changedetection.io 0.60.10-CE-ubuntu24.04-r1 build trail

• Productchangedetection.io (changedetection) [MANIFEST.json]
• Release tag0.60.10-CE-ubuntu24.04-r1 [MANIFEST.json]
• Imagereadystack/changedetection:0.60.10-CE-ubuntu24.04-r1 [MANIFEST.json]
• Image index digestsha256:38dfa7fa7bc63368e9c380cc03cd60c2d5cef0a46fd3e3df941cc70cfde34846 [docs/provenance/LOCKED_DIGEST.txt]
• linux/amd64 image digestsha256:99092a0c9ffe8f4371f53957c083fb32d64e0070e40a13d55cd21d9a4fb38437 [ReadyStack-changedetection-0.60.10-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
• ArchiveReadyStack-changedetection-0.60.10-CE-ubuntu24.04-r1.tar.gz (bytes 423217788) [MANIFEST.json]
• Archive sha256 at publish3e5e894d58514aa61f5dfc40a788200b93c3bc4ebd8dd0e80df518a16260ab5b [MANIFEST.json, repack_history[0].previous_tarball_sha256]
• Archive sha256 nowe08018f89f95ad2f989a218297f7a102d5b18edd537e5b0e8cc6301cf1ac6143 [MANIFEST.json, tarball_sha256]
• Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
• Repack history
  • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 3e5e894d58514aa61f5dfc40a788200b93c3bc4ebd8dd0e80df518a16260ab5b · sha256 e08018f89f95ad2f989a218297f7a102d5b18edd537e5b0e8cc6301cf1ac6143 · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
  [MANIFEST.json, repack_history]
• Upstream repositoryhttps://github.com/dgtlmoon/changedetection.io [docs/provenance/SOURCE_TREE_HASH.json]
• Upstream ref0.60.10 [docs/provenance/SOURCE_TREE_HASH.json]
• Upstream commit16974bf351cd68b1978af9494082b75efadaa8e0 [docs/provenance/SOURCE_TREE_HASH.json]
• Source tree hashf45413f0584911392b7aae2cff7d933ce697c000566cabb4b87d72192731af38 (files 1175) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
• Kit tree hashsha256:d219e207e61b9be495223beaae57e215af8e7cc35efd2488e26bc910f270e118 [ReadyStack-changedetection-0.60.10-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
• SOURCE_DATE_EPOCH1793015953 (utc 2026-10-26T11:59:13Z) [ReadyStack-changedetection-0.60.10-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
• Base images
  • ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
  [ReadyStack-changedetection-0.60.10-CE-ubuntu24.04-r1.rebuild.json, bases]
• BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-changedetection-0.60.10-CE-ubuntu24.04-r1.rebuild.json, engine]

• Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

• Chain709 (created 2026-10-27T16:46:00Z · trigger customer_request · upstream version 0.60.10) [chains, chains #709]
• Requestbuild request #385 (rebuild) (requested at 2026-10-27T04:38:53Z · requested by kitforge-agent · version 0.60.10) [build_requests, build_requests #385]
• Reasonretarget to 0.60.10: a newer upstream release (rule 1) [build_requests, build_requests #385 request_reason]
• Supersedesreadystack/changedetection:0.60.9-CE-ubuntu24.04-r3 (chain 641) [chains, chains #641]

1 chain · 5 drives · 18 stages · 2 rewinds

Stages, in order

[stage_runs]

Rewinds

• 2026-10-28T05:54:04Z: verdict to assemble_kit on strategy_changed (chain 709: strategy changed — rewound from 'verdict' to assemble_kit and dropped the vendored tree so the change actually reaches the build.) [stage_events, stage_events #2341]
• 2026-10-28T10:07:02Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #745]

• Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
• Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Role: writer model. Calls up to 2026-10-28T10:17:46Z.

6 calls over 3 stages

[micro_step_runs]

• Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
• Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
• Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Role: review model.

1 round, 1 counted, $0.44 recorded cost

• Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
• Not recorded: the round cap in force at each round (the state files did not keep it)

• Ledger entries6 [defects, defects where product_slug=changedetection and this tag or chain]
• Disclosed in the archive5 [docs/defects/defects.json, entries]

6 ledger entries: by severity high 1, low 4, medium 1; by status open 3, fixed-before-release 2, fixed-in-release 1.

• Reproduced before publishingyes (rebuilt digest sha256:99092a0c9ffe8f4371f53957c083fb32d64e0070e40a13d55cd21d9a4fb38437 · published digest sha256:99092a0c9ffe8f4371f53957c083fb32d64e0070e40a13d55cd21d9a4fb38437 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 251) [docs/provenance/REPRO_VERIFICATION.json, verified]
• Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 709 package_archive gate_result.g8.result]
• Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-28T10:09:27Z · failing Docker Scout counts 120 packages with copyleft licences (EPL, GPL, LGPL, MPL), 116 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
• First own scan of the releaseA (at 2026-10-28T10:17:57Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-28T06:23:30Z) [image_scans, image_scans #1455]
• Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-28T10:08:45Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
• Image signature transparency-log entries
  • log index 3533928300 · transparency-log entry
  • log index 3533928444 · transparency-log entry
  [docs/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
• rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3621198961 · transparency-log entry · integrated 2026-11-01T05:24:17Z) [ReadyStack-changedetection-0.60.10-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]

Offline clean-room rebuilds

• 2026-10-28T07:15:30Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
  rebuilt sha256:99092a0c9ffe8f4371f53957c083fb32d64e0070e40a13d55cd21d9a4fb38437 [clean-room rebuild ledger, runs[513]]

• Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
• Not recorded: the attestations' transparency-log entries (no attestation record in the release's workspace)
• Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

• Image pushed (internal tag), publish_image passed2026-10-28T06:16:17Z [stage_runs, stage_runs chain 709 stage publish_image]
• Archive manifests written2026-10-28T10:11:22Z [PUBLISH_MANIFEST.json, published_at]
• Archive cut over on prodasset, package_archive passed2026-10-28T10:17:46Z [stage_runs, stage_runs chain 709 stage package_archive]
• Cut-over markerpresent (chain 709) [.cutover.json]

• Not recorded: when the release tag was promoted (the promotion record in the archive was written before the promotion, and the release's workspace no longer holds this chain)
• Not recorded: the site event's time (the release checklist is in the chain's workspace, which no longer holds this chain)

• Packages in the image316 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
• x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 992 · probed 2026-11-02T17:02:55Z · source backfill) [release_images, isa_level_hard]

• 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records
• 2026-11-03T00:32:18Z repack: previous sha256 e08018f89f95ad2f989a218297f7a102d5b18edd537e5b0e8cc6301cf1ac6143 · sha256 c690f2f560fbc116ea8f15086b7f5cbb15dd7366c4aa8c09f863b51b74b6fcc3 · reason customer kit files brought up to the current engine: every pinned input's reason (docs/PINS.md, docs/provenance/PINS.json) and docs/PROVENANCE.md's section pointing at it, rendered by release/pin_reasons.py; docs/PROVENANCE.md's 'Build trail' section pointing at the signed build trail beside the archive (release/build_trail.py); not image inputs; image and every build input unchanged · label kitfix · replaced docs/PROVENANCE.md · added docs/PINS.md, docs/provenance/PINS.json · record MANIFEST.json repack_history