Canvas LMS 2026-05-20.143-CE-ubuntu24.04-r6 build trail
How ReadyStack built readystack/canvas:2026-05-20.143-CE-ubuntu24.04-r6 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/canvas:2026-05-20.143-CE-ubuntu24.04-r6 - Index digestsha256:e0b6f6e8d336f5842f96909cc43224ca8e516ddc114350222ae1eb8f191e078d
- linux/amd64 digestsha256:a12e988306e54f322bedf70233b0738d7686cb4a06f829b17f190c9d699e34d3
- Archive
ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.tar.gz - Archive SHA-256 nowf633c78186237b9458f0c166f4c3507739104cdf2c7af3fdb471ac41c0277bfb
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-12T18:46:15Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.trail.json.sigstore ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductCanvas LMS (canvas) [MANIFEST.json]
- Release tag2026-05-20.143-CE-ubuntu24.04-r6 [MANIFEST.json]
- Imagereadystack/canvas:2026-05-20.143-CE-ubuntu24.04-r6 [MANIFEST.json]
- Image index digestsha256:e0b6f6e8d336f5842f96909cc43224ca8e516ddc114350222ae1eb8f191e078d [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:a12e988306e54f322bedf70233b0738d7686cb4a06f829b17f190c9d699e34d3 [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.tar.gz (bytes 1008874532) [MANIFEST.json]
- Archive sha256 at publishf633c78186237b9458f0c166f4c3507739104cdf2c7af3fdb471ac41c0277bfb [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/instructure/canvas-lms [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refrelease/2026-05-20.143 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit2e2b4a46d08e32667d4845f7b78e1214250345d3 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash222ae1df10656048500098d09530d7337d8bb8fb99e7e3676629165870c2e1af (files 22662) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:bb1a376b39982fac5515279126762e6d7c41b976574690e73b5c974d45c3bc0c [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794448141 (utc 2026-11-12T01:49:01Z) [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.rebuild.json, engine]
- Engine commit(s)
- commit 5cf3b0594a304e32ae246441aa48f3a4b4d2aaa5 · dirty yes · first drive 4452
- commit 1d3c43d9db86693d3b22280581f5473f4d3bdb92 · dirty yes · first drive 4458
Why this release exists
Fully recorded- Chain1030 (created 2026-11-12T16:08:37Z · trigger customer_request · upstream version 2026-05-20.143) [chains, chains #1030]
- Requestbuild request #685 (rebuild) (requested at 2026-11-12T01:49:03Z · requested by kitforge-agent · version 2026-05-20.143) [build_requests, build_requests #685]
- Reasonrevision 2026-05-20.143-CE-ubuntu24.04-r6: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #685 request_reason]
- Supersedesreadystack/canvas:2026-05-20.143-CE-ubuntu24.04-r5 (chain 968) [chains, chains #968]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1030 release · ready_to_ship
Created 2026-11-12T16:08:37Z, upstream 2026-05-20.143, build request 685 [chains, chains #1030]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4452 | 2026-11-12T16:09:24Z | 92.7 | build host 1 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4452] |
| 4458 | 2026-11-12T18:31:18Z | — | build host 1 publish-held | not recorded [drive_runs, drive_runs #4458] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-12T16:09:35Z | 2026-11-12T16:09:36Z | 1 | 4
|
order_json 116cea933c6e… |
acquire |
2026-11-12T16:10:13Z | 2026-11-12T16:10:15Z | 1 | 12
|
source_tree cab5b8b605e3…license_file 57c8ff33c9c0…custody_inputs 245070a7f8a1…source_tree_hash 642cb5fb3665…source_file_manifest c2d9b38b00e9… |
plan |
2026-11-12T16:10:53Z | 2026-11-12T16:10:54Z | 1 | 10
|
recon_report 568be97e7e72…input_pin_plan 16ec46b40775…toolchain_lock 331ca67b24c4… |
assemble_kit |
2026-11-12T16:45:33Z | 2026-11-12T16:45:34Z | 1 | 27
|
dockerfile d3b1baf143d1…build_recipe e98b31d17585…system_pinning 762ec5577126…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health 264a8b313af3…verify_offline_sh 3e8184ea230c…base_image_digests db1a64ed3312…dockerfile_offline d3b1baf143d1…first_build_digest 2c3977052c42… |
remediate |
2026-11-12T16:46:10Z | 2026-11-12T16:46:10Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 67efb6ac6eeb…security_report acb45aa1cc6d… |
build_kit |
2026-11-12T17:09:49Z | 2026-11-12T17:09:49Z | 1 | 9
|
cosign_stamp 82ff279743fe…locked_digest b04ba1df2d46…freeze_manifest fc4ec125b08f…offline_rebuild_transcript ebd8eea25064… |
verdict |
2026-11-12T17:13:11Z | 2026-11-12T17:13:11Z | 1 | 8
|
scout_verdict 8bc002aea5c0… |
publish_image |
2026-11-12T17:14:38Z | 2026-11-12T17:14:39Z | 1 | 7
|
hub_readme ea213628423e…promotion_record a0662fa34fd5… |
boot_instance |
2026-11-12T17:16:32Z | 2026-11-12T17:16:36Z | 2 | 3
|
instance_handle 413ae0f5b920… |
sbom |
2026-11-12T17:17:31Z | 2026-11-12T17:17:32Z | 1 | 5
|
sbom_md e629d999d48e…sbom_json 8522246f91bf… |
schema_discovery |
2026-11-12T17:17:34Z | 2026-11-12T17:17:35Z | 1 | 7
|
schema_hash 381015f79a1b…dependency_tree 61fe400e72b6…table_classification 59cee695e5a5… |
admin_handbook |
2026-11-12T17:17:42Z | 2026-11-12T17:17:43Z | 1 | 7
|
api_map 80bc742414c1…admin_handbook 5ae917d63d98… |
db_handbook |
2026-11-12T17:17:52Z | 2026-11-12T17:17:53Z | 1 | 8
|
db_handbook 7d814cf5cfda…seed_isolation c29b1a346a6a… |
seed_data |
2026-11-12T17:18:03Z | 2026-11-12T17:18:04Z | 1 | 6
|
seed_data_sql a0f6af47712c…seed_cases_json 9804745d99f5… |
seed_validate |
2026-11-12T17:18:07Z | 2026-11-12T17:18:07Z | 1 | 3
|
seed_data_contract 6b9605ba07fe… |
usecase_validate |
2026-11-12T17:18:28Z | 2026-11-12T17:18:29Z | 1 | 10
|
failed_tests 62f069916c41…passed_tests 95e2025a8ea8…test_results acc2a71bfad7…usecase_contract 1c150eef1704… |
finalize_docs |
2026-11-12T17:18:35Z | 2026-11-12T17:18:36Z | 1 | 9
|
defects_json dff28f1b1a4c…release_notes 818fac7f9b5b…api_integration_guide f336450fb361… |
package_archive invalidated 2026-11-12T18:30:52Z |
2026-11-12T17:42:04Z | 2026-11-12T17:42:07Z | 1 | 37 (final gate PASS)
|
sale_tar c6f737928277…checksums 3a4b3910bffd…verify_md 51f9d8f5a915…rebuild_md 07d041a472c9…manifest_txt 68681d0432ae…actions_jsonl b515eba34133…provenance_md 32cb273db8ad…assetchain_log_md e9eccaec0c0f…assetchain_log_json 5d0655bf1180… |
[stage_runs]
Rewinds
- 2026-11-12T18:30:52Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #34306]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-12T17:42:07Z.
5 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 11248 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 11592 | L-A183, L-A15 |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 1718 | L-A59 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.32 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-12T17:45:11Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1829] | $0.32 | 3 rounds, $40.00 | c6f737928277… |
Defects
Fully recorded- Ledger entries1 [defects, defects where product_slug=canvas and this tag or chain]
- Disclosed in the archive1 [docs/defects/defects.json, entries]
1 ledger entry: by severity low 1; by status open 1.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-canvas-459f7e3143Docker Hub README: The Docker Hub README names only the Gemfile.d/app.rb line although the diff also changes Gemfile.lock and the build removes spec/, .github/ and the workspace package.json files. [defects, defects #272267] | low | open | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:a12e988306e54f322bedf70233b0738d7686cb4a06f829b17f190c9d699e34d3 · published digest sha256:a12e988306e54f322bedf70233b0738d7686cb4a06f829b17f190c9d699e34d3 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 564) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T18:32:24Z · failing Docker Scout counts 119 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 111 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: academic_benchmarks.) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T18:31:31Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3836904383 · transparency-log entry
- log index 3836905632 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3838076115 · transparency-log entry · integrated 2026-11-12T18:44:18Z) [ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:e0b6f6e8d336f5842f96909cc43224ca8e516ddc114350222ae1eb8f191e078d · state attached · log index 3838082461 · transparency-log entry
- kind sbom · digest sha256:e0b6f6e8d336f5842f96909cc43224ca8e516ddc114350222ae1eb8f191e078d · state attached · log index 3838084789 · transparency-log entry
- kind vsa · digest sha256:e0b6f6e8d336f5842f96909cc43224ca8e516ddc114350222ae1eb8f191e078d · state attached · log index 3838087704 · transparency-log entry
- kind provenance · digest sha256:a12e988306e54f322bedf70233b0738d7686cb4a06f829b17f190c9d699e34d3 · state attached · log index 3838089852 · transparency-log entry
- kind sbom · digest sha256:a12e988306e54f322bedf70233b0738d7686cb4a06f829b17f190c9d699e34d3 · state attached · log index 3838091554 · transparency-log entry
- kind vsa · digest sha256:a12e988306e54f322bedf70233b0738d7686cb4a06f829b17f190c9d699e34d3 · state attached · log index 3838093061 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/canvas/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-12T17:45:19Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:a12e988306e54f322bedf70233b0738d7686cb4a06f829b17f190c9d699e34d3 [clean-room rebuild ledger, runs[801]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-12T17:14:39Z [stage_runs, stage_runs chain 1030 stage publish_image]
- Archive manifests written2026-11-12T18:38:41Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 1044 · probed 2026-11-12T17:00:09Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-12T18:46:15Z generated: by KitForge release/build_trail.py · generator commit 1d3c43d9db86693d3b22280581f5473f4d3bdb92
- 2026-11-12T18:49:10Z publication: promoted at 2026-11-12T18:47:05Z · promoted digest sha256:e0b6f6e8d336f5842f96909cc43224ca8e516ddc114350222ae1eb8f191e078d · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 515 · checklist status complete · checklist at 2026-11-12T18:49:10Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r6/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r6/), as staged for publishing | — |
ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.rebuild.json | beside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r6/), as staged for publishing | — |
ReadyStack-canvas-2026-05-20.143-CE-ubuntu24.04-r6.rebuild.json.sigstore | beside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r6/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/canvas/2026-05-20.143-CE-ubuntu24.04-r6/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 685 |
chains | sadb, ReadyStack's engine database (not published) | 1030 |
defects | sadb, ReadyStack's engine database (not published) | canvas 2026-05-20.143-CE-ubuntu24.04-r6 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1030 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1030 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1030 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1030 |
release_images | sadb, ReadyStack's engine database (not published) | canvas 2026-05-20.143-CE-ubuntu24.04-r6 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1030 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1030 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |