGPL, MPL), 127 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:cd35bb338596…) with the platform digest it records for the base (sha256:de07a7c89a94…), which never match. This image's base is docker.io/library/eclipse-temurin:21-jre-noble's current linux/amd64 image (checked on the registry 2026-10-28)."}]}},{"slug":"jitsi","docker_tag":"stable-11248-CE-ubuntu24.04-r2","available":true,"staging_path":"jitsi/stable-11248-CE-ubuntu24.04-r2","product_name":"Jitsi Meet","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T16:39:42.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"stable-11248","category":"Open Source","description":"Single container holding ONLY the Jitsi Meet web frontend: the browser application (built from source) served by nginx as a non-root user on port 8080, with /http-bind and /xmpp-websocket proxied to an XMPP server. It is NOT a complete Jitsi Meet: a conference also needs prosody (XMPP signalling), jicofo (conference focus) and jitsi-videobridge (the media server, UDP 10000). None of those are in this image. The environment variable names match docker-jitsi-meet's `web` service, so this container can replace that service in a docker-jitsi-meet deployment that supplies the other three.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4456,"type":"other"},{"path":"ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1153,"type":"other"},{"path":"ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2569,"type":"other"},{"path":"ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r2.tar.gz","size_bytes":534450530,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2906,"type":"other"}],"promoted_at":"2026-10-27T16:39:42+00:00","promoted_by":"KitForge v3 (chain 682)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:fc341a382a00ed276f0a60e8b9ac785bd6d0402c9289321d9411027ca251534a","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 104 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"jitsi","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T10:36:23.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:fc341a382a00ed276f0a60e8b9ac785bd6d0402c9289321d9411027ca251534a","first_failure":null,"detail":"published sha256:fc341a382a00ed276f0a60e8b9ac785bd6d0402c9289321d9411027ca251534a rebuilt sha256:fc341a382a00ed276f0a60e8b9ac785bd6d0402c9289321d9411027ca251534a"},"evidence_at":"2026-10-27T16:43:01.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 104 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"kafka","docker_tag":"4.4.0-CE-ubuntu24.04-r2","available":true,"staging_path":"kafka/4.4.0-CE-ubuntu24.04-r2","product_name":"Apache Kafka","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T13:28:44.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"4.4.0","category":"Open Source","description":"A single container running one Kafka node in KRaft combined mode (it is both broker and controller; Kafka 4 has no ZooKeeper) as the non-root kafka user, on the Eclipse Temurin 25 JRE. Topic data is log segments under /var/lib/kafka/data. There is no web UI, no REST API and no SQL database; clients use the Kafka protocol on port 9092, and the Kafka command-line tools are in the image under /opt/kafka/bin (on PATH).","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":3862,"type":"other"},{"path":"ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1555,"type":"other"},{"path":"ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":3093,"type":"other"},{"path":"ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r2.tar.gz","size_bytes":973284103,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":3447,"type":"other"}],"promoted_at":"2026-10-27T13:28:44+00:00","promoted_by":"KitForge v3 (chain 683)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:d3f92612901df9e1b5427c406b7b4ddf8f46dcc56501ef558e7888fdd585eec4","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 91 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:ce8543ddd307…) with the platform digest it records for the base (sha256:4b027e62bb74…), which never match. This image's base is docker.io/library/eclipse-temurin:25-jre-noble's current linux/amd64 image (checked on the registry 2026-10-27).","Docker Scout counts 91 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:ce8543ddd307…) with the platform digest it records for the base (sha256:4b027e62bb74…), which never match. This image's base is docker.io/library/eclipse-temurin:25-jre-noble's current linux/amd64 image (checked on the registry 2026-10-27)."}],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"kafka","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T12:54:15.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:d3f92612901df9e1b5427c406b7b4ddf8f46dcc56501ef558e7888fdd585eec4","first_failure":null,"detail":"published sha256:d3f92612901df9e1b5427c406b7b4ddf8f46dcc56501ef558e7888fdd585eec4 rebuilt sha256:d3f92612901df9e1b5427c406b7b4ddf8f46dcc56501ef558e7888fdd585eec4"},"evidence_at":"2026-10-27T13:34:04.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 91 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:ce8543ddd307…) with the platform digest it records for the base (sha256:4b027e62bb74…), which never match. This image's base is docker.io/library/eclipse-temurin:25-jre-noble's current linux/amd64 image (checked on the registry 2026-10-27).","Docker Scout counts 91 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:ce8543ddd307…) with the platform digest it records for the base (sha256:4b027e62bb74…), which never match. This image's base is docker.io/library/eclipse-temurin:25-jre-noble's current linux/amd64 image (checked on the registry 2026-10-27)."}]}},{"slug":"keycloak","docker_tag":"26.8.1-CE-ubuntu24.04-r1","available":true,"staging_path":"keycloak/26.8.1-CE-ubuntu24.04-r1","product_name":"Keycloak","scout_grade":"A","grade_basis":null,"released_at":"2026-10-20T22:58:30.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"26.8.1","category":"Open Source","description":"Single container: a Quarkus-based Identity and Access Management server (OpenID Connect / OAuth2 / SAML provider, admin console, account console). It REQUIRES an external PostgreSQL database that you provide: point the container at it with KC_DB_URL_HOST and KC_DB_URL_DATABASE (or one KC_DB_URL JDBC string) plus KC_DB_USERNAME and KC_DB_PASSWORD. The image was pre-built for PostgreSQL (`kc.sh build --db=postgres --health-enabled=true --metrics-enabled=true`) and is started with `start --optimized`; Keycloak creates and migrates its own schema in that database on first start. NOT a docker-compose-only or Kubernetes-only product, but it is NOT self-contained: PostgreSQL is a hard external dependency (this image is built for PostgreSQL only; `start-dev` with embedded H2 does not run in it).","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":3994,"type":"other"},{"path":"ReadyStack-keycloak-26.8.1-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1541,"type":"other"},{"path":"ReadyStack-keycloak-26.8.1-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2421,"type":"other"},{"path":"ReadyStack-keycloak-26.8.1-CE-ubuntu24.04-r1.tar.gz","size_bytes":2201014392,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4288,"type":"other"}],"promoted_at":"2026-10-20T22:58:30+00:00","promoted_by":"KitForge v3 (chain 570)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:004e57d43387770916aa38784d49136ae2ab76f9df9d10ee12bf0b48c87032d1","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":83,"grade_at":"2026-10-27","grade_reasons":["Base image docker.io/library/eclipse-temurin:21-jre-noble has been updated since this image was built: it was built on sha256:da0f0d242bec…, and the tag's current linux/amd64 image is sha256:de07a7c89a94….","Docker Scout counts 118 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"keycloak","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-20T22:24:40.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:004e57d43387770916aa38784d49136ae2ab76f9df9d10ee12bf0b48c87032d1","first_failure":null,"detail":"published sha256:004e57d43387770916aa38784d49136ae2ab76f9df9d10ee12bf0b48c87032d1 rebuilt sha256:004e57d43387770916aa38784d49136ae2ab76f9df9d10ee12bf0b48c87032d1"},"evidence_at":"2026-10-27T06:37:00.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-20","reasons":["Docker Scout counts 118 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:35501d3f9317…) with the platform digest it records for the base (sha256:da0f0d242bec…), which never match. This image's base is docker.io/library/eclipse-temurin:21-jre-noble's current linux/amd64 image (checked on the registry 2026-10-20).","Docker Scout counts 118 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:35501d3f9317…) with the platform digest it records for the base (sha256:da0f0d242bec…), which never match. This image's base is docker.io/library/eclipse-temurin:21-jre-noble's current linux/amd64 image (checked on the registry 2026-10-20)."}]}},{"slug":"kubernetes","docker_tag":"v1.37.1-CE-ubuntu24.04-r2","available":true,"staging_path":"kubernetes/v1.37.1-CE-ubuntu24.04-r2","product_name":"Kubernetes","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T08:54:19.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v1.37.1","category":"Open Source","description":"One container, two ways to run it. (1) Single-node cluster, started with --privileged --user 0 (the documented run command): etcd, kube-apiserver, kube-controller-manager and kube-scheduler run as the unprivileged user kube; containerd, kubelet and kube-proxy run as root, because a Kubernetes node needs root on Linux; CoreDNS answers cluster DNS and a ptp CNI network gives Pods addresses in 10.244.0.0/24. The node registers as Ready and runs Pods inside this container. (2) Control plane only, the image's default (no --privileged, no --user): etcd, kube-apiserver, kube-controller-manager and kube-scheduler as kube, with no node, so Pods are accepted but stay Pending. The control-plane components run as plain processes under supervisord with the flags kubeadm v1.37 uses; they are not static Pods. One node only: kubeadm join is not run and there is no way to add nodes.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5444,"type":"other"},{"path":"ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1466,"type":"other"},{"path":"ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2709,"type":"other"},{"path":"ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.tar.gz","size_bytes":605369312,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2904,"type":"other"}],"promoted_at":"2026-10-27T08:54:19+00:00","promoted_by":"KitForge v3 (chain 657)","chain_price_cents":1000,"runtime_privileges":{"privileges":["--privileged","--user 0"],"why":"Only for the single-node mode: containerd, kubelet and kube-proxy need root and the host's cgroup, mount and netfilter facilities, as a Kubernetes node does on any Linux host. The control plane still runs as the unprivileged user kube, and the default control-plane-only mode needs neither flag.","optional":true,"to_remove":"Upstream's rootless kubelet (not yet GA) would remove --user 0; the control-plane-only mode already needs nothing."},"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:fd30476fb8e96b42deaaafcb7ba25e0437b57c83ceeac7c6ae42572559ca20e7","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 118 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"999","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T05:21:46.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:fd30476fb8e96b42deaaafcb7ba25e0437b57c83ceeac7c6ae42572559ca20e7","first_failure":null,"detail":"published sha256:fd30476fb8e96b42deaaafcb7ba25e0437b57c83ceeac7c6ae42572559ca20e7 rebuilt sha256:fd30476fb8e96b42deaaafcb7ba25e0437b57c83ceeac7c6ae42572559ca20e7"},"evidence_at":"2026-10-27T09:01:02.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 118 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"loki","docker_tag":"v3.7.9-CE-ubuntu24.04-r3","available":true,"staging_path":"loki/v3.7.9-CE-ubuntu24.04-r3","product_name":"Loki","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T00:55:39.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v3.7.9","category":"Open Source","description":"Single container, single static Go binary running in single-binary monolithic mode (-target=all, all components in one process), foreground process. Log aggregation with the tsdb index + chunk object-store BOTH on the local filesystem under /loki; NO relational/SQL database, NO external object store, NO sidecar. The image IS the complete running instance.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5082,"type":"other"},{"path":"ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1432,"type":"other"},{"path":"ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":2853,"type":"other"},{"path":"ReadyStack-loki-v3.7.9-CE-ubuntu24.04-r3.tar.gz","size_bytes":661046399,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4198,"type":"other"}],"promoted_at":"2026-10-28T00:55:39+00:00","promoted_by":"KitForge v3 (chain 728)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:aa843955e1120ff14139e5d78014e0d11f158fb8f31eac25f09ced53537ebef5","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"loki","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T22:44:32.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:aa843955e1120ff14139e5d78014e0d11f158fb8f31eac25f09ced53537ebef5","first_failure":null,"detail":"published sha256:aa843955e1120ff14139e5d78014e0d11f158fb8f31eac25f09ced53537ebef5 rebuilt sha256:aa843955e1120ff14139e5d78014e0d11f158fb8f31eac25f09ced53537ebef5"},"evidence_at":"2026-10-28T00:59:56.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}]}},{"slug":"mariadb","docker_tag":"12.3.3-CE-ubuntu24.04-r3","available":true,"staging_path":"mariadb/12.3.3-CE-ubuntu24.04-r3","product_name":"MariaDB","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T08:30:07.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"12.3.3","category":"Open Source","description":"Single container. MariaDB Server 12.3.3 (12.3 LTS) compiled from the upstream source tag with CMake and installed in /usr/local/mariadb. The image is the whole database server: there is no external database and no sidecar, and Galera clustering is not compiled in. mariadbd runs in the foreground as the non-root mysql user. On the first start, when the data directory has no mysql subdirectory the entrypoint creates the data directory in /var/lib/mysql and sets the root password before the server opens a network port.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4894,"type":"other"},{"path":"ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1311,"type":"other"},{"path":"ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":3093,"type":"other"},{"path":"ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r3.tar.gz","size_bytes":357223000,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2069,"type":"other"}],"promoted_at":"2026-10-27T08:30:07+00:00","promoted_by":"KitForge v3 (chain 664)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:43d9277dd92c2000c5320f99122830a9edc04334686c5c6acfd2ea601be21ea6","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 82 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"mysql","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T05:27:38.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:43d9277dd92c2000c5320f99122830a9edc04334686c5c6acfd2ea601be21ea6","first_failure":null,"detail":"published sha256:43d9277dd92c2000c5320f99122830a9edc04334686c5c6acfd2ea601be21ea6 rebuilt sha256:43d9277dd92c2000c5320f99122830a9edc04334686c5c6acfd2ea601be21ea6"},"evidence_at":"2026-10-27T08:36:31.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 82 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"mattermost","docker_tag":"v12.0.1-CE-ubuntu24.04-r1","available":true,"staging_path":"mattermost/v12.0.1-CE-ubuntu24.04-r1","product_name":"Mattermost","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T04:09:34.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v12.0.1","category":"Open Source","description":"Single container running the mattermost server in the foreground, serving both the REST API and the compiled web client, against an EXTERNAL PostgreSQL 15 or later database (Mattermost 12 raised the minimum from 14; against an older server it logs `Unsupported Postgres version` at start and keeps running, which upstream does not support), which must be reachable by name from the container: a postgres container goes on a user-defined Docker network that the mattermost container joins too (on the default bridge network a container name such as your-db does not resolve and the server exits). This is Team Edition — the free, open-source edition — built from source with all Enterprise code removed rather than merely disabled.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":7027,"type":"other"},{"path":"ReadyStack-mattermost-v12.0.1-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1498,"type":"other"},{"path":"ReadyStack-mattermost-v12.0.1-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2565,"type":"other"},{"path":"ReadyStack-mattermost-v12.0.1-CE-ubuntu24.04-r1.tar.gz","size_bytes":1230996305,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4213,"type":"other"}],"promoted_at":"2026-10-28T04:09:34+00:00","promoted_by":"KitForge v3 (chain 704)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:faf91c14c282d1d073b724193f997144c4f03824016c5a6b3766a212ad1b1a8d","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 121 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 121 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"mattermost","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T16:24:38.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:faf91c14c282d1d073b724193f997144c4f03824016c5a6b3766a212ad1b1a8d","first_failure":null,"detail":"published sha256:faf91c14c282d1d073b724193f997144c4f03824016c5a6b3766a212ad1b1a8d rebuilt sha256:faf91c14c282d1d073b724193f997144c4f03824016c5a6b3766a212ad1b1a8d"},"evidence_at":"2026-10-28T04:23:01.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 121 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 121 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}]}},{"slug":"metabase","docker_tag":"v0.64.3.5-CE-ubuntu24.04-r1","available":true,"staging_path":"metabase/v0.64.3.5-CE-ubuntu24.04-r1","product_name":"Metabase","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T23:35:32.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v0.64.3.5","category":"Open Source","description":"Single container, SELF-CONTAINED. A JVM (Clojure) business-intelligence / analytics server (dashboards, 'questions', SQL editor) shipped as one self-contained uberjar (metabase.jar) on an eclipse-temurin 25 JRE. The application database defaults to an EMBEDDED H2 file the container creates + Liquibase-migrates itself on first boot — the image IS the complete running instance (NO external DB, NO sidecar, NO docker-compose required). For production scale Metabase can OPTIONALLY be pointed at an external PostgreSQL/MySQL application database via MB_DB_TYPE + MB_DB_* env vars, but that is optional; the default and certified single-container posture is embedded H2, but Metabase logs a warning at every start that H2 is not recommended for production, so back up /metabase-data regularly.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5225,"type":"other"},{"path":"ReadyStack-metabase-v0.64.3.5-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1486,"type":"other"},{"path":"ReadyStack-metabase-v0.64.3.5-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2613,"type":"other"},{"path":"ReadyStack-metabase-v0.64.3.5-CE-ubuntu24.04-r1.tar.gz","size_bytes":1830805515,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4291,"type":"other"}],"promoted_at":"2026-10-27T23:35:32+00:00","promoted_by":"KitForge v3 (chain 715)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:f8d26fce0c631e0baad7003a5f56195a777a122220312e636629850b0ef96edd","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 109 packages with copyleft licences (GPL, LGPL, MPL), 107 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:ce8543ddd307…) with the platform digest it records for the base (sha256:4b027e62bb74…), which never match. This image's base is docker.io/library/eclipse-temurin:25-jre-noble's current linux/amd64 image (checked on the registry 2026-10-27).","Docker Scout counts 109 packages with copyleft licences (GPL, LGPL, MPL), 107 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:ce8543ddd307…) with the platform digest it records for the base (sha256:4b027e62bb74…), which never match. This image's base is docker.io/library/eclipse-temurin:25-jre-noble's current linux/amd64 image (checked on the registry 2026-10-27)."}],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"metabase","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T21:03:21.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:f8d26fce0c631e0baad7003a5f56195a777a122220312e636629850b0ef96edd","first_failure":null,"detail":"published sha256:f8d26fce0c631e0baad7003a5f56195a777a122220312e636629850b0ef96edd rebuilt sha256:f8d26fce0c631e0baad7003a5f56195a777a122220312e636629850b0ef96edd"},"evidence_at":"2026-10-27T23:47:13.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 109 packages with copyleft licences (GPL, LGPL, MPL), 107 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:ce8543ddd307…) with the platform digest it records for the base (sha256:4b027e62bb74…), which never match. This image's base is docker.io/library/eclipse-temurin:25-jre-noble's current linux/amd64 image (checked on the registry 2026-10-27).","Docker Scout counts 109 packages with copyleft licences (GPL, LGPL, MPL), 107 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:ce8543ddd307…) with the platform digest it records for the base (sha256:4b027e62bb74…), which never match. This image's base is docker.io/library/eclipse-temurin:25-jre-noble's current linux/amd64 image (checked on the registry 2026-10-27)."}]}},{"slug":"mimir","docker_tag":"3.2.3-CE-ubuntu24.04-r2","available":true,"staging_path":"mimir/3.2.3-CE-ubuntu24.04-r2","product_name":"Mimir","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T05:43:15.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"3.2.3","category":"Open Source","description":"ReadyStack Mimir Community Edition build kit.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":3523,"type":"other"},{"path":"ReadyStack-mimir-3.2.3-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1432,"type":"other"},{"path":"ReadyStack-mimir-3.2.3-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":3045,"type":"other"},{"path":"ReadyStack-mimir-3.2.3-CE-ubuntu24.04-r2.tar.gz","size_bytes":512084608,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2066,"type":"other"}],"promoted_at":"2026-10-27T05:43:15+00:00","promoted_by":"KitForge v3 (chain 665)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:5bff66d33d8b284ff5eaf2b209d4ff78e0d90573b51de9e920ad7f3d912c9edf","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"mimir","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T05:22:59.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:5bff66d33d8b284ff5eaf2b209d4ff78e0d90573b51de9e920ad7f3d912c9edf","first_failure":null,"detail":"published sha256:5bff66d33d8b284ff5eaf2b209d4ff78e0d90573b51de9e920ad7f3d912c9edf rebuilt sha256:5bff66d33d8b284ff5eaf2b209d4ff78e0d90573b51de9e920ad7f3d912c9edf"},"evidence_at":"2026-10-27T05:48:09.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"miniflux","docker_tag":"2.3.4-CE-ubuntu24.04-r3","available":true,"staging_path":"miniflux/2.3.4-CE-ubuntu24.04-r3","product_name":"Miniflux","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T01:14:18.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"2.3.4","category":"Open Source","description":"ReadyStack Miniflux Community Edition build kit.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4788,"type":"other"},{"path":"ReadyStack-miniflux-2.3.4-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1494,"type":"other"},{"path":"ReadyStack-miniflux-2.3.4-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":2761,"type":"other"},{"path":"ReadyStack-miniflux-2.3.4-CE-ubuntu24.04-r3.tar.gz","size_bytes":455262698,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":1903,"type":"other"}],"promoted_at":"2026-10-28T01:14:18+00:00","promoted_by":"KitForge v3 (chain 721)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:c4809ba317e5a207d6fd40e32f311f08303124d00df4ebe3b96a51906decec86","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"miniflux","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T22:36:25.000Z","host":"prep5","network":"egress-blocked","rebuilt_digest":"sha256:c4809ba317e5a207d6fd40e32f311f08303124d00df4ebe3b96a51906decec86","first_failure":null,"detail":"published sha256:c4809ba317e5a207d6fd40e32f311f08303124d00df4ebe3b96a51906decec86 rebuilt sha256:c4809ba317e5a207d6fd40e32f311f08303124d00df4ebe3b96a51906decec86"},"evidence_at":"2026-10-28T01:17:00.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"minio","docker_tag":"RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r7","available":true,"staging_path":"minio/RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r7","product_name":"MinIO","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T01:04:29.000Z","built_from":{"kind":"source","label":"Built from upstream's source; the web Console's compiled React frontend is the prebuilt bundle that ships inside the github.com/minio/console Go module (//go:embed build/*), vendored with the Go dependencies; it is not built here"},"release_notes":true,"version":"RELEASE.2025-10-15T17-29-55Z","category":"Open Source","description":"Single container, single static Go binary (CGO-free), foreground process. S3-compatible OBJECT STORAGE: objects + metadata persisted on the local filesystem under /data (internal state under /data/.minio.sys). NO relational/SQL database. Embeds and serves a web Console (an object browser) on port 9001. The image IS the complete running instance (no docker-compose, no Kubernetes, no external DB). The entrypoint, /usr/local/bin/readystack-entrypoint.sh, works out the root password MinIO will use (from MINIO_ROOT_PASSWORD, a MINIO_ROOT_PASSWORD_FILE secret or MINIO_CONFIG_ENV_FILE), exits 1 if it is unset, blank or minioadmin (and also on other unusable credential input, for example a root user or password that starts with \"env\", a `*_FILE` secret or MINIO_CONFIG_ENV_FILE naming a missing or unreadable file, or an empty `*_FILE` secret), and then runs `minio` with the default arguments `server /data --address :9000 --console-address :9001`, which arguments after the image name replace.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":6598,"type":"other"},{"path":"ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r7.rebuild.json","size_bytes":1579,"type":"other"},{"path":"ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r7.rebuild.json.sigstore","size_bytes":2661,"type":"other"},{"path":"ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r7.tar.gz","size_bytes":515467460,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4222,"type":"other"}],"promoted_at":"2026-10-28T01:04:29+00:00","promoted_by":"KitForge v3 (chain 739)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:125ed6b550bc095a5d94e3e1ed5412918243f9a00b92aab957956d49a274e206","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"minio","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-28T00:54:22.000Z","host":"prep3","network":"egress-blocked","rebuilt_digest":"sha256:125ed6b550bc095a5d94e3e1ed5412918243f9a00b92aab957956d49a274e206","first_failure":null,"detail":"published sha256:125ed6b550bc095a5d94e3e1ed5412918243f9a00b92aab957956d49a274e206 rebuilt sha256:125ed6b550bc095a5d94e3e1ed5412918243f9a00b92aab957956d49a274e206"},"evidence_at":"2026-10-28T01:07:51.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}]}},{"slug":"moodle","docker_tag":"v5.3.0-CE-ubuntu24.04-r4","available":true,"staging_path":"moodle/v5.3.0-CE-ubuntu24.04-r4","product_name":"Moodle","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T10:12:27.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v5.3.0","category":"Open Source","description":"Single container (Apache + mod_php, one foreground process) running the Moodle LMS. It REQUIRES an EXTERNAL MySQL 8.4+ / MariaDB 11.4+ database the operator provisions and points the container at via DB_HOST/DB_PORT/DB_NAME/DB_USER/DB_PASS — there is NO embedded/SQLite database. On first start Moodle runs `php admin/cli/install.php` to create config.php + all module schema (a multi-minute one-time install). NOT a multi-service cluster, but NOT self-contained: a MySQL/MariaDB server is a hard external dependency, and moodledata + the DB must persist.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":3742,"type":"other"},{"path":"ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r4.rebuild.json","size_bytes":1212,"type":"other"},{"path":"ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r4.rebuild.json.sigstore","size_bytes":2757,"type":"other"},{"path":"ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r4.tar.gz","size_bytes":382998128,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2904,"type":"other"}],"promoted_at":"2026-10-27T10:12:27+00:00","promoted_by":"KitForge v3 (chain 668)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:7db55b5d94598d01488b16d7a5065e7ded89f7a2b534235f4e367b0c28d67a5c","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 134 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"www-data","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T07:28:47.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:7db55b5d94598d01488b16d7a5065e7ded89f7a2b534235f4e367b0c28d67a5c","first_failure":null,"detail":"published sha256:7db55b5d94598d01488b16d7a5065e7ded89f7a2b534235f4e367b0c28d67a5c rebuilt sha256:7db55b5d94598d01488b16d7a5065e7ded89f7a2b534235f4e367b0c28d67a5c"},"evidence_at":"2026-10-27T10:18:16.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 134 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"mysql","docker_tag":"9.7.4-CE-ubuntu24.04-r2","available":true,"staging_path":"mysql/9.7.4-CE-ubuntu24.04-r2","product_name":"MySQL","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T11:12:56.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"9.7.4","category":"Open Source","description":"Single container. MySQL Community Server 9.7.4 (9.7 LTS) compiled from the upstream source tag with CMake and installed in /usr/local/mysql. The image is the whole database server: there is no external database and no sidecar. mysqld runs in the foreground as the non-root mysql user. On the first start with an empty data directory the entrypoint creates the data directory in /var/lib/mysql and sets the root password before the server opens a network port.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4464,"type":"other"},{"path":"ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1280,"type":"other"},{"path":"ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2997,"type":"other"},{"path":"ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r2.tar.gz","size_bytes":1142170797,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2066,"type":"other"}],"promoted_at":"2026-10-27T11:12:56+00:00","promoted_by":"KitForge v3 (chain 669)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:3b3241325f4a473450857d565d0f4e82a2d60a29d7e06bf317db978f13fa7858","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 83 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"mysql","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T09:54:09.000Z","host":"prep5","network":"egress-blocked","rebuilt_digest":"sha256:3b3241325f4a473450857d565d0f4e82a2d60a29d7e06bf317db978f13fa7858","first_failure":null,"detail":"published sha256:3b3241325f4a473450857d565d0f4e82a2d60a29d7e06bf317db978f13fa7858 rebuilt sha256:3b3241325f4a473450857d565d0f4e82a2d60a29d7e06bf317db978f13fa7858"},"evidence_at":"2026-10-27T11:19:46.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 83 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"nats","docker_tag":"v2.15.2-CE-ubuntu24.04-r2","available":true,"staging_path":"nats/v2.15.2-CE-ubuntu24.04-r2","product_name":"NATS","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T03:28:45.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v2.15.2","category":"Open Source","description":"A single container running one NATS server (nats-server, one static Go binary) as the non-root nats user, with JetStream on. JetStream state is files under /data/jetstream; there is no separate database, no sidecar and no web UI. The nats command-line client is not in the image: use it (or any NATS client library) from outside, or the HTTP monitoring endpoints on port 8222.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4956,"type":"other"},{"path":"ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1479,"type":"other"},{"path":"ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2565,"type":"other"},{"path":"ReadyStack-nats-v2.15.2-CE-ubuntu24.04-r2.tar.gz","size_bytes":461609742,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":1898,"type":"other"}],"promoted_at":"2026-10-28T03:28:45+00:00","promoted_by":"KitForge v3 (chain 743)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:ed77bffbe5e2c9ab2740c0a09f618e1f6b62371a91523126bd975fa118dfbf02","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 11 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"nats","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-28T02:27:38.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:ed77bffbe5e2c9ab2740c0a09f618e1f6b62371a91523126bd975fa118dfbf02","first_failure":null,"detail":"published sha256:ed77bffbe5e2c9ab2740c0a09f618e1f6b62371a91523126bd975fa118dfbf02 rebuilt sha256:ed77bffbe5e2c9ab2740c0a09f618e1f6b62371a91523126bd975fa118dfbf02"},"evidence_at":"2026-10-28T03:31:58.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 11 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"netbox","docker_tag":"v4.7.3-CE-ubuntu24.04-r3","available":true,"staging_path":"netbox/v4.7.3-CE-ubuntu24.04-r3","product_name":"NetBox","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T08:31:57.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v4.7.3","category":"Open Source","description":"ONE product container (supervisord runs the gunicorn web server [:8080] + an RQ worker, which also runs NetBox's scheduled system jobs such as daily housekeeping) PLUS two required datastore sidecars the customer provides: a PostgreSQL server (15 or later — NetBox 4.7 drops PostgreSQL 14 support and needs the trusted `ltree` extension, installed automatically on first migrate) and a Redis instance (6.0 or later; used for both the task queue and caching). NOT a single self-contained image — NetBox is multi-service.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":3702,"type":"other"},{"path":"ReadyStack-netbox-v4.7.3-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1219,"type":"other"},{"path":"ReadyStack-netbox-v4.7.3-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":3093,"type":"other"},{"path":"ReadyStack-netbox-v4.7.3-CE-ubuntu24.04-r3.tar.gz","size_bytes":575960969,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2070,"type":"other"}],"promoted_at":"2026-10-27T08:31:57+00:00","promoted_by":"KitForge v3 (chain 670)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:0bc952bc8426a4d8c6d78ae90724f8e1b2e7eded75d5539380e6c5a1c29ecc58","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 110 packages with copyleft licences (GPL, LGPL, MPL), 106 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"netbox","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T07:57:34.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:0bc952bc8426a4d8c6d78ae90724f8e1b2e7eded75d5539380e6c5a1c29ecc58","first_failure":null,"detail":"published sha256:0bc952bc8426a4d8c6d78ae90724f8e1b2e7eded75d5539380e6c5a1c29ecc58 rebuilt sha256:0bc952bc8426a4d8c6d78ae90724f8e1b2e7eded75d5539380e6c5a1c29ecc58"},"evidence_at":"2026-10-27T08:37:14.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 110 packages with copyleft licences (GPL, LGPL, MPL), 106 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"nextcloud","docker_tag":"v35.0.2-CE-ubuntu24.04-r4","available":true,"staging_path":"nextcloud/v35.0.2-CE-ubuntu24.04-r4","product_name":"Nextcloud","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T01:05:11.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v35.0.2","category":"Open Source","description":"Single container (Apache + mod_php, one foreground process) running Nextcloud Server. SELF-CONTAINED: the database is a self-managed EMBEDDED SQLite file (owncloud.db) under /var/www/html/data — the image IS the complete running instance, no external DB and no sidecar required. (The image contains only the SQLite database driver; it cannot be pointed at an external MySQL/MariaDB or PostgreSQL database.) NOT a multi-service cluster, NOT docker-compose/Kubernetes-only.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4507,"type":"other"},{"path":"ReadyStack-nextcloud-v35.0.2-CE-ubuntu24.04-r4.rebuild.json","size_bytes":1162,"type":"other"},{"path":"ReadyStack-nextcloud-v35.0.2-CE-ubuntu24.04-r4.rebuild.json.sigstore","size_bytes":2853,"type":"other"},{"path":"ReadyStack-nextcloud-v35.0.2-CE-ubuntu24.04-r4.tar.gz","size_bytes":385197361,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4322,"type":"other"}],"promoted_at":"2026-10-28T01:05:11+00:00","promoted_by":"KitForge v3 (chain 734)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:7d2b7cb7f3ab3b18dbfee5cdb02fd70ed6cdc10fb71569f68c3036285c298613","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 140 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 135 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: icewind/searchdav, nextcloud/lognormalizer."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 140 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 135 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: icewind/searchdav, nextcloud/lognormalizer."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"www-data","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-28T00:03:53.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:7d2b7cb7f3ab3b18dbfee5cdb02fd70ed6cdc10fb71569f68c3036285c298613","first_failure":null,"detail":"published sha256:7d2b7cb7f3ab3b18dbfee5cdb02fd70ed6cdc10fb71569f68c3036285c298613 rebuilt sha256:7d2b7cb7f3ab3b18dbfee5cdb02fd70ed6cdc10fb71569f68c3036285c298613"},"evidence_at":"2026-10-28T01:10:26.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 140 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 135 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: icewind/searchdav, nextcloud/lognormalizer."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 140 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 135 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: icewind/searchdav, nextcloud/lognormalizer."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}]}},{"slug":"nginx","docker_tag":"1.31.8-CE-ubuntu24.04-r1","available":true,"staging_path":"nginx/1.31.8-CE-ubuntu24.04-r1","product_name":"NGINX","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T19:34:03.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"1.31.8","category":"Open Source","description":"Single container. The nginx master process is the container's main process (ENTRYPOINT /opt/nginx/sbin/nginx with the default arguments `-g 'daemon off;'`) and starts the worker processes. nginx is compiled from source by this image's build (./auto/configure, make, make install). No database, no sidecar and no state kept on disk: with no mounts at all, the shipped configuration (/etc/nginx/nginx.conf and /etc/nginx/conf.d/default.conf) serves upstream's welcome page and other static files from /usr/share/nginx/html on port 8080. Beyond that, what the server does is decided by the configuration you mount; it works as a web server, a reverse proxy, a TCP/UDP (stream) proxy and a mail proxy.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4634,"type":"other"},{"path":"ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1154,"type":"other"},{"path":"ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2665,"type":"other"},{"path":"ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r1.tar.gz","size_bytes":231359024,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2067,"type":"other"}],"promoted_at":"2026-10-27T19:34:03+00:00","promoted_by":"KitForge v3 (chain 717)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:a15dcfdc9d381a8f199efba6a96fa8683d39b0dd6d4b2e81423bb023da1d102c","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"nginx","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T19:20:32.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:a15dcfdc9d381a8f199efba6a96fa8683d39b0dd6d4b2e81423bb023da1d102c","first_failure":null,"detail":"published sha256:a15dcfdc9d381a8f199efba6a96fa8683d39b0dd6d4b2e81423bb023da1d102c rebuilt sha256:a15dcfdc9d381a8f199efba6a96fa8683d39b0dd6d4b2e81423bb023da1d102c"},"evidence_at":"2026-10-27T19:37:00.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"nodebb","docker_tag":"v4.16.4-CE-ubuntu24.04-r3","available":true,"staging_path":"nodebb/v4.16.4-CE-ubuntu24.04-r3","product_name":"NodeBB","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T23:56:03.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v4.16.4","category":"Open Source","description":"Single container running the NodeBB forum in the foreground against an EXTERNAL database (Valkey in this release's tested setup; NodeBB can also use Redis, MongoDB or PostgreSQL, untested here). Node.js application; the image contains no database.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4848,"type":"other"},{"path":"ReadyStack-nodebb-v4.16.4-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1213,"type":"other"},{"path":"ReadyStack-nodebb-v4.16.4-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":2901,"type":"other"},{"path":"ReadyStack-nodebb-v4.16.4-CE-ubuntu24.04-r3.tar.gz","size_bytes":404209319,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2902,"type":"other"}],"promoted_at":"2026-10-27T23:56:03+00:00","promoted_by":"KitForge v3 (chain 729)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:2fcef1179723d202929cc7e7805149f3127c64758d5789ac0fbbc009ad43f5c4","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 102 packages with copyleft licences (GPL, LGPL, MPL), 96 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"nodebb","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T22:46:22.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:2fcef1179723d202929cc7e7805149f3127c64758d5789ac0fbbc009ad43f5c4","first_failure":null,"detail":"published sha256:2fcef1179723d202929cc7e7805149f3127c64758d5789ac0fbbc009ad43f5c4 rebuilt sha256:2fcef1179723d202929cc7e7805149f3127c64758d5789ac0fbbc009ad43f5c4"},"evidence_at":"2026-10-28T00:01:51.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 102 packages with copyleft licences (GPL, LGPL, MPL), 96 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"openbao","docker_tag":"v2.7.2-CE-ubuntu24.04-r1","available":true,"staging_path":"openbao/v2.7.2-CE-ubuntu24.04-r1","product_name":"OpenBao","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T16:35:41.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v2.7.2","category":"Open Source","description":"Single container, single static Go binary. The image's ENTRYPOINT is `bao` and its default command is `server -config=/openbao/config/openbao.hcl`, a configuration shipped in the image: integrated (raft) storage in /openbao/data, a plain-HTTP listener on 0.0.0.0:8200 (tls_disable = true), api_addr http://127.0.0.1:8200 and cluster_addr http://127.0.0.1:8201 (cluster port 8201). The server starts uninitialized and sealed and has no built-in root token: nothing is usable until you initialize it once (`bao operator init` prints the unseal keys and the initial root token, only that once) and unseal it (`bao operator unseal`, once per key until the threshold, 3 of 5 by default). Secrets management, KV, dynamic secrets, PKI and transit encryption over the HTTP API on :8200. No SQL database, no sidecar. The web UI is not bundled; the API and the bao CLI are.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5512,"type":"other"},{"path":"ReadyStack-openbao-v2.7.2-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1486,"type":"other"},{"path":"ReadyStack-openbao-v2.7.2-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2565,"type":"other"},{"path":"ReadyStack-openbao-v2.7.2-CE-ubuntu24.04-r1.tar.gz","size_bytes":543730286,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2071,"type":"other"}],"promoted_at":"2026-10-27T16:35:41+00:00","promoted_by":"KitForge v3 (chain 700)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:73c9d5b6c471861ebbb1524e471c0c4dd64364ec3d873bee0572c06df3b6e4b8","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"openbao","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T16:25:15.000Z","host":"prep5","network":"egress-blocked","rebuilt_digest":"sha256:73c9d5b6c471861ebbb1524e471c0c4dd64364ec3d873bee0572c06df3b6e4b8","first_failure":null,"detail":"published sha256:73c9d5b6c471861ebbb1524e471c0c4dd64364ec3d873bee0572c06df3b6e4b8 rebuilt sha256:73c9d5b6c471861ebbb1524e471c0c4dd64364ec3d873bee0572c06df3b6e4b8"},"evidence_at":"2026-10-27T16:39:05.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"openproject","docker_tag":"v17.9.2-CE-ubuntu24.04-r1","available":true,"staging_path":"openproject/v17.9.2-CE-ubuntu24.04-r1","product_name":"OpenProject","scout_grade":"A","grade_basis":null,"released_at":"2026-10-21T02:49:23.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v17.9.2","category":"Open Source","description":"Two containers from this one image, plus your PostgreSQL: the web server (default command, Puma on port 8080, non-root user app) and the background worker (`./docker/prod/worker`, good_job). Both are required: jobs never run without the worker. A one-time seeder (`./docker/prod/seeder`) prepares an empty database. No PostgreSQL, memcached, Redis, Apache or hocuspocus inside the image.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5522,"type":"other"},{"path":"ReadyStack-openproject-v17.9.2-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1218,"type":"other"},{"path":"ReadyStack-openproject-v17.9.2-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2853,"type":"other"},{"path":"ReadyStack-openproject-v17.9.2-CE-ubuntu24.04-r1.tar.gz","size_bytes":1056501587,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4219,"type":"other"}],"promoted_at":"2026-10-21T02:49:23+00:00","promoted_by":"KitForge v3 (chain 552)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:e2307444c5adcc6d6454568f8cfa2fe436ba2c6f36a0efea6105775ff9986a03","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":83,"grade_at":"2026-10-27","grade_reasons":["Base image docker.io/library/ubuntu:24.04 has been updated since this image was built: it was built on sha256:a2d43bffc466…, and the tag's current linux/amd64 image is sha256:78d4744ead1f….","Docker Scout counts 157 packages with copyleft licences (CDDL, GPL, LGPL, MPL), 146 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"app","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-20T22:02:31.000Z","host":"prep5","network":"egress-blocked","rebuilt_digest":"sha256:e2307444c5adcc6d6454568f8cfa2fe436ba2c6f36a0efea6105775ff9986a03","first_failure":null,"detail":"published sha256:e2307444c5adcc6d6454568f8cfa2fe436ba2c6f36a0efea6105775ff9986a03 rebuilt sha256:e2307444c5adcc6d6454568f8cfa2fe436ba2c6f36a0efea6105775ff9986a03"},"evidence_at":"2026-10-27T07:27:19.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-21","reasons":["Docker Scout counts 157 packages with copyleft licences (CDDL, GPL, LGPL, MPL), 146 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-21).","Docker Scout counts 157 packages with copyleft licences (CDDL, GPL, LGPL, MPL), 146 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-21)."}]}},{"slug":"opensearch","docker_tag":"3.9.0-CE-ubuntu24.04-r3","available":true,"staging_path":"opensearch/3.9.0-CE-ubuntu24.04-r3","product_name":"OpenSearch","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T02:53:37.000Z","built_from":{"kind":"prebuilt","label":"Repackaged from upstream's prebuilt release; nothing compiled from source"},"release_notes":true,"version":"3.9.0","category":"Open Source","description":"Single container, JVM (system OpenJDK 21) search + analytics engine, foreground `bin/opensearch`. HTTP REST API on :9200, transport on :9300. Indices persist under /opt/opensearch/data. NO SQL DB, NO sidecar (single-node). This is the OpenSearch ENGINE only (OpenSearch Dashboards is a separate product). The lean CE image drops the bundled JDK (uses our dist-upgraded system OpenJDK 21) and the two heavy security/security-analytics plugins.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4188,"type":"other"},{"path":"ReadyStack-opensearch-3.9.0-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1166,"type":"other"},{"path":"ReadyStack-opensearch-3.9.0-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":3045,"type":"other"},{"path":"ReadyStack-opensearch-3.9.0-CE-ubuntu24.04-r3.tar.gz","size_bytes":1150499291,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2077,"type":"other"}],"promoted_at":"2026-10-28T02:53:37+00:00","promoted_by":"KitForge v3 (chain 714)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:cfeedc2623aba884b8fe03dee8146d237c801f68f985935b344eeaace425136b","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 104 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"opensearch","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-28T01:21:59.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:cfeedc2623aba884b8fe03dee8146d237c801f68f985935b344eeaace425136b","first_failure":null,"detail":"published sha256:cfeedc2623aba884b8fe03dee8146d237c801f68f985935b344eeaace425136b rebuilt sha256:cfeedc2623aba884b8fe03dee8146d237c801f68f985935b344eeaace425136b"},"evidence_at":"2026-10-28T03:02:39.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 104 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"otelcol","docker_tag":"v0.164.0-CE-ubuntu24.04-r1","available":true,"staging_path":"otelcol/v0.164.0-CE-ubuntu24.04-r1","product_name":"OpenTelemetry Collector","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T01:18:14.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v0.164.0","category":"Open Source","description":"Single container, single static Go binary (`otelcol --config /etc/otelcol/config.yaml`) in the foreground. A stateless telemetry pipeline: it receives traces, metrics and logs, processes them and forwards them to the backends you configure. It stores nothing itself: no database, no web UI, no query API.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":6119,"type":"other"},{"path":"ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1433,"type":"other"},{"path":"ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2757,"type":"other"},{"path":"ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.tar.gz","size_bytes":469752155,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2073,"type":"other"}],"promoted_at":"2026-10-28T01:18:14+00:00","promoted_by":"KitForge v3 (chain 708)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:59a91de832a64a1aff37b7303e5053383dda6b83d81776710791b9d4f2d231e4","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"otelcol","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T17:49:00.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:59a91de832a64a1aff37b7303e5053383dda6b83d81776710791b9d4f2d231e4","first_failure":null,"detail":"published sha256:59a91de832a64a1aff37b7303e5053383dda6b83d81776710791b9d4f2d231e4 rebuilt sha256:59a91de832a64a1aff37b7303e5053383dda6b83d81776710791b9d4f2d231e4"},"evidence_at":"2026-10-28T01:21:47.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"paperlessngx","docker_tag":"v3.3.4-CE-ubuntu24.04-r4","available":true,"staging_path":"paperlessngx/v3.3.4-CE-ubuntu24.04-r4","product_name":"Paperless-ngx","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T01:28:07.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v3.3.4","category":"Open Source","description":"ONE product container (supervisord runs the granian ASGI webserver [:8000] + a Celery worker + Celery beat scheduler + the document consumer) PLUS two required datastore sidecars the customer provides: a PostgreSQL server and a Redis broker. NOT a single self-contained image — Paperless is multi-service. This lean CE image ships only English OCR (tesseract-ocr-eng); other languages need an image built with extra tesseract-ocr-<lang> packages, which the archive's offline rebuild does not do (it reproduces this English-only image).","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5130,"type":"other"},{"path":"ReadyStack-paperlessngx-v3.3.4-CE-ubuntu24.04-r4.rebuild.json","size_bytes":1225,"type":"other"},{"path":"ReadyStack-paperlessngx-v3.3.4-CE-ubuntu24.04-r4.rebuild.json.sigstore","size_bytes":2901,"type":"other"},{"path":"ReadyStack-paperlessngx-v3.3.4-CE-ubuntu24.04-r4.tar.gz","size_bytes":2449644255,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4377,"type":"other"}],"promoted_at":"2026-10-28T01:28:07+00:00","promoted_by":"KitForge v3 (chain 723)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:3592e6f6da0d61d05c7030522e63614dc9390867c5d439455fce62edc9d01510","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 226 packages with copyleft licences (AGPL, CDDL, GPL, LGPL, MPL), 216 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: fonts-urw-base35, ghostscript, jbig2dec, libgs-common, libgs10."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 226 packages with copyleft licences (AGPL, CDDL, GPL, LGPL, MPL), 216 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: fonts-urw-base35, ghostscript, jbig2dec, libgs-common, libgs10."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"paperless","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T22:34:39.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:3592e6f6da0d61d05c7030522e63614dc9390867c5d439455fce62edc9d01510","first_failure":null,"detail":"published sha256:3592e6f6da0d61d05c7030522e63614dc9390867c5d439455fce62edc9d01510 rebuilt sha256:3592e6f6da0d61d05c7030522e63614dc9390867c5d439455fce62edc9d01510"},"evidence_at":"2026-10-28T01:41:00.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 226 packages with copyleft licences (AGPL, CDDL, GPL, LGPL, MPL), 216 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: fonts-urw-base35, ghostscript, jbig2dec, libgs-common, libgs10."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 226 packages with copyleft licences (AGPL, CDDL, GPL, LGPL, MPL), 216 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: fonts-urw-base35, ghostscript, jbig2dec, libgs-common, libgs10."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}]}},{"slug":"portainer","docker_tag":"2.45.3-CE-ubuntu24.04-r1","available":true,"staging_path":"portainer/2.45.3-CE-ubuntu24.04-r1","product_name":"Portainer","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T17:12:13.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"2.45.3","category":"Open Source","description":"Single container, one static CGO-free Go binary (`portainer`) that serves a web UI + a REST API + an Edge reverse-tunnel server, all in one foreground process. Portainer is a container-management GUI for Docker / Docker Swarm / Kubernetes. ALL state - users, environments, stacks, settings, edge configs - lives in an EMBEDDED bbolt key-value database at /data/portainer.db that the server creates + migrates itself; NO external/relational DB, NO docker-compose, NO sidecar. The on-disk web frontend (dist/public) is served from /opt/portainer/public. The image IS the complete running instance.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":7712,"type":"other"},{"path":"ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1442,"type":"other"},{"path":"ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2805,"type":"other"},{"path":"ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r1.tar.gz","size_bytes":481107739,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2907,"type":"other"}],"promoted_at":"2026-10-27T17:12:13+00:00","promoted_by":"KitForge v3 (chain 707)","chain_price_cents":1000,"runtime_privileges":{"privileges":["docker.sock"],"why":"To manage the Docker engine on its own host, Portainer mounts the host's Docker socket (and joins the socket's group), which gives control of that engine and so of the host. Portainer itself runs as the unprivileged user portainer.","optional":true,"to_remove":"Leave out the socket mount and --group-add: Portainer then manages remote environments only."},"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:a2cbe2d511c57174efe65263c59e63f50b081168921f328977e8665e8b3c9e34","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"portainer","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T16:40:13.000Z","host":"prep3","network":"egress-blocked","rebuilt_digest":"sha256:a2cbe2d511c57174efe65263c59e63f50b081168921f328977e8665e8b3c9e34","first_failure":null,"detail":"published sha256:a2cbe2d511c57174efe65263c59e63f50b081168921f328977e8665e8b3c9e34 rebuilt sha256:a2cbe2d511c57174efe65263c59e63f50b081168921f328977e8665e8b3c9e34"},"evidence_at":"2026-10-27T17:15:47.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"postgresql","docker_tag":"18.6-CE-ubuntu24.04-r4","available":true,"staging_path":"postgresql/18.6-CE-ubuntu24.04-r4","product_name":"PostgreSQL","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T03:06:04.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"18.6","category":"Open Source","description":"Single container. A self-contained PostgreSQL 18.6 object-relational database server, compiled from source (./configure && make world-bin && make install-world-bin). The image IS the complete running instance — PostgreSQL itself IS the database, so there is NO external database and NO sidecar. On first boot the entrypoint runs initdb to create the cluster under PGDATA (/var/lib/postgresql/data), then runs `postgres` in the foreground. Runs fully NON-ROOT as the postgres user.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4523,"type":"other"},{"path":"ReadyStack-postgresql-18.6-CE-ubuntu24.04-r4.rebuild.json","size_bytes":1237,"type":"other"},{"path":"ReadyStack-postgresql-18.6-CE-ubuntu24.04-r4.rebuild.json.sigstore","size_bytes":2853,"type":"other"},{"path":"ReadyStack-postgresql-18.6-CE-ubuntu24.04-r4.tar.gz","size_bytes":335954713,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4206,"type":"other"}],"promoted_at":"2026-10-28T03:06:04+00:00","promoted_by":"KitForge v3 (chain 718)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:183750538702ff27776350942f3d4676c8000b695960afd21d392f13cbfe37ff","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 87 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 87 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"postgres","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T20:03:50.000Z","host":"prep5","network":"egress-blocked","rebuilt_digest":"sha256:183750538702ff27776350942f3d4676c8000b695960afd21d392f13cbfe37ff","first_failure":null,"detail":"published sha256:183750538702ff27776350942f3d4676c8000b695960afd21d392f13cbfe37ff rebuilt sha256:183750538702ff27776350942f3d4676c8000b695960afd21d392f13cbfe37ff"},"evidence_at":"2026-10-28T03:09:31.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 87 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 87 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}]}},{"slug":"posthog","docker_tag":"master-20261022-b904ac8-CE-ubuntu24.04-r1","available":true,"staging_path":"posthog/master-20261022-b904ac8-CE-ubuntu24.04-r1","product_name":"PostHog","scout_grade":"A","grade_basis":null,"released_at":"2026-10-24T20:30:39.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"master-20261022-b904ac8","category":"Open Source","description":"One image, one PostHog role per container (the command argument), all as the non-root user posthog (uid 10001): allinone (default) runs every PostHog process in one container for a single host: Caddy on :8000 (the one HTTP port), the Django web app (granian) and Celery worker+scheduler, the Node ingestion server, and the Rust capture, feature-flags, property-defs and personhog services. The roles web, worker, ingestion, plugins, capture, feature-flags, property-defs, personhog-replica, personhog-router, proxy and migrate run the same processes one per container. PostgreSQL, Redis-protocol cache (Valkey), Apache Kafka and ClickHouse are not in the image: you run them (the run command starts all four as containers).","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5243,"type":"other"},{"path":"ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1256,"type":"other"},{"path":"ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2905,"type":"other"},{"path":"ReadyStack-posthog-master-20261022-b904ac8-CE-ubuntu24.04-r1.tar.gz","size_bytes":3049471772,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4223,"type":"other"}],"promoted_at":"2026-10-24T20:30:39+00:00","promoted_by":"KitForge v3 (chain 630)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:e5edff2d616054b702512e27673c159243f51576ab0275d8650d0ad1e37a3f58","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":83,"grade_at":"2026-10-27","grade_reasons":["Base image docker.io/library/ubuntu:24.04 has been updated since this image was built: it was built on sha256:a2d43bffc466…, and the tag's current linux/amd64 image is sha256:78d4744ead1f….","Docker Scout counts 115 packages with copyleft licences (GPL, LGPL, MPL), 103 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"posthog","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-24T15:14:47.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:e5edff2d616054b702512e27673c159243f51576ab0275d8650d0ad1e37a3f58","first_failure":null,"detail":"published sha256:e5edff2d616054b702512e27673c159243f51576ab0275d8650d0ad1e37a3f58 rebuilt sha256:e5edff2d616054b702512e27673c159243f51576ab0275d8650d0ad1e37a3f58"},"evidence_at":"2026-10-27T08:16:51.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-24","reasons":["Docker Scout counts 115 packages with copyleft licences (GPL, LGPL, MPL), 103 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-24).","Docker Scout counts 115 packages with copyleft licences (GPL, LGPL, MPL), 103 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-24)."}]}},{"slug":"prometheus","docker_tag":"v3.15.1-CE-ubuntu24.04-r2","available":true,"staging_path":"prometheus/v3.15.1-CE-ubuntu24.04-r2","product_name":"Prometheus","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T09:46:40.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v3.15.1","category":"Open Source","description":"Single container, single static Go binary, foreground process. Own embedded time-series database (TSDB) on disk; no relational database.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4770,"type":"other"},{"path":"ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1443,"type":"other"},{"path":"ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2901,"type":"other"},{"path":"ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r2.tar.gz","size_bytes":612480734,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2910,"type":"other"}],"promoted_at":"2026-10-27T09:46:40+00:00","promoted_by":"KitForge v3 (chain 676)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:859f3a39ea35ec408206ed6e6f17f65a4242cf8b57b706a312814d7b1553274b","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"prometheus","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T09:26:27.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:859f3a39ea35ec408206ed6e6f17f65a4242cf8b57b706a312814d7b1553274b","first_failure":null,"detail":"published sha256:859f3a39ea35ec408206ed6e6f17f65a4242cf8b57b706a312814d7b1553274b rebuilt sha256:859f3a39ea35ec408206ed6e6f17f65a4242cf8b57b706a312814d7b1553274b"},"evidence_at":"2026-10-27T09:52:08.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"qdrant","docker_tag":"v1.19.2-CE-ubuntu24.04-r1","available":true,"staging_path":"qdrant/v1.19.2-CE-ubuntu24.04-r1","product_name":"Qdrant","scout_grade":"A","grade_basis":null,"released_at":"2026-10-20T23:33:59.000Z","built_from":{"kind":"source","label":"Built from upstream's source; the web dashboard is upstream's prebuilt qdrant-web-ui v0.2.18 release"},"release_notes":true,"version":"v1.19.2","category":"Open Source","description":"Single self-contained container. Embedded on-disk storage, no datastore sidecar.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4417,"type":"other"},{"path":"ReadyStack-qdrant-v1.19.2-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1431,"type":"other"},{"path":"ReadyStack-qdrant-v1.19.2-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2757,"type":"other"},{"path":"ReadyStack-qdrant-v1.19.2-CE-ubuntu24.04-r1.tar.gz","size_bytes":957696542,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":3371,"type":"other"}],"promoted_at":"2026-10-20T23:33:59+00:00","promoted_by":"KitForge v3 (chain 456)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:29caea2180dd669eda1af4c9220fcb5ca334feb81c086a9416924e7579c4493a","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":83,"grade_at":"2026-10-27","grade_reasons":["Base image docker.io/library/ubuntu:24.04 has been updated since this image was built: it was built on sha256:a2d43bffc466…, and the tag's current linux/amd64 image is sha256:78d4744ead1f….","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"qdrant","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-20T22:49:20.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:29caea2180dd669eda1af4c9220fcb5ca334feb81c086a9416924e7579c4493a","first_failure":null,"detail":"published sha256:29caea2180dd669eda1af4c9220fcb5ca334feb81c086a9416924e7579c4493a rebuilt sha256:29caea2180dd669eda1af4c9220fcb5ca334feb81c086a9416924e7579c4493a"},"evidence_at":"2026-10-27T08:23:42.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-20","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-20).","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-20)."}]}},{"slug":"rabbitmq","docker_tag":"4.4.0-CE-ubuntu24.04-r2","available":true,"staging_path":"rabbitmq/4.4.0-CE-ubuntu24.04-r2","product_name":"RabbitMQ","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T10:23:27.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"4.4.0","category":"Open Source","description":"Single container running a single-node RabbitMQ broker: the rabbitmq-server launcher script (PID 1) starts one self-contained Erlang/OTP VM (the BEAM VM). RabbitMQ IS its own datastore: an embedded metadata store (Khepri; the `khepri_db` feature flag is enabled) plus the message/queue store, all on the local filesystem under /var/lib/rabbitmq. NO relational/SQL database, NO external store, NO sidecar. The rabbitmq_management (UI + REST API) and rabbitmq_prometheus (metrics) plugins are enabled at build time. The image IS the complete running instance.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4435,"type":"other"},{"path":"ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1157,"type":"other"},{"path":"ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2901,"type":"other"},{"path":"ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r2.tar.gz","size_bytes":457298488,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2904,"type":"other"}],"promoted_at":"2026-10-27T10:23:27+00:00","promoted_by":"KitForge v3 (chain 677)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:d1bb0cfc83942898f836cc5d6bc5ad0e5ea678ec8a44259cced81d33c1b8c6fc","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"rabbitmq","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T10:11:59.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:d1bb0cfc83942898f836cc5d6bc5ad0e5ea678ec8a44259cced81d33c1b8c6fc","first_failure":null,"detail":"published sha256:d1bb0cfc83942898f836cc5d6bc5ad0e5ea678ec8a44259cced81d33c1b8c6fc rebuilt sha256:d1bb0cfc83942898f836cc5d6bc5ad0e5ea678ec8a44259cced81d33c1b8c6fc"},"evidence_at":"2026-10-27T10:27:23.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"rancher","docker_tag":"v2.15.2-CE-ubuntu24.04-r2","available":true,"staging_path":"rancher/v2.15.2-CE-ubuntu24.04-r2","product_name":"Rancher","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T11:58:37.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v2.15.2","category":"Open Source","description":"SINGLE container, upstream's Docker install: the rancher server process starts an embedded k3s (Kubernetes v1.36.5, server and agent, embedded etcd) and installs its system charts (rancher-webhook, Fleet, system-upgrade-controller, Rancher Turtles, cluster-api) into that local cluster as pods. Unlike upstream's image it runs as the NON-ROOT user rancher (uid 1001): Rancher, k3s and the pods run inside a rootlesskit user namespace (root only inside it; on the host every process is uid 1001 or a subordinate uid 100000-165535), networked through slirp4netns, with ports 80 and 443 forwarded. It still needs docker run --privileged, like upstream's image.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4967,"type":"other"},{"path":"ReadyStack-rancher-v2.15.2-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1436,"type":"other"},{"path":"ReadyStack-rancher-v2.15.2-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2901,"type":"other"},{"path":"ReadyStack-rancher-v2.15.2-CE-ubuntu24.04-r2.tar.gz","size_bytes":1284609000,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2905,"type":"other"}],"promoted_at":"2026-10-27T11:58:37+00:00","promoted_by":"KitForge v3 (chain 678)","chain_price_cents":1000,"runtime_privileges":{"privileges":["--privileged"],"why":"Single-container Rancher runs an embedded k3s cluster whose containerd and kubelet need the host's cgroup, mount and netfilter facilities. The Rancher server process runs as the unprivileged user rancher.","optional":false,"to_remove":"Run Rancher on an existing Kubernetes cluster (upstream's Helm install) instead of the embedded k3s, or k3s's rootless mode once it supports Rancher."},"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:a4eba327f34b2f0103f9880fa0e13cebc543bb2e813b279c416a220bf2f5dbf4","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 139 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"rancher","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T11:20:49.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:a4eba327f34b2f0103f9880fa0e13cebc543bb2e813b279c416a220bf2f5dbf4","first_failure":null,"detail":"published sha256:a4eba327f34b2f0103f9880fa0e13cebc543bb2e813b279c416a220bf2f5dbf4 rebuilt sha256:a4eba327f34b2f0103f9880fa0e13cebc543bb2e813b279c416a220bf2f5dbf4"},"evidence_at":"2026-10-27T12:08:40.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 139 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"redash","docker_tag":"v26.9.0-CE-ubuntu24.04-r3","available":true,"staging_path":"redash/v26.9.0-CE-ubuntu24.04-r3","product_name":"Redash","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T14:22:25.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v26.9.0","category":"Open Source","description":"ONE product container (supervisord runs the gunicorn web server [:5000] + an RQ worker listening on all six queues + the RQ scheduler) PLUS two required datastore sidecars the customer provides: PostgreSQL and Redis. NOT self-contained. This LEAN CE image ships the MAIN dependency set only: the ~45 optional datasource drivers of upstream's all_ds group (snowflake, cassandra, mysqlclient, pandas, etc.), the GPL-conflicting ldap3 extra, and the proprietary msodbcsql18/Simba ODBC drivers are NOT included — query runners degrade gracefully (a runner is enabled only when its Python driver imports). PostgreSQL/JSON/URL/Prometheus/Elasticsearch/ClickHouse-class runners work out of the box; MySQL and CSV are not available (their drivers, mysqlclient and pandas, are in all_ds), and the Microsoft SQL Server (ODBC) and Databricks types are listed (their Python driver, pyodbc, is installed) but cannot connect, because no ODBC driver is installed.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4003,"type":"other"},{"path":"ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1220,"type":"other"},{"path":"ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":2949,"type":"other"},{"path":"ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r3.tar.gz","size_bytes":574106055,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2903,"type":"other"}],"promoted_at":"2026-10-27T14:22:25+00:00","promoted_by":"KitForge v3 (chain 686)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:b3c9ce83782aca3c67fa2946c8d721523e2b78c0906edde5293ced895ea3d4c5","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 104 packages with copyleft licences (GPL, LGPL, MPL), 103 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"redash","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T13:28:19.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:b3c9ce83782aca3c67fa2946c8d721523e2b78c0906edde5293ced895ea3d4c5","first_failure":null,"detail":"published sha256:b3c9ce83782aca3c67fa2946c8d721523e2b78c0906edde5293ced895ea3d4c5 rebuilt sha256:b3c9ce83782aca3c67fa2946c8d721523e2b78c0906edde5293ced895ea3d4c5"},"evidence_at":"2026-10-27T14:26:37.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 104 packages with copyleft licences (GPL, LGPL, MPL), 103 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"redis","docker_tag":"8.10.2-CE-ubuntu24.04-r3","available":true,"staging_path":"redis/8.10.2-CE-ubuntu24.04-r3","product_name":"Redis","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T14:45:08.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"8.10.2","category":"Open Source","description":"Single container, single self-contained C binary (redis-server) compiled from source, foreground process (PID 1). An in-memory key-value data store; state persists to disk as an RDB snapshot (and optionally an AOF) under /data. NO relational/SQL database, NO external datastore, NO sidecar. The image IS the complete running instance (no docker-compose, no cluster).","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4004,"type":"other"},{"path":"ReadyStack-redis-8.10.2-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1273,"type":"other"},{"path":"ReadyStack-redis-8.10.2-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":2517,"type":"other"},{"path":"ReadyStack-redis-8.10.2-CE-ubuntu24.04-r3.tar.gz","size_bytes":234121740,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2899,"type":"other"}],"promoted_at":"2026-10-27T14:45:08+00:00","promoted_by":"KitForge v3 (chain 697)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:05497f9a42527131301397a1a760fc62d443eceafa86a10b0a15dfe890d29b90","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 83 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"redis","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T14:17:07.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:05497f9a42527131301397a1a760fc62d443eceafa86a10b0a15dfe890d29b90","first_failure":null,"detail":"published sha256:05497f9a42527131301397a1a760fc62d443eceafa86a10b0a15dfe890d29b90 rebuilt sha256:05497f9a42527131301397a1a760fc62d443eceafa86a10b0a15dfe890d29b90"},"evidence_at":"2026-10-27T14:47:47.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 83 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"registry","docker_tag":"v3.1.2-CE-ubuntu24.04-r4","available":true,"staging_path":"registry/v3.1.2-CE-ubuntu24.04-r4","product_name":"Distribution Registry","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T11:23:36.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v3.1.2","category":"Open Source","description":"Single container, single static Go binary (`registry serve /etc/distribution/config.yml`) in the foreground. Stores image layers and manifests on the local filesystem under /var/lib/registry; no database, no web UI, no sidecar.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4864,"type":"other"},{"path":"ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r4.rebuild.json","size_bytes":1431,"type":"other"},{"path":"ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r4.rebuild.json.sigstore","size_bytes":2905,"type":"other"},{"path":"ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r4.tar.gz","size_bytes":467802201,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2073,"type":"other"}],"promoted_at":"2026-10-27T11:23:36+00:00","promoted_by":"KitForge v3 (chain 687)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:d6436e0a56df3d46a2e500ca816766af0a6661c4c45122cd9797c52082ecf837","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"registry","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T11:04:31.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:d6436e0a56df3d46a2e500ca816766af0a6661c4c45122cd9797c52082ecf837","first_failure":null,"detail":"published sha256:d6436e0a56df3d46a2e500ca816766af0a6661c4c45122cd9797c52082ecf837 rebuilt sha256:d6436e0a56df3d46a2e500ca816766af0a6661c4c45122cd9797c52082ecf837"},"evidence_at":"2026-10-27T11:26:46.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"seaweedfs","docker_tag":"4.48-CE-ubuntu24.04-r3","available":true,"staging_path":"seaweedfs/4.48-CE-ubuntu24.04-r3","product_name":"SeaweedFS","scout_grade":"A","grade_basis":null,"released_at":"2026-10-21T19:12:20.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"4.48","category":"Open Source","description":"Single container, single static Go binary (weed, CGO-free), foreground `weed server -s3`. Master+volume+filer+S3 in one process: the S3 API on :8333 is the one port meant for clients; the filer, master and volume server listen on the container's loopback interface only (see Ports in the handbooks). Object storage — data + metadata under /data. NO SQL DB, NO sidecar (production scales master/volume/filer as separate roles; this image is the single-node S3 endpoint).","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4535,"type":"other"},{"path":"ReadyStack-seaweedfs-4.48-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1526,"type":"other"},{"path":"ReadyStack-seaweedfs-4.48-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":2565,"type":"other"},{"path":"ReadyStack-seaweedfs-4.48-CE-ubuntu24.04-r3.tar.gz","size_bytes":667214473,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":3374,"type":"other"}],"promoted_at":"2026-10-21T19:12:20+00:00","promoted_by":"KitForge v3 (chain 595)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:a3bbf3db560f5cd2b58d0e7120aa312db98a711192a0f60a51d6ffe3cf343f05","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":83,"grade_at":"2026-10-27","grade_reasons":["Base image docker.io/library/ubuntu:24.04 has been updated since this image was built: it was built on sha256:a2d43bffc466…, and the tag's current linux/amd64 image is sha256:78d4744ead1f….","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"seaweedfs","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-21T18:49:48.000Z","host":"prep3","network":"egress-blocked","rebuilt_digest":"sha256:a3bbf3db560f5cd2b58d0e7120aa312db98a711192a0f60a51d6ffe3cf343f05","first_failure":null,"detail":"published sha256:a3bbf3db560f5cd2b58d0e7120aa312db98a711192a0f60a51d6ffe3cf343f05 rebuilt sha256:a3bbf3db560f5cd2b58d0e7120aa312db98a711192a0f60a51d6ffe3cf343f05"},"evidence_at":"2026-10-27T08:34:00.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-21","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-21).","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-21)."}]}},{"slug":"superset","docker_tag":"6.1.0-CE-ubuntu24.04-r3","available":true,"staging_path":"superset/6.1.0-CE-ubuntu24.04-r3","product_name":"Apache Superset","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T00:41:44.000Z","built_from":{"kind":"artifact","label":"Built from upstream's published release package, not its source tree"},"release_notes":true,"version":"6.1.0","category":"Open Source","description":"ONE container running Superset's web server (gunicorn, non-root user superset, port 8088) PLUS a PostgreSQL database you provide for Superset's own metadata (users, dashboards, charts, saved queries). The image has no database server, no Redis and no Celery worker: caching is off (NullCache) and async queries, alerts, reports and thumbnails stay disabled unless you add Redis and a worker yourself. Every start runs `superset db upgrade` and `superset init` before the server listens.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5432,"type":"other"},{"path":"ReadyStack-superset-6.1.0-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1213,"type":"other"},{"path":"ReadyStack-superset-6.1.0-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":2709,"type":"other"},{"path":"ReadyStack-superset-6.1.0-CE-ubuntu24.04-r3.tar.gz","size_bytes":823976061,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2905,"type":"other"}],"promoted_at":"2026-10-28T00:41:44+00:00","promoted_by":"KitForge v3 (chain 688)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:fd2c79e95d1ed0767a0c89f0a7de674bc93481c522d49ee1e5fea57731e32c69","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 102 packages with copyleft licences (GPL, LGPL, MPL), 101 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"superset","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T18:38:42.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:fd2c79e95d1ed0767a0c89f0a7de674bc93481c522d49ee1e5fea57731e32c69","first_failure":null,"detail":"published sha256:fd2c79e95d1ed0767a0c89f0a7de674bc93481c522d49ee1e5fea57731e32c69 rebuilt sha256:fd2c79e95d1ed0767a0c89f0a7de674bc93481c522d49ee1e5fea57731e32c69"},"evidence_at":"2026-10-28T00:48:30.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 102 packages with copyleft licences (GPL, LGPL, MPL), 101 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"syncthing","docker_tag":"v2.1.7-CE-ubuntu24.04-r2","available":true,"staging_path":"syncthing/v2.1.7-CE-ubuntu24.04-r2","product_name":"Syncthing","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T11:31:03.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v2.1.7","category":"Open Source","description":"Single container running syncthing (pure-Go, CGO-free) as the non-root syncthing user (uid 999); syncthing's own monitor process is PID 1 and runs the syncthing worker. Continuous peer-to-peer file synchronization. State lives under STHOMEDIR (/var/syncthing/config): config.xml, the device identity (cert.pem/key.pem), the GUI HTTPS certificate, and the folder indexes in an embedded pure-Go SQLite database under index-v2/ (main.db plus one folder.*.db per folder). No external database server, no docker-compose, no Kubernetes. The image is the complete running instance.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4878,"type":"other"},{"path":"ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1450,"type":"other"},{"path":"ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2757,"type":"other"},{"path":"ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r2.tar.gz","size_bytes":488172387,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2908,"type":"other"}],"promoted_at":"2026-10-27T11:31:03+00:00","promoted_by":"KitForge v3 (chain 689)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:41018e6c100e3c14eb410fae22c814174709c3846023858d7368ea50c3fae352","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 100 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"syncthing","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T11:22:24.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:41018e6c100e3c14eb410fae22c814174709c3846023858d7368ea50c3fae352","first_failure":null,"detail":"published sha256:41018e6c100e3c14eb410fae22c814174709c3846023858d7368ea50c3fae352 rebuilt sha256:41018e6c100e3c14eb410fae22c814174709c3846023858d7368ea50c3fae352"},"evidence_at":"2026-10-27T11:34:23.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 100 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"tempo","docker_tag":"v3.1.1-CE-ubuntu24.04-r2","available":true,"staging_path":"tempo/v3.1.1-CE-ubuntu24.04-r2","product_name":"Tempo","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T11:45:15.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v3.1.1","category":"Open Source","description":"ReadyStack Tempo Community Edition build kit.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":3525,"type":"other"},{"path":"ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1431,"type":"other"},{"path":"ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2853,"type":"other"},{"path":"ReadyStack-tempo-v3.1.1-CE-ubuntu24.04-r2.tar.gz","size_bytes":513666810,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2067,"type":"other"}],"promoted_at":"2026-10-27T11:45:15+00:00","promoted_by":"KitForge v3 (chain 690)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:5cbee4bfcb2be7903ebc5fde62e556cb7a4733c3d4b091f2ab2f6ca08893f54f","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"tempo","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T11:39:59.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:5cbee4bfcb2be7903ebc5fde62e556cb7a4733c3d4b091f2ab2f6ca08893f54f","first_failure":null,"detail":"published sha256:5cbee4bfcb2be7903ebc5fde62e556cb7a4733c3d4b091f2ab2f6ca08893f54f rebuilt sha256:5cbee4bfcb2be7903ebc5fde62e556cb7a4733c3d4b091f2ab2f6ca08893f54f"},"evidence_at":"2026-10-27T11:49:26.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"temporal","docker_tag":"v1.32.1-CE-ubuntu24.04-r3","available":true,"staging_path":"temporal/v1.32.1-CE-ubuntu24.04-r3","product_name":"Temporal","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T13:02:56.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v1.32.1","category":"Open Source","description":"Single container running the temporal-server binary in the foreground, with all four services (frontend, history, matching, worker) in one process and a self-contained pure-Go SQLite store. This is a durable-execution backend, not an application with a UI — clients connect with a Temporal SDK over gRPC on 7233 and run workflows against it.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5024,"type":"other"},{"path":"ReadyStack-temporal-v1.32.1-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1449,"type":"other"},{"path":"ReadyStack-temporal-v1.32.1-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":2857,"type":"other"},{"path":"ReadyStack-temporal-v1.32.1-CE-ubuntu24.04-r3.tar.gz","size_bytes":518659858,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2907,"type":"other"}],"promoted_at":"2026-10-27T13:02:56+00:00","promoted_by":"KitForge v3 (chain 691)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:4ef64bf87564b8aabd6a3d5fdbbbe0c122a7edbf9e39bc97c303d0f92fe73034","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 100 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"temporal","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T12:19:18.000Z","host":"prep5","network":"egress-blocked","rebuilt_digest":"sha256:4ef64bf87564b8aabd6a3d5fdbbbe0c122a7edbf9e39bc97c303d0f92fe73034","first_failure":null,"detail":"published sha256:4ef64bf87564b8aabd6a3d5fdbbbe0c122a7edbf9e39bc97c303d0f92fe73034 rebuilt sha256:4ef64bf87564b8aabd6a3d5fdbbbe0c122a7edbf9e39bc97c303d0f92fe73034"},"evidence_at":"2026-10-27T13:07:04.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 100 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"traefik","docker_tag":"v3.7.15-CE-ubuntu24.04-r1","available":true,"staging_path":"traefik/v3.7.15-CE-ubuntu24.04-r1","product_name":"Traefik","scout_grade":"A","grade_basis":null,"released_at":"2026-10-20T20:19:18.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v3.7.15","category":"Open Source","description":"Single container, single static binary, foreground process. No relational database, no user accounts. Only the FILE provider is enabled by default (--providers.file.filename=/etc/traefik/traefik-dynamic.yml, baked into the image's ENTRYPOINT; the shipped file is an empty configuration, {}); the docker, kubernetes and other providers are off until you add their flag as an extra command-line argument (see Docker provider in the handbooks). Mounting /var/run/docker.sock by itself changes nothing (tested).","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5167,"type":"other"},{"path":"ReadyStack-traefik-v3.7.15-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1433,"type":"other"},{"path":"ReadyStack-traefik-v3.7.15-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2997,"type":"other"},{"path":"ReadyStack-traefik-v3.7.15-CE-ubuntu24.04-r1.tar.gz","size_bytes":498405023,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4205,"type":"other"}],"promoted_at":"2026-10-20T20:19:18+00:00","promoted_by":"KitForge v3 (chain 572)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:90ee1390f5e963f4cab8b43d247b54d494e79537a0b554254ee2e12ec8f8fa41","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":83,"grade_at":"2026-10-27","grade_reasons":["Base image docker.io/library/ubuntu:24.04 has been updated since this image was built: it was built on sha256:a2d43bffc466…, and the tag's current linux/amd64 image is sha256:78d4744ead1f….","Docker Scout counts 97 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"traefik","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-20T19:52:53.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:90ee1390f5e963f4cab8b43d247b54d494e79537a0b554254ee2e12ec8f8fa41","first_failure":null,"detail":"published sha256:90ee1390f5e963f4cab8b43d247b54d494e79537a0b554254ee2e12ec8f8fa41 rebuilt sha256:90ee1390f5e963f4cab8b43d247b54d494e79537a0b554254ee2e12ec8f8fa41"},"evidence_at":"2026-10-27T09:06:19.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-20","reasons":["Docker Scout counts 97 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-20).","Docker Scout counts 97 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-20)."}]}},{"slug":"uptimekuma","docker_tag":"2.5.8-CE-ubuntu24.04-r1","available":true,"staging_path":"uptimekuma/2.5.8-CE-ubuntu24.04-r1","product_name":"Uptime Kuma","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T03:25:39.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"2.5.8","category":"Open Source","description":"Single container. A Node.js (Express + socket.io) self-hosted uptime/status monitor with an embedded SQLite database under /app/data by default. The image IS the complete running instance for that default (no external DB, no sidecar needed). An external MariaDB is technically reachable through environment variables (tested — see Database in the handbooks), but it is not the tested/supported deployment for this release.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5540,"type":"other"},{"path":"ReadyStack-uptimekuma-2.5.8-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1165,"type":"other"},{"path":"ReadyStack-uptimekuma-2.5.8-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2713,"type":"other"},{"path":"ReadyStack-uptimekuma-2.5.8-CE-ubuntu24.04-r1.tar.gz","size_bytes":257222147,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4207,"type":"other"}],"promoted_at":"2026-10-28T03:25:39+00:00","promoted_by":"KitForge v3 (chain 719)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:a327647578a8739011019c5fc79f812dba307dae852f8b632889339252f15c80","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 99 packages with copyleft licences (GPL, LGPL, MPL), 98 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 99 packages with copyleft licences (GPL, LGPL, MPL), 98 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"uptimekuma","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T20:10:10.000Z","host":"prep4","network":"egress-blocked","rebuilt_digest":"sha256:a327647578a8739011019c5fc79f812dba307dae852f8b632889339252f15c80","first_failure":null,"detail":"published sha256:a327647578a8739011019c5fc79f812dba307dae852f8b632889339252f15c80 rebuilt sha256:a327647578a8739011019c5fc79f812dba307dae852f8b632889339252f15c80"},"evidence_at":"2026-10-28T03:30:38.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 99 packages with copyleft licences (GPL, LGPL, MPL), 98 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 99 packages with copyleft licences (GPL, LGPL, MPL), 98 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}]}},{"slug":"valkey","docker_tag":"9.1.2-CE-ubuntu24.04-r2","available":true,"staging_path":"valkey/9.1.2-CE-ubuntu24.04-r2","product_name":"Valkey","scout_grade":"A","grade_basis":null,"released_at":"2026-10-21T22:27:16.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"9.1.2","category":"Open Source","description":"Single container, single self-contained C binary (valkey-server) compiled from source, foreground process (PID 1). An in-memory key-value data store; state persists to disk as an RDB snapshot (and optionally an AOF) under /data. NO relational/SQL database, NO external datastore, NO sidecar. Drop-in Redis-compatible (RESP protocol, reports redis_version 7.2.4 for client compat).","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4026,"type":"other"},{"path":"ReadyStack-valkey-9.1.2-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1277,"type":"other"},{"path":"ReadyStack-valkey-9.1.2-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2757,"type":"other"},{"path":"ReadyStack-valkey-9.1.2-CE-ubuntu24.04-r2.tar.gz","size_bytes":234230039,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":3369,"type":"other"}],"promoted_at":"2026-10-21T22:27:16+00:00","promoted_by":"KitForge v3 (chain 600)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:f1e9b20a31a8b58f5f50570cf5c2d4cc63e85be53d433b1f60924b586476a3d3","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":83,"grade_at":"2026-10-27","grade_reasons":["Base image docker.io/library/ubuntu:24.04 has been updated since this image was built: it was built on sha256:a2d43bffc466…, and the tag's current linux/amd64 image is sha256:78d4744ead1f….","Docker Scout counts 83 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"valkey","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-21T20:19:20.000Z","host":"prep2","network":"egress-blocked","rebuilt_digest":"sha256:f1e9b20a31a8b58f5f50570cf5c2d4cc63e85be53d433b1f60924b586476a3d3","first_failure":null,"detail":"published sha256:f1e9b20a31a8b58f5f50570cf5c2d4cc63e85be53d433b1f60924b586476a3d3 rebuilt sha256:f1e9b20a31a8b58f5f50570cf5c2d4cc63e85be53d433b1f60924b586476a3d3"},"evidence_at":"2026-10-27T09:08:56.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-21","reasons":["Docker Scout counts 83 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-21).","Docker Scout counts 83 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-21)."}]}},{"slug":"vaultwarden","docker_tag":"1.37.4-CE-ubuntu24.04-r4","available":true,"staging_path":"vaultwarden/1.37.4-CE-ubuntu24.04-r4","product_name":"Vaultwarden","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T01:15:01.000Z","built_from":{"kind":"source","label":"Built from upstream's source; the web UI in /web-vault is upstream's prebuilt release https://github.com/dani-garcia/bw_web_builds/releases/download/v2026.7.0/bw_web_v2026.7.0.tar.gz (sha256 002e972bf0d0…)"},"release_notes":true,"version":"1.37.4","category":"Open Source","description":"Single container. A Rust (Rocket) server binary (~40MB ELF, dynamically linked against Ubuntu 24.04's OpenSSL 3.0, package libssl3t64) with embedded SQLite statically compiled in. Serves a PREBUILT Bitwarden-compatible web vault UI from /web-vault on disk. NO external database (self-managed SQLite under /data). The image IS the complete running instance (no docker-compose, no Kubernetes, no DB sidecar).","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5148,"type":"other"},{"path":"ReadyStack-vaultwarden-1.37.4-CE-ubuntu24.04-r4.rebuild.json","size_bytes":1433,"type":"other"},{"path":"ReadyStack-vaultwarden-1.37.4-CE-ubuntu24.04-r4.rebuild.json.sigstore","size_bytes":2905,"type":"other"},{"path":"ReadyStack-vaultwarden-1.37.4-CE-ubuntu24.04-r4.tar.gz","size_bytes":941306236,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4212,"type":"other"}],"promoted_at":"2026-10-28T01:15:01+00:00","promoted_by":"KitForge v3 (chain 733)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:5a333ebba93eb24b0fd0812ca9f7fe5728b9f7b5c383fa6edc13fe217c6d323f","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"vaultwarden","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-28T00:27:23.000Z","host":"prep3","network":"egress-blocked","rebuilt_digest":"sha256:5a333ebba93eb24b0fd0812ca9f7fe5728b9f7b5c383fa6edc13fe217c6d323f","first_failure":null,"detail":"published sha256:5a333ebba93eb24b0fd0812ca9f7fe5728b9f7b5c383fa6edc13fe217c6d323f rebuilt sha256:5a333ebba93eb24b0fd0812ca9f7fe5728b9f7b5c383fa6edc13fe217c6d323f"},"evidence_at":"2026-10-28T01:19:44.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}]}},{"slug":"victoriametrics","docker_tag":"v1.154.1-CE-ubuntu24.04-r1","available":true,"staging_path":"victoriametrics/v1.154.1-CE-ubuntu24.04-r1","product_name":"VictoriaMetrics","scout_grade":"A","grade_basis":null,"released_at":"2026-10-22T19:06:40.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v1.154.1","category":"Open Source","description":"ReadyStack VictoriaMetrics Community Edition build kit.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":3223,"type":"other"},{"path":"ReadyStack-victoriametrics-v1.154.1-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1444,"type":"other"},{"path":"ReadyStack-victoriametrics-v1.154.1-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":2809,"type":"other"},{"path":"ReadyStack-victoriametrics-v1.154.1-CE-ubuntu24.04-r1.tar.gz","size_bytes":557728484,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":3406,"type":"other"}],"promoted_at":"2026-10-22T19:06:40+00:00","promoted_by":"KitForge v3 (chain 627)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:d2aed401734c448da0f33d5e4370387d8bbd8b7fb0518549c9ceb3f4156c4a4a","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":83,"grade_at":"2026-10-27","grade_reasons":["Base image docker.io/library/ubuntu:24.04 has been updated since this image was built: it was built on sha256:a2d43bffc466…, and the tag's current linux/amd64 image is sha256:78d4744ead1f….","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"victoriametrics","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-22T15:26:13.000Z","host":"prep3","network":"egress-blocked","rebuilt_digest":"sha256:d2aed401734c448da0f33d5e4370387d8bbd8b7fb0518549c9ceb3f4156c4a4a","first_failure":null,"detail":"published sha256:d2aed401734c448da0f33d5e4370387d8bbd8b7fb0518549c9ceb3f4156c4a4a rebuilt sha256:d2aed401734c448da0f33d5e4370387d8bbd8b7fb0518549c9ceb3f4156c4a4a"},"evidence_at":"2026-10-27T09:10:55.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-22","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-22).","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-22)."}]}},{"slug":"wikijs","docker_tag":"3.0.0-beta.685-CE-ubuntu24.04-r3","available":true,"staging_path":"wikijs/3.0.0-beta.685-CE-ubuntu24.04-r3","product_name":"Wiki.js","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T18:38:56.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"3.0.0-beta.685","category":"Open Source","description":"One container running the Wiki.js 3 server (Node.js 26, `node --no-experimental-webstorage backend` under tini as PID 1, one foreground process plus its worker threads) on port 3000, and a PostgreSQL 17 or later database that you run beside it. Wiki.js 3 supports no other database and embeds none. Everything the wiki stores lives in that database: pages and their history, users and groups, settings, and uploaded files (stored as binary columns), in a schema named wiki (DB_SCHEMA). /wiki/data inside the container is a cache that starts empty in a new container and fills as the wiki is used, plus the working copies of Git storage targets you configure. It is not a multi-instance cluster in this configuration.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":5505,"type":"other"},{"path":"ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.rebuild.json","size_bytes":1220,"type":"other"},{"path":"ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.rebuild.json.sigstore","size_bytes":2997,"type":"other"},{"path":"ReadyStack-wikijs-3.0.0-beta.685-CE-ubuntu24.04-r3.tar.gz","size_bytes":319231960,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2102,"type":"other"}],"promoted_at":"2026-10-27T18:38:56+00:00","promoted_by":"KitForge v3 (chain 693)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:1d70c95a3332c0432bf7584f2f5dba1d4b9bfc3d5d75f8e8e168117d470b33ec","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 111 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 109 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: wiki-backend."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"wiki","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T13:06:20.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:1d70c95a3332c0432bf7584f2f5dba1d4b9bfc3d5d75f8e8e168117d470b33ec","first_failure":null,"detail":"published sha256:1d70c95a3332c0432bf7584f2f5dba1d4b9bfc3d5d75f8e8e168117d470b33ec rebuilt sha256:1d70c95a3332c0432bf7584f2f5dba1d4b9bfc3d5d75f8e8e168117d470b33ec"},"evidence_at":"2026-10-27T18:43:38.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 111 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 109 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: wiki-backend."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"woodpecker","docker_tag":"v3.19.0-CE-ubuntu24.04-r2","available":true,"staging_path":"woodpecker/v3.19.0-CE-ubuntu24.04-r2","product_name":"Woodpecker","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T16:32:25.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v3.19.0","category":"Open Source","description":"Single container running the Woodpecker SERVER (web UI + API + gRPC). State in an embedded SQLite database. Connects to a git forge (GitHub/Gitea/GitLab) and to one or more agents (run separately) that execute pipelines.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":6339,"type":"other"},{"path":"ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1650,"type":"other"},{"path":"ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2613,"type":"other"},{"path":"ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.tar.gz","size_bytes":496891989,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2911,"type":"other"}],"promoted_at":"2026-10-27T16:32:25+00:00","promoted_by":"KitForge v3 (chain 694)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:836c5f9ef4f115ef243e1823f3f421891bfdccb0f6a80e6b4d3f9e6f09cbc585","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 100 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"woodpecker","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T13:41:26.000Z","host":"prep5","network":"egress-blocked","rebuilt_digest":"sha256:836c5f9ef4f115ef243e1823f3f421891bfdccb0f6a80e6b4d3f9e6f09cbc585","first_failure":null,"detail":"published sha256:836c5f9ef4f115ef243e1823f3f421891bfdccb0f6a80e6b4d3f9e6f09cbc585 rebuilt sha256:836c5f9ef4f115ef243e1823f3f421891bfdccb0f6a80e6b4d3f9e6f09cbc585"},"evidence_at":"2026-10-27T16:35:53.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 100 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"wordpress","docker_tag":"7.1.3-CE-ubuntu24.04-r4","available":true,"staging_path":"wordpress/7.1.3-CE-ubuntu24.04-r4","product_name":"WordPress","scout_grade":"A","grade_basis":null,"released_at":"2026-10-27T14:37:46.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"7.1.3","category":"Open Source","description":"Single container: Apache with mod_php, one foreground process, running WordPress 7.1.3 as www-data (uid 33) on port 8080. Self-contained by default: the database is an embedded SQLite file on the wordpress-data volume, through WordPress.org's SQLite Database Integration drop-in, so no database server and no second container are needed. Set WORDPRESS_DB_HOST and WORDPRESS_DB_PASSWORD (WORDPRESS_DB_NAME and WORDPRESS_DB_USER default to wordpress) to use your own MySQL or MariaDB server instead, the databases WordPress itself is built for. WordPress is installed by the container at its first start; the web installer is never served.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4434,"type":"other"},{"path":"ReadyStack-wordpress-7.1.3-CE-ubuntu24.04-r4.rebuild.json","size_bytes":1180,"type":"other"},{"path":"ReadyStack-wordpress-7.1.3-CE-ubuntu24.04-r4.rebuild.json.sigstore","size_bytes":2853,"type":"other"},{"path":"ReadyStack-wordpress-7.1.3-CE-ubuntu24.04-r4.tar.gz","size_bytes":276897303,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":2074,"type":"other"}],"promoted_at":"2026-10-27T14:37:46+00:00","promoted_by":"KitForge v3 (chain 695)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:9e32ef4f20c508f445b5ed93248aa204e19393494f8557956d86fb9b3f72797a","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-27","grade_reasons":["Docker Scout counts 135 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"www-data","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T13:50:45.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:9e32ef4f20c508f445b5ed93248aa204e19393494f8557956d86fb9b3f72797a","first_failure":null,"detail":"published sha256:9e32ef4f20c508f445b5ed93248aa204e19393494f8557956d86fb9b3f72797a rebuilt sha256:9e32ef4f20c508f445b5ed93248aa204e19393494f8557956d86fb9b3f72797a"},"evidence_at":"2026-10-27T14:41:46.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-27","reasons":["Docker Scout counts 135 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[]}},{"slug":"zabbix","docker_tag":"7.4.16-CE-ubuntu24.04-r2","available":true,"staging_path":"zabbix/7.4.16-CE-ubuntu24.04-r2","product_name":"Zabbix","scout_grade":"A","grade_basis":null,"released_at":"2026-10-28T03:52:02.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"7.4.16","category":"Open Source","description":"Single container running zabbix_server in the foreground as the non-root zabbix user: the Zabbix monitoring engine (pollers, trappers, triggers, alerting) built from source. It REQUIRES an external PostgreSQL database (13 or newer); on first start against an empty database the entrypoint loads the Zabbix schema and seed data into it. The Zabbix web frontend and its JSON-RPC API are NOT in this image: run a Zabbix frontend (PHP) against the same database to configure hosts and see data. No Zabbix agent runs in this container.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":4619,"type":"other"},{"path":"ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.rebuild.json","size_bytes":1212,"type":"other"},{"path":"ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.rebuild.json.sigstore","size_bytes":2905,"type":"other"},{"path":"ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.tar.gz","size_bytes":380101854,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4204,"type":"other"}],"promoted_at":"2026-10-28T03:52:02+00:00","promoted_by":"KitForge v3 (chain 696)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:a076e237d9451ae3032a101d985d6009cc8e822ae5e7800d0f4c08442a32430a","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"A","grade_percent":94,"grade_at":"2026-10-28","grade_reasons":["Docker Scout counts 126 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 126 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"zabbix","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-27T15:29:14.000Z","host":"prep5","network":"egress-blocked","rebuilt_digest":"sha256:a076e237d9451ae3032a101d985d6009cc8e822ae5e7800d0f4c08442a32430a","first_failure":null,"detail":"published sha256:a076e237d9451ae3032a101d985d6009cc8e822ae5e7800d0f4c08442a32430a rebuilt sha256:a076e237d9451ae3032a101d985d6009cc8e822ae5e7800d0f4c08442a32430a"},"evidence_at":"2026-10-28T04:01:38.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-28","reasons":["Docker Scout counts 126 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28).","Docker Scout counts 126 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:24737cef17f4…) with the platform digest it records for the base (sha256:78d4744ead1f…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-28)."}]}},{"slug":"zitadel","docker_tag":"v4.19.5-CE-ubuntu24.04-r1","available":true,"staging_path":"zitadel/v4.19.5-CE-ubuntu24.04-r1","product_name":"ZITADEL","scout_grade":"A","grade_basis":null,"released_at":"2026-10-20T19:09:08.000Z","built_from":{"kind":"source","label":"Built from upstream's source"},"release_notes":true,"version":"v4.19.5","category":"Open Source","description":"Single container, single static Go binary (CGO-free), foreground process — a cloud-native Identity & Access Management (IAM) / OIDC + OAuth2 + SAML + OpenID provider. REQUIRES an EXTERNAL PostgreSQL database the customer provisions and points the container at via ZITADEL_DATABASE_POSTGRES_* env vars — there is NO embedded/SQLite database. zitadel creates and migrates its own schema (event-sourced) in that postgres on first start. NOT a docker-compose-only or Kubernetes-only product, but it is NOT self-contained: postgres is a hard external dependency.","artifacts":[{"path":"RELEASE_NOTES.md","size_bytes":8192,"type":"other"},{"path":"ReadyStack-zitadel-v4.19.5-CE-ubuntu24.04-r1.rebuild.json","size_bytes":1493,"type":"other"},{"path":"ReadyStack-zitadel-v4.19.5-CE-ubuntu24.04-r1.rebuild.json.sigstore","size_bytes":3141,"type":"other"},{"path":"ReadyStack-zitadel-v4.19.5-CE-ubuntu24.04-r1.tar.gz","size_bytes":965924614,"type":"other"},{"path":"SCOUT_EVIDENCE.json","size_bytes":4205,"type":"other"}],"promoted_at":"2026-10-20T19:09:08+00:00","promoted_by":"KitForge v3 (chain 569)","chain_price_cents":1000,"runtime_privileges":null,"free_release":false,"ready_for_production":true,"reproducible":true,"image_manifest_digest":"sha256:cad95b106e5a9422c0ded09378b332a011122cc65f3dd89e43bbbcbe85794c25","base_os":{"segment":"ubuntu24.04","label":"Ubuntu 24.04"},"grade":"B","grade_percent":83,"grade_at":"2026-10-27","grade_reasons":["Base image docker.io/library/ubuntu:24.04 has been updated since this image was built: it was built on sha256:a2d43bffc466…, and the tag's current linux/amd64 image is sha256:78d4744ead1f….","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"grade_docker":null,"grade_docker_percent":null,"grade_docker_reasons":null,"grade_corrections":[],"signed":true,"unsigned_legacy":null,"key_fingerprint":"04daa92344a52dbc","signed_after":null,"nonroot":true,"run_user":"zitadel","attestations":{"sbom_spdx":true,"provenance":"v1"},"rebuild":{"verified":true,"at":"2026-10-20T07:41:53.000Z","host":"prep1","network":"egress-blocked","rebuilt_digest":"sha256:cad95b106e5a9422c0ded09378b332a011122cc65f3dd89e43bbbcbe85794c25","first_failure":null,"detail":"published sha256:cad95b106e5a9422c0ded09378b332a011122cc65f3dd89e43bbbcbe85794c25 rebuilt sha256:cad95b106e5a9422c0ded09378b332a011122cc65f3dd89e43bbbcbe85794c25"},"evidence_at":"2026-10-27T09:16:59.000Z","at_release":{"basis":"scout-policy","grade":"A","grade_percent":94,"passed":null,"at":"2026-10-20","reasons":["Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"config":{"tool":"docker scout policy","cli":"1.26.0","config":"docker-default","org_vex":false},"note":null,"release_check":{"passed":true},"grade_docker":"B","grade_docker_percent":83,"grade_docker_reasons":["Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-20).","Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component)."],"grade_corrections":[{"name":"No outdated base images","docker_pass":false,"pass":true,"why":"Docker Scout fails “No outdated base images” for every image built on a multi-arch base: its rule compares the base tag's index digest (sha256:68ee22004a91…) with the platform digest it records for the base (sha256:a2d43bffc466…), which never match. This image's base is docker.io/library/ubuntu:24.04's current linux/amd64 image (checked on the registry 2026-10-20)."}]}}]