Apache Airflow 3.3.2-CE-ubuntu24.04-r5 build trail

• ProductApache Airflow (airflow) [MANIFEST.json]
• Release tag3.3.2-CE-ubuntu24.04-r5 [MANIFEST.json]
• Imagereadystack/airflow:3.3.2-CE-ubuntu24.04-r5 [MANIFEST.json]
• Image index digestsha256:abe81f278d0992a3b1968e8440e2a3a368da9e464621a712fc74fae261c0586b [docs/provenance/LOCKED_DIGEST.txt]
• linux/amd64 image digestsha256:b411b52e4e7e0ecb4e5912aa466778e923c79257ad31af1b641d90b9a81b59e2 [ReadyStack-airflow-3.3.2-CE-ubuntu24.04-r5.rebuild.json, subject.image_manifest_digest]
• ArchiveReadyStack-airflow-3.3.2-CE-ubuntu24.04-r5.tar.gz (bytes 492569649) [MANIFEST.json]
• Archive sha256 at publishb9fbf5f414577866b701c0a10ffc77a298db2880a51c46458b049d53e5bfd372 [MANIFEST.json, repack_history[0].previous_tarball_sha256]
• Archive sha256 now2b1c040e60da742d5d1ace37259d7e62ed80708e9af72a57d1e237b081c89b38 [MANIFEST.json, tarball_sha256]
• Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
• Repack history
  • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 b9fbf5f414577866b701c0a10ffc77a298db2880a51c46458b049d53e5bfd372 · sha256 2b1c040e60da742d5d1ace37259d7e62ed80708e9af72a57d1e237b081c89b38 · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
  [MANIFEST.json, repack_history]
• Upstream repositoryhttps://github.com/apache/airflow [docs/provenance/SOURCE_TREE_HASH.json]
• Upstream ref3.3.2 [docs/provenance/SOURCE_TREE_HASH.json]
• Upstream commitaa19d2dbb9ed187ec01957a92848d9b005e9ba9d [docs/provenance/SOURCE_TREE_HASH.json]
• Source tree hash0c2bedc616cb31218619d06cfbcf76165852c90952c130e097f5b92ef6924e6c (files 13190) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
• Kit tree hashsha256:6d205132e39db8601b1a4b369afe00fabed541a131108ffb44ce15cc7913d69b [ReadyStack-airflow-3.3.2-CE-ubuntu24.04-r5.rebuild.json, inputs.tree_hash]
• SOURCE_DATE_EPOCH1789292163 (utc 2026-09-13T09:36:03Z) [ReadyStack-airflow-3.3.2-CE-ubuntu24.04-r5.rebuild.json, inputs.source_date_epoch]
• Base images
  • ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
  [ReadyStack-airflow-3.3.2-CE-ubuntu24.04-r5.rebuild.json, bases]
• BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-airflow-3.3.2-CE-ubuntu24.04-r5.rebuild.json, engine]

• Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

• Chain722 (created 2026-10-27T20:25:03Z · trigger customer_request · upstream version 3.3.2) [chains, chains #722]
• Requestbuild request #422 (rebuild) (requested at 2026-10-27T20:16:23Z · requested by kitforge-agent · version 3.3.2) [build_requests, build_requests #422]
• Reasonrevision 3.3.2-CE-ubuntu24.04-r5: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #422 request_reason]
• Supersedesreadystack/airflow:3.3.2-CE-ubuntu24.04-r4 (chain 649) [chains, chains #649]

1 chain · 4 drives · 18 stages · 3 rewinds

Stages, in order

[stage_runs]

Rewinds

• 2026-10-28T10:55:02Z: verdict to assemble_kit on strategy_changed (chain 722: strategy changed — rewound from 'verdict' to assemble_kit and dropped the vendored tree so the change actually reaches the build.) [stage_events, stage_events #2342]
• 2026-10-28T11:48:23Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #1985]
• 2026-10-28T12:26:00Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #309]

• Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
• Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Role: writer model. Calls up to 2026-10-28T12:34:31Z.

8 calls over 3 stages

[micro_step_runs]

• Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
• Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
• Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Role: review model.

2 rounds, 2 counted, $0.87 recorded cost

• Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
• Not recorded: the round cap in force at each round (the state files did not keep it)

• Ledger entries5 [defects, defects where product_slug=airflow and this tag or chain]
• Disclosed in the archive5 [docs/defects/defects.json, entries]

5 ledger entries: by severity medium 1, high 4; by status open 1, fixed-before-release 4.

• Reproduced before publishingyes (rebuilt digest sha256:b411b52e4e7e0ecb4e5912aa466778e923c79257ad31af1b641d90b9a81b59e2 · published digest sha256:b411b52e4e7e0ecb4e5912aa466778e923c79257ad31af1b641d90b9a81b59e2 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 212) [docs/provenance/REPRO_VERIFICATION.json, verified]
• Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 722 package_archive gate_result.g8.result]
• Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-28T12:26:58Z · failing Docker Scout counts 104 packages with copyleft licences (GPL, LGPL, MPL), 101 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
• First own scan of the releaseA (at 2026-10-28T12:34:40Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-28T06:23:30Z) [image_scans, image_scans #1456]
• Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-28T12:26:35Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
• Image signature transparency-log entries
  • log index 3536921538 · transparency-log entry
  • log index 3536924370 · transparency-log entry
  [docs/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
• rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3620338505 · transparency-log entry · integrated 2026-11-01T04:51:47Z) [ReadyStack-airflow-3.3.2-CE-ubuntu24.04-r5.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]

Offline clean-room rebuilds

• 2026-10-28T11:26:45Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
  rebuilt sha256:b411b52e4e7e0ecb4e5912aa466778e923c79257ad31af1b641d90b9a81b59e2 [clean-room rebuild ledger, runs[521]]
• 2026-11-01T04:56:07Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
  rebuilt sha256:b411b52e4e7e0ecb4e5912aa466778e923c79257ad31af1b641d90b9a81b59e2 [clean-room rebuild ledger, runs[570]]

• Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
• Not recorded: the attestations' transparency-log entries (no attestation record in the release's workspace)
• Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

• Image pushed (internal tag), publish_image passed2026-10-28T11:13:50Z [stage_runs, stage_runs chain 722 stage publish_image]
• Archive manifests written2026-10-28T12:29:18Z [PUBLISH_MANIFEST.json, published_at]
• Archive cut over on prodasset, package_archive passed2026-10-28T12:34:31Z [stage_runs, stage_runs chain 722 stage package_archive]
• Cut-over markerpresent (chain 722) [.cutover.json]

• Not recorded: when the release tag was promoted (the promotion record in the archive was written before the promotion, and the release's workspace no longer holds this chain)
• Not recorded: the site event's time (the release checklist is in the chain's workspace, which no longer holds this chain)

• Packages in the image249 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
• x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 882 · probed 2026-11-02T17:00:43Z · source backfill) [release_images, isa_level_hard]

• 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records