Canvas LMS 2026-05-20.143-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/canvas:2026-05-20.143-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/canvas:2026-05-20.143-CE-ubuntu24.04-r2
  • Index digestsha256:79b1ec971c178dd8c078b5cdb7099b5bb3514f5352c02619a1b3b8b1b4bcaf8c
  • linux/amd64 digestsha256:3535e722ffb3d4e850e8aa266a00beb5f94dada56dea624ea2d3640a5b922163
  • ArchiveReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 nowf6b94829ae292214de9ac87f57ab782cae7ff4ba6b3fa3c1e024cbc9be624527
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since 2026-11-03T00:28:31Z)
  • Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
  • Sections9 sections, 4 fully recorded; 11 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.trail.json
ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.trail.jsonReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.trail.mdCanvas LMS product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

1 item not recorded
  • ProductCanvas LMS (canvas) [MANIFEST.json]
  • Release tag2026-05-20.143-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/canvas:2026-05-20.143-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:79b1ec971c178dd8c078b5cdb7099b5bb3514f5352c02619a1b3b8b1b4bcaf8c [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:3535e722ffb3d4e850e8aa266a00beb5f94dada56dea624ea2d3640a5b922163 [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.tar.gz (bytes 1006396097) [MANIFEST.json]
  • Archive sha256 at publish11f0b26c637927aa8c84214a7bb580bdb98aaf697996ae7f40def9ff76b473ee [MANIFEST.json, repack_history[0].previous_tarball_sha256]
  • Archive sha256 now3130d80f0bdb50aa518df25d7cfbe572db139c3544a7ffc9cc6127a361fc79c6 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack history
    • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 11f0b26c637927aa8c84214a7bb580bdb98aaf697996ae7f40def9ff76b473ee · sha256 3130d80f0bdb50aa518df25d7cfbe572db139c3544a7ffc9cc6127a361fc79c6 · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
    [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/instructure/canvas-lms [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refrelease/2026-05-20.143 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit2e2b4a46d08e32667d4845f7b78e1214250345d3 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash222ae1df10656048500098d09530d7337d8bb8fb99e7e3676629165870c2e1af (files 22662) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:d9a7e28bd451197589b2d0c490ca2db48341a22b022a14899b1c3d7daa8287c5 [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1777557004 (utc 2026-04-30T13:50:04Z) [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded
  • Chain679 (created 2026-10-27T09:17:49Z · trigger customer_request · upstream version 2026-05-20.143) [chains, chains #679]
  • Requestbuild request #356 (rebuild) (requested at 2026-10-27T02:36:25Z · requested by kitforge-agent · version 2026-05-20.143) [build_requests, build_requests #356]
  • Reasonrevision 2026-05-20.143-CE-ubuntu24.04-r2: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #356 request_reason]
  • Supersedesreadystack/canvas:2026-05-20.143-CE-ubuntu24.04-r1 (chain 617) [chains, chains #617]

The path through the harness

2 items not recorded

1 chain · 9 drives · 18 stages · 6 rewinds

Chain 679 release · shipped

Created 2026-10-27T09:17:49Z, upstream 2026-05-20.143, build request 356 [chains, chains #679]

DriveStartedMinutesBuild hostHow it stopped
9582026-10-27T09:20:25Z82.3build host 5 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #958] rebuilt from a build line's log
9652026-10-27T12:16:53Z32.5build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #965] rebuilt from a build line's log
9792026-10-27T16:46:09Z17.1build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #979] rebuilt from a build line's log
9972026-10-28T03:36:20Z10.7build host 5 publish-held stage_failed at package_archive [drive_runs, drive_runs #997] rebuilt from a build line's log
10192026-10-29T19:53:00Z115.5build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #1019] rebuilt from a build line's log
10212026-10-29T22:35:40Z14.9build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #1021] rebuilt from a build line's log
10232026-10-29T23:29:29Z15build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #1023] rebuilt from a build line's log
10262026-10-30T00:14:43Z15.1build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #1026] rebuilt from a build line's log
10282026-10-30T01:33:39Z20.3build host 5 publish-held shipped [drive_runs, drive_runs #1028] rebuilt from a build line's log

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-27T09:20:30Z2026-10-27T09:20:31Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-27T09:21:01Z2026-10-27T09:21:02Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-27T09:21:41Z2026-10-27T09:21:42Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-27T09:38:19Z2026-10-29T20:40:06Z2
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 —
remediate 2026-10-27T09:39:12Z2026-10-29T20:40:09Z2
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 —
build_kit 2026-10-27T10:07:00Z2026-10-29T21:07:13Z2
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 —
verdict 2026-10-27T10:16:14Z2026-10-29T21:12:04Z2
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 —
publish_image 2026-10-27T10:19:41Z2026-10-29T21:14:04Z2
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 —
boot_instance 2026-10-27T10:22:28Z2026-10-29T21:16:42Z4
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 —
sbom 2026-10-27T10:23:53Z2026-10-29T21:17:47Z2
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 —
schema_discovery 2026-10-27T10:23:56Z2026-10-29T21:17:50Z2
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 —
admin_handbook 2026-10-27T10:30:41Z2026-10-29T21:17:56Z2
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 —
db_handbook 2026-10-27T10:36:54Z2026-10-29T21:18:05Z2
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 —
seed_data 2026-10-27T10:37:06Z2026-10-29T21:18:15Z2
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 —
seed_validate 2026-10-27T10:37:09Z2026-10-29T21:18:17Z2
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 —
usecase_validate 2026-10-27T10:37:39Z2026-10-29T21:18:30Z2
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 —
finalize_docs 2026-10-27T10:41:49Z2026-10-29T21:18:36Z2
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 —
package_archive 2026-10-27T10:42:40Z2026-10-30T01:53:52Z9
33 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 scout_grade_a
  • G8 script_copies
  • G8 three_way_sha
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 assetchain_coverage
 —

[stage_runs]

Rewinds

  • 2026-10-28T03:35:47Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #1181]
  • 2026-10-29T19:53:10Z: package_archive to assemble_kit on strategy_changed (chain 679: strategy changed — rewound from 'package_archive' to assemble_kit and dropped the vendored tree so the change actually reaches the build.) [stage_events, stage_events #2364]
  • 2026-10-29T22:30:44Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2000]
  • 2026-10-29T23:24:23Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2001]
  • 2026-10-30T00:09:01Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2002]
  • 2026-10-30T01:33:11Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #1218]
  • Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
  • Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-10-30T01:53:52Z.

100 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook31302 not recordednot recorded —
db_handbook37803 not recordednot recorded —
usecase_validate2001 not recordednot recorded —
finalize_docs26202 not recordednot recorded —

[micro_step_runs]

  • Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
  • Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

3 items not recorded

Role: review model.

7 rounds, 6 counted, $16.90 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
1 not counted2026-10-27T12:51:27Z ——— blocked to blocked [held_rounds, held_rounds #9] rebuilt from a held-review state file — not recorded not recorded
22026-10-27T14:17:39Z 0416 blocked to blocked [held_rounds, held_rounds #10] rebuilt from a held-review state file $2.34 not recorded not recorded
32026-10-27T17:04:21Z 0019 clean to publish [held_rounds, held_rounds #11] rebuilt from a held-review state file $2.72 not recorded not recorded
42026-10-29T21:49:50Z 0210 findings to repackage [held_rounds, held_rounds #12] rebuilt from a held-review state file $2.11 not recorded not recorded
52026-10-29T22:52:25Z 0215 findings to repackage [held_rounds, held_rounds #13] rebuilt from a held-review state file $3.55 not recorded not recorded
62026-10-29T23:45:02Z 017 findings to repackage [held_rounds, held_rounds #14] rebuilt from a held-review state file $2.25 not recorded not recorded
72026-10-30T00:31:42Z 003 clean to publish [held_rounds, held_rounds #15] rebuilt from a held-review state file $3.94 not recorded not recorded

Overrides

  • max_rounds: — to 7; by not recorded; why: not recorded predates override recording (2026-11-02): found in runstate/held-auto/canvas.json, last written 2026-10-30T01:32Z; who set it, why, when and the value before are not known [review_overrides, review_overrides #1]
  • Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
  • Not recorded: the round cap in force at each round (the state files did not keep it)
  • Not recorded: who raised max_rounds to 7 and why (review_overrides #1 was backfilled from a state file; overrides are recorded with who and why from 2026-11-02)

Defects

Fully recorded
  • Ledger entries81 [defects, defects where product_slug=canvas and this tag or chain]
  • Disclosed in the archive80 [docs/defects/defects.json, entries]

81 ledger entries: by severity medium 2, critical 1, high 9, low 69; by status fixed-before-release 79, fixed-in-release 1, open 1.

DefectSeverityStatusFound byFixed in
RSD-canvas-5aa740820e
The Docker Hub run example passes CANVAS_LMS_ADMIN_PASSWORD with -e, so the administrator password stays in the container's environment after setup [defects, defects #108140]		mediumfixed-before-releaseagent case study—
RSD-canvas-7b9e7018ee
Offline rebuild does not reproduce the published image digest [defects, defects #108692]		criticalfixed-before-releaseclean-room rebuild—
RSD-canvas-021fd9776d
Release notes: The Reproducibility paragraph states the offline rebuild reaches the identical digest, while the Known issues of the same file list a critical open row saying the offline rebuild does not reproduce… [defects, defects #112566]		highfixed-before-releaseheld review (review model)—
RSD-canvas-25c92773b1
API guide: Tells the customer to remove the encryption keys from the container environment after setup. [defects, defects #112567]		highfixed-before-releaseheld review (review model)—
RSD-canvas-b692a288d0
Admin handbook: The example runs a bare new container with no network, no CANVAS_DATABASE_*/CANVAS_REDIS_URL/CANVAS_ENCRYPTION_KEY and no -it. [defects, defects #112568]		highfixed-before-releaseheld review (review model)—
RSD-canvas-8ff9b24efc
Database handbook: The default is true, not false (the same handbook says "CANVAS_SSL (default true)" at line 186 and in the Domain and tls fact). [defects, defects #112569]		highfixed-before-releaseheld review (review model)—
RSD-canvas-8855d83789
Admin handbook: CANVAS_SSL=false does not prevent sign-in; the documented start command uses it. [defects, defects #112570]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-765a9c34b0
Database handbook: Plain HTTP is not rejected: it is answered 200 without a session cookie, which line 581 of the same handbook states ("no redirect, no error"). [defects, defects #112571]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-1a69077799
Database handbook: Contradicts the same handbook (lines 485, 755, 988) and the measured behaviour. [defects, defects #112572]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-7f6fe64a01
Database handbook: With CANVAS_SKIP_MIGRATE=1 the entrypoint skips both rake steps and execs Puma regardless of pending migrations; it never refuses to start. [defects, defects #112573]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-b0d3790890
Database handbook: The image contains setuid binaries. [defects, defects #112574]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-e76bed8d15
Database handbook: A restart keeps the container's environment, so the old first-start password stays in `docker inspect` and /proc; only recreating the container removes it (as the Operating facts say). [defects, defects #112575]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-693a43abae
Database handbook: Sessions are signed cookies (lines 458 and 566 of the same handbook), not stored in PostgreSQL. [defects, defects #112576]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-1ef3ef7c04
Database handbook: The entrypoint does not read CANVAS_DATABASE_HOST, CANVAS_REDIS_URL or CANVAS_DOMAIN into security.yml; that file holds only the encryption keys and the lti issuer, and the same handbook says at… [defects, defects #112577]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-de6828c42c
Admin handbook: The image does not set CANVAS_JOB_WORKERS; the default of 2 comes from config/delayed_jobs.yml. [defects, defects #112578]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-443ebe9d4c
Admin handbook: A waiting jobs container does not exit; it loops with a 10-second sleep. [defects, defects #112579]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-66024d1530
Admin handbook: Authentication is keyed on CANVAS_SMTP_USER_NAME alone (the password defaults to empty); "set both" contradicts the next bullet and the same section's earlier text. [defects, defects #112580]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-a2ef33b95c
API guide: GET / and GET /login/canvas need no token; the guide says so itself ("All endpoints except /health_check and /login/canvas require authentication", line 481). [defects, defects #112581]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-82e303e077
API guide: Contradicts the token sections of the same guide (lines 549, 572, 600): an expiration date can be set and Canvas then refuses the token. [defects, defects #112582]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-dc17dfe438
API guide: With CANVAS_SSL=false (the documented run command) the session cookie is issued over plain HTTP and sign-in works. [defects, defects #112583]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-f6facd3e14
API guide: Docs audit: the guide never names the runtime user; IMAGE_CONFIG.json User is "canvas". [defects, defects #112584]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-3b691e7fdb
Admin handbook: Nothing writes the keys into security.yml: it is an ERB file evaluated from the environment, and the handbook says "read from config/security.yml" at lines 331 and 751. [defects, defects #112585]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-8d4c355c69
Release notes: A Known issues row quotes the round-2 review finding about this file. [defects, defects #116802]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-5a3683bc99
Admin handbook: The published patch is not a single-line file: it is 438 lines and changes two upstream files. [defects, defects #116803]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-67f75dac9b
Admin handbook: 'One modification' understates the patch and the image label's own disclosure (lockfile changes, removed directories). [defects, defects #116804]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-af72d74c7d
Database handbook: Same understatement: the diff also changes Gemfile.lock. [defects, defects #116805]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-b67f84c20c
API guide: Same understatement: the diff also changes Gemfile.lock (and line 112 of this guide already mentions the gepub update). [defects, defects #116806]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-91345cb258
Database handbook: Perl is in the image, so 'language runtime beyond Ruby' is false. [defects, defects #116807]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-6e42de8d4a
Admin handbook: The sentence promises --entrypoint and the block that follows is `docker exec -it canvas rails console`; the two disagree. [defects, defects #116808]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-646310d873
Admin handbook: The bare `docker run IMAGE web` shown does not start a web server. [defects, defects #116809]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-21731d4983
Database handbook: Under 'Starting the web server' the bare command exits at once. [defects, defects #116810]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-b364ffaf2a
Database handbook: The bare command exits 64 before the worker starts. [defects, defects #116811]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-404204e5f0
API guide: Canvas answers 403 unless the setting is on. [defects, defects #116812]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-32b87a8991
API guide: The records do not show courses or users/self verified by the build: validation/test-results.json records /api/v1/courses as 'pruned-needs-credentials-401' (not exercised) and has no users/self… [defects, defects #116813]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-478d70a75c
API guide: GET / needs no token (line 198 of the same guide says so); measured: unauthenticated GET / -> 302 Location /login. [defects, defects #116814]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-61c9f092bf
API guide: The Purpose given to /login/canvas is the title of the build's separate GET / check; the page is the sign-in form, not an API gateway. [defects, defects #116815]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-a293d4fec6
Database handbook: The entrypoint checks three variables; the list names only two here, while lines 597 and 605 of the same handbook name three. [defects, defects #116816]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-526e8d76f7
Admin handbook: 142 s is 2 min 22 s, not 2 min 40 s; the same handbook states 142 s and 111 s at lines 163, 319 and 739. [defects, defects #116817]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-7b02d72051
Database handbook: Every other statement of this key in the three guides, the Operating facts and security.yml say it encrypts the tokens; this section's heading and sentence say it signs them. [defects, defects #116818]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-f3dffa4cfc
Admin handbook: The API guide (lines 157, 549, 590) says the expiration date is optional and that a token without one does not expire. [defects, defects #116819]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-e9a119343b
Database handbook: The documented start command mounts a named volume (canvas-files), which has no host path to copy to; files copied in as root are not writable by uid 9999. [defects, defects #116820]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-6b72baa175
CVE-2026-111497 in libbrotli1 1.1.0-2build2 is on CISA's Known Exploited Vulnerabilities list [defects, defects #139738]		mediumfixed-in-releaseimage scan2026-05-20.143-CE-ubuntu24.04-r2
RSD-canvas-4cf0e7f754
API guide: Not true for the administrator this guide tells the reader to use: a token created without an expiration date expires after one week, so an integration built on it stops working with 401. [defects, defects #140686]		highfixed-before-releaseheld review (review model)—
RSD-canvas-dbc06bd35f
API guide: Not true for the administrator this guide tells the reader to use: a token created without an expiration date expires after one week, so an integration built on it stops working with 401. [defects, defects #140687]		highfixed-before-releaseheld review (review model)—
RSD-canvas-59479ab479
API guide: Presents the expiration date as optional for any user; students must set one (tokens_controller.rb:119-127) and an administrator's token without one still expires after a week. [defects, defects #140688]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-327fbd60fd
Database handbook: Round 3 finding not fixed: this sentence says the keys sign the JSON web tokens, every other statement (and the curated fact) says the JWT key encrypts them. [defects, defects #140689]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-0bf1e7e6f8
Database handbook: Round 3 finding not fixed: heading calls the key a signing key while the section text and all other documents say it encrypts the tokens. [defects, defects #140690]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-066389d304
Database handbook: Round 3 understatement persists: names only the Gemfile.d/app.rb line although the diff also changes Gemfile.lock and the build removes directories. [defects, defects #140691]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-05d313257a
Database handbook: 'The modification' (singular) understates the diff, which also changes Gemfile.lock. [defects, defects #140692]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-1acbca477d
API guide: Round 3 understatement persists: the diff also changes Gemfile.lock. [defects, defects #140693]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-6bb95f3382
API guide: Contradicts lines 198 and 211: GET / needs no token. [defects, defects #140694]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-c16afbeabe
API guide: Same contradiction: GET / needs no token. [defects, defects #140695]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-332ce8c874
Admin handbook: Names two of the three variables the entrypoint requires on a first start. [defects, defects #140696]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-3be5d38747
Admin handbook: Says the web container requires the JWT key; line 997 and the entrypoint say it is optional. [defects, defects #140697]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-9cc81b2387
API guide: False for the administrator this guide tells the reader to use: the date entered is honoured only when it is earlier than one week after creation, so an integration built on a token with a date… [defects, defects #141224]		highfixed-before-releaseheld review (review model)—
RSD-canvas-dad6862ce8
Database handbook: The two listed items are not all of the state a restore needs. [defects, defects #141225]		highfixed-before-releaseheld review (review model)—
RSD-canvas-f802fd11dc
API guide: Implies that an administrator who sets a date keeps the token until that date; the one-week cap applies to a date too. [defects, defects #141226]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-c095e5a472
API guide: Presents the date as a way around the one-week expiry for the administrator; a later date is capped to one week. [defects, defects #141227]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-5eee0982c1
API guide: Same one-week cap omitted for a date set by the site administrator. [defects, defects #141228]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-c6f30b04f3
Admin handbook: Same one-week cap omitted; a reader who sets a long expiration date for an integration still loses the token after a week. [defects, defects #141229]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-65d0207b22
API guide: The section the reader is told to scroll to does not exist under that name. [defects, defects #141230]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-c1db6999d6
API guide: Same: no 'Access Tokens' section on the settings page. [defects, defects #141231]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-3bf7c70186
API guide: Same: no 'Access Tokens' section on the settings page. [defects, defects #141232]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-30dc37b82d
API guide: Presented as a common pattern of this API, but the only list endpoint the guide documents ignores them. [defects, defects #141233]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-3ebce7c6b0
API guide: No record of this release shows a Canvas dashboard that reports API usage; what the API returns is the X-Rate-Limit-Remaining / X-Request-Cost headers (measured: x-rate-limit-remaining: 600.0,… [defects, defects #141234]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-a6ce6f30ac
API guide: Round 4 finding not fully fixed: 'The modification' (singular) still understates the diff, which changes two files (Gemfile.d/app.rb and Gemfile.lock) and the build removes directories. [defects, defects #141235]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-714171d164
Docker Hub README: Round 3/4 understatement persists: the line names only the Gemfile.d/app.rb line although the diff also changes Gemfile.lock and the build removes directories. [defects, defects #141236]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-07ac7263d7
Database handbook: Lists the JWT key as something the jobs container requires; round 4 finding paraphrased: the entrypoint requires only CANVAS_ENCRYPTION_KEY (20+ characters) and the JWT key is optional (security.yml… [defects, defects #141237]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-1700e77d2f
Admin handbook: Unsupported and contradicted by measurement; also contradicts line 884 ('continues to process jobs'). [defects, defects #141238]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-9aef3c8efb
Database handbook: Unsupported 'cannot function correctly'; a queued job ran with Redis down. [defects, defects #141239]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-2d9755fff7
Database handbook: 'Much faster' is not what the documents' own measurements show (142 s first start, 111 s restart). [defects, defects #141240]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-6dad251786
Database handbook: A reader who plans backups from this paragraph omits the encryption key; the restored database then cannot be used with a new key. [defects, defects #141904]		highfixed-before-releaseheld review (review model)—
RSD-canvas-f46ba58308
Database handbook: 'The only data kept outside the database' and 'the database backups handle everything else' are false for the encryption key; same class as the line 397 finding. [defects, defects #141905]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-4d67e1068e
API guide: Round 5 one-week-cap finding paraphrased in the Token Expiration subsection: for the administrator the guide tells the reader to use, a later date does not keep the token until that date. [defects, defects #141906]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-cad0b53da7
API guide: Same one-week cap omitted as in the round 5 findings; this paragraph follows line 590 but contradicts it for a later date. [defects, defects #141907]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-651c6ccb48
API guide: The only filtering example is a request that does not filter: 'active' is not a course state and the parameter is state[]. [defects, defects #141908]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-7e9883800a
API guide: No response header reports when the limit resets; the sentence promises information Canvas does not send. [defects, defects #141909]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-f0f2520212
API guide: Round 5 'JWT key required' finding paraphrased: the lead-in tells the reader to set two keys while the list marks one optional. [defects, defects #141910]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-b49ddbc643
Docker Hub README: The Docker Hub README names only the Gemfile.d/app.rb line although the diff also changes Gemfile.lock and the build removes spec/, .github/ and the workspace package.json files. [defects, defects #141911]		lowopenheld review (review model)—
RSD-canvas-d098900f98
Database handbook: Same class as the round 6 backup findings, repeated in the Redis section: the sentence says only PostgreSQL holds recoverable state, which omits the files volume and the encryption key that the… [defects, defects #142835]		lowfixed-before-releaseheld review (review model)—
RSD-canvas-5337ef40e3
Admin handbook: The handbooks call Redis a disposable cache and describe starting over on an empty database, but do not say that a Redis left over from an earlier database makes db:initial_setup fail; the customer… [defects, defects #142836]		lowfixed-before-releaseheld review (review model)—

Verification

2 items not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:3535e722ffb3d4e850e8aa266a00beb5f94dada56dea624ea2d3640a5b922163 · published digest sha256:3535e722ffb3d4e850e8aa266a00beb5f94dada56dea624ea2d3640a5b922163 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 780) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 679 package_archive gate_result.g8.result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-30T01:34:47Z · failing Docker Scout counts 119 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 111 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: academic_benchmarks. · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • First own scan of the releaseA (at 2026-10-30T01:55:00Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-29T06:23:34Z) [image_scans, image_scans #1574]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-30T01:33:47Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3621068065 · transparency-log entry · integrated 2026-11-01T05:19:10Z) [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:79b1ec971c178dd8c078b5cdb7099b5bb3514f5352c02619a1b3b8b1b4bcaf8c · state attached · log index 3581735449 · transparency-log entry
    • kind sbom · digest sha256:79b1ec971c178dd8c078b5cdb7099b5bb3514f5352c02619a1b3b8b1b4bcaf8c · state attached · log index 3581737389 · transparency-log entry
    • kind vsa · digest sha256:79b1ec971c178dd8c078b5cdb7099b5bb3514f5352c02619a1b3b8b1b4bcaf8c · state attached · log index 3581740054 · transparency-log entry
    • kind provenance · digest sha256:3535e722ffb3d4e850e8aa266a00beb5f94dada56dea624ea2d3640a5b922163 · state attached · log index 3581742830 · transparency-log entry
    • kind sbom · digest sha256:3535e722ffb3d4e850e8aa266a00beb5f94dada56dea624ea2d3640a5b922163 · state attached · log index 3581745704 · transparency-log entry
    • kind vsa · digest sha256:3535e722ffb3d4e850e8aa266a00beb5f94dada56dea624ea2d3640a5b922163 · state attached · log index 3581749153 · transparency-log entry
    (at 2026-10-30T01:49:23Z) [attestations.json, results]

Offline clean-room rebuilds

  • 2026-10-27T12:51:30Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit no, digest match no, customer verify no, first failure digest_match
    rebuilt sha256:2906e116edd710712051d022b2946579a51c19ed54691044712cfcba3842ee29 [clean-room rebuild ledger, runs[456]]
  • 2026-10-27T14:17:43Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:8eb2bcca4d1f167e72f8913e8906909b8da25420def326430e4f2aebc974e0ee [clean-room rebuild ledger, runs[464]]
  • 2026-10-29T21:49:54Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:3535e722ffb3d4e850e8aa266a00beb5f94dada56dea624ea2d3640a5b922163 [clean-room rebuild ledger, runs[556]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
  • Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

Fully recorded
  • Image pushed (internal tag), publish_image passed2026-10-29T21:14:04Z [stage_runs, stage_runs chain 679 stage publish_image]
  • Release tag promoted2026-10-30T01:51:32Z (method imagetools_create_retag_by_digest_no_rebuild · digest sha256:79b1ec971c178dd8c078b5cdb7099b5bb3514f5352c02619a1b3b8b1b4bcaf8c · tag readystack/canvas:2026-05-20.143-CE-ubuntu24.04-r2) [deliverables/provenance/PROMOTION_RECORD.json, promoted_at]
  • Archive manifests written2026-10-30T01:42:25Z [PUBLISH_MANIFEST.json, published_at]
  • Archive cut over on prodasset, package_archive passed2026-10-30T01:53:52Z [stage_runs, stage_runs chain 679 stage package_archive]
  • Cut-over markerpresent (chain 679) [.cutover.json]
  • Release checklist and site event2026-10-30T01:53:50Z (status complete · site event 298 · steps grade a verified done · release tag promoted done · cosign signed done · release evidence recorded done · contract gate passed done · archive published done · hub readme live done · reproducibility recorded done · defects ledger published done · catalog available done · build request fulfilled done · seo regenerated skipped · site catalogue refreshed done · site grade recorded done · site queue synced done · customer requests charged done · owners notified done) [deliverables/provenance/RELEASE_CHECKLIST.json, run_at]

Packages and CPU level

Fully recorded
  • Packages in the image492 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 1044 · probed 2026-11-02T17:08:51Z · source backfill) [release_images, isa_level_hard]

History

2 events
  • 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records
  • 2026-11-03T00:28:31Z repack: previous sha256 3130d80f0bdb50aa518df25d7cfbe572db139c3544a7ffc9cc6127a361fc79c6 · sha256 f6b94829ae292214de9ac87f57ab782cae7ff4ba6b3fa3c1e024cbc9be624527 · reason customer kit files brought up to the current engine: every pinned input's reason (docs/PINS.md, docs/provenance/PINS.json) and docs/PROVENANCE.md's section pointing at it, rendered by release/pin_reasons.py; docs/PROVENANCE.md's 'Build trail' section pointing at the signed build trail beside the archive (release/build_trail.py); not image inputs; image and every build input unchanged · label kitfix · replaced docs/PROVENANCE.md · added docs/PINS.md, docs/provenance/PINS.json · record MANIFEST.json repack_history

Records

26 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.tar.gz)—
.cutover.jsonbeside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r2/)—
MANIFEST.jsonbeside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r2/)—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r2/)—
ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r2/)—
ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r2/)—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r2/)—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)356
chainssadb, ReadyStack's engine database (not published)679
defectssadb, ReadyStack's engine database (not published)canvas 2026-05-20.143-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 679
held_roundssadb, ReadyStack's engine database (not published)chain 679
image_scanssadb, ReadyStack's engine database (not published)1574
micro_step_runssadb, ReadyStack's engine database (not published)chain 679
release_imagessadb, ReadyStack's engine database (not published)canvas 2026-05-20.143-CE-ubuntu24.04-r2
review_overridessadb, ReadyStack's engine database (not published)1
stage_eventssadb, ReadyStack's engine database (not published)chain 679
stage_runssadb, ReadyStack's engine database (not published)chain 679
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/RELEASE_CHECKLIST.jsonthe chain's workspace on the controller (not published)—