cloudflared 2026.10.7-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/cloudflared:2026.10.7-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/cloudflared:2026.10.7-CE-ubuntu24.04-r2
  • Index digestsha256:62b79484cca90003252cf9a092b839fcbe99fcb47835b035ed64ac7c693d578a
  • linux/amd64 digestsha256:ef1b064483decfc5c5323c3e5f2c850cd17b200b11951fe3e935b4c9d9c25215
  • ArchiveReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 nowdf8097dae465e9844211cb366859f5a4a256ba0ecd93a34ef81ee0e2fdd59d44
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-08T12:20:50Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.trail.json
ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.trail.jsonReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.trail.mdcloudflared product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • Productcloudflared (cloudflared) [MANIFEST.json]
  • Release tag2026.10.7-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/cloudflared:2026.10.7-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:62b79484cca90003252cf9a092b839fcbe99fcb47835b035ed64ac7c693d578a [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:ef1b064483decfc5c5323c3e5f2c850cd17b200b11951fe3e935b4c9d9c25215 [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.tar.gz (bytes 459035434) [MANIFEST.json]
  • Archive sha256 at publishdf8097dae465e9844211cb366859f5a4a256ba0ecd93a34ef81ee0e2fdd59d44 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/cloudflare/cloudflared [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref2026.10.7 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit872b241f94871665c1c157adefcf90c11f0ead96 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashead232ece2af8a12a4909624ac0dae58773921a5bffd4614f61004e56a6c66e3 (files 487) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:1133bdec7edc353b96ea648a79bf01e775c64331e15214d236316776e020d794 [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793378609 (utc 2026-10-30T16:43:29Z) [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit de82d9f15f2f16d4019ffa4fd6872481dac1dbe0 · dirty yes · first drive 3669
    • commit 92dcb99fd5af2466b8a040e9b12f1cd9afdd07b3 · dirty yes · first drive 3691
    • commit 1d24a22962e9de18cdeec385796ad8804bed7d3c · dirty yes · first drive 3714
    • commit 3d32cc1dd39bba72d2a0135dfa6216cfa284f64a · dirty yes · first drive 3772
    • commit 51b2b16f817c9ef72f9eae92153faa98cb236aff · dirty yes · first drive 3780
    • commit 14ac19f4178268c2dbfa7e7cae4be76d466ea445 · dirty yes · first drive 3792
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain863 (created 2026-11-08T02:56:44Z · trigger customer_request · upstream version 2026.10.7) [chains, chains #863]
  • Requestbuild request #539 (rebuild) (requested at 2026-11-08T02:54:47Z · requested by kitforge-agent · version 2026.10.7) [build_requests, build_requests #539]
  • Reasonrevision 2026.10.7-CE-ubuntu24.04-r2: same upstream version rebuilt on the chiselled slim base (Core slim batch, PR #195; retarget.py --rev-bump) [build_requests, build_requests #539 request_reason]
  • Supersedesreadystack/cloudflared:2026.10.7-CE-ubuntu24.04-r1 (chain 844) [chains, chains #844]

The path through the harness

Fully recorded

1 chain · 6 drives · 18 stages · 4 rewinds

Chain 863 release · ready_to_ship

Created 2026-11-08T02:56:44Z, upstream 2026.10.7, build request 539 [chains, chains #863]

DriveStartedMinutesBuild hostHow it stopped
36692026-11-08T02:57:06Z31build host 5 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3669]
36912026-11-08T04:37:21Z1.7build host 5 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3691]
37142026-11-08T06:06:24Z4.4build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3714]
37722026-11-08T11:04:33Z4.1build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3772]
37802026-11-08T11:30:50Z2.4build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3780]
37922026-11-08T12:17:06Z—build host 5 publish-held not recorded [drive_runs, drive_runs #3792]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-08T02:57:18Z2026-11-08T02:57:18Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json ee9e32d0231e…
acquire 2026-11-08T02:57:22Z2026-11-08T02:57:23Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 6fb32f90eb40…
license_file 58d1e17ffe51…
custody_inputs 6ad976ab0a20…
source_tree_hash ac50f8ad4e88…
source_file_manifest 7968487fb727…
plan 2026-11-08T02:57:52Z2026-11-08T02:57:52Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 9f8815556cc3…
input_pin_plan 0fe2b589101d…
toolchain_lock 3b0411246fc5…
assemble_kit 2026-11-08T03:00:24Z2026-11-08T03:00:25Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 77cc087e63fe…
build_recipe 4b67e03d7c05…
system_pinning fa091140511e…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 6c2c03b68f94…
verify_offline_sh 3e8184ea230c…
base_image_digests 38951f88945d…
dockerfile_offline 77cc087e63fe…
first_build_digest 24e48d31129f…
remediate 2026-11-08T03:01:01Z2026-11-08T03:01:02Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 98d6bf2ea674…
security_report aeb3558dffd4…
build_kit 2026-11-08T03:04:56Z2026-11-08T03:04:57Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 55f66b56d8b2…
locked_digest 613ed408e736…
freeze_manifest d83b007a366e…
offline_rebuild_transcript 98c5de4cc079…
verdict 2026-11-08T03:05:32Z2026-11-08T03:05:33Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 97ca0be2c5c5…
publish_image 2026-11-08T03:06:04Z2026-11-08T03:06:05Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 31025214f20f…
promotion_record 1cba1e6ec2ce…
boot_instance 2026-11-08T03:06:16Z2026-11-08T03:06:23Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle f38e99a09503…
sbom 2026-11-08T03:06:34Z2026-11-08T03:06:34Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 27dcbf535393…
sbom_json 2bec7097f251…
schema_discovery 2026-11-08T03:06:37Z2026-11-08T03:06:37Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 3e14821deba7…
dependency_tree 519ec69aae9f…
table_classification 52a8b59c22a1…
admin_handbook 2026-11-08T03:12:27Z2026-11-08T03:12:28Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 78587680e440…
admin_handbook c2d723bbae97…
db_handbook 2026-11-08T03:17:05Z2026-11-08T03:17:06Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 4708cb386ed8…
seed_isolation 9d9634c8d2ba…
seed_data 2026-11-08T03:17:18Z2026-11-08T03:17:19Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 81b58bb65ad3…
seed_cases_json 8473177fdfe6…
seed_validate 2026-11-08T03:17:22Z2026-11-08T03:17:22Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 13e25e92d9d9…
usecase_validate 2026-11-08T03:17:43Z2026-11-08T03:17:44Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 0f5bc14c3a9f…
test_results 2e5ebf16ecff…
usecase_contract 61e2e7ca9a09…
finalize_docs 2026-11-08T03:23:01Z2026-11-08T03:23:02Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 92fda515b33b…
release_notes fa4660288f8b…
api_integration_guide ad7ef377396a…
package_archive invalidated 2026-11-08T12:16:34Z 2026-11-08T03:27:59Z2026-11-08T11:33:15Z5
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 08c71a85f1c7…
checksums 4f82d6723ed2…
verify_md ae8d3247bc5c…
rebuild_md 947b883650ad…
manifest_txt a539a70cb221…
actions_jsonl d0c83e861d0b…
provenance_md 4522e3ce62d3…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json bd478bf6f200…

[stage_runs]

Rewinds

  • 2026-11-08T04:04:22Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #25075]
  • 2026-11-08T06:59:06Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #25352]
  • 2026-11-08T11:27:55Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26030]
  • 2026-11-08T12:16:34Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26133]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-08T11:33:15Z.

98 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 07251 —
remediate2001 010933 L-A08, L-038, L-036, L-034, L-032
admin_handbook371603 3193027 —
db_handbook25703 0114657 —
usecase_validate1001 01753 —
finalize_docs31903 0148412 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

4 rounds, 4 counted, $5.11 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-08T03:28:54Z 0159 findings to repackage [held_rounds, held_rounds #1469] $1.30 3 rounds, $40.00 a7fabf9b1837…
22026-11-08T06:11:40Z 028 findings to repackage [held_rounds, held_rounds #1479] $1.44 3 rounds, $40.00 d992dcc74088…
32026-11-08T11:09:40Z 0111 findings to repackage [held_rounds, held_rounds #1501] $1.31 3 rounds, $40.00 75b11588504b…
42026-11-08T11:34:01Z 0011 clean to publish [held_rounds, held_rounds #1504] $1.05 3 rounds, $40.00 08c71a85f1c7…

Defects

Fully recorded
  • Ledger entries57 [defects, defects where product_slug=cloudflared and this tag or chain]
  • Disclosed in the archive57 [docs/defects/defects.json, entries]

57 ledger entries: by severity medium 1, high 17, low 39; by status open 1, fixed-before-release 56.

DefectSeverityStatusFound byFixed in
RSD-cloudflared-91acce27cd
Unauthenticated metrics port 20241 by default [defects, defects #170062]		mediumopenbuild strategy record—
RSD-cloudflared-8ed0c59733
Admin handbook: IMAGE_CONFIG.json Entrypoint [cloudflared,--no-autoupdate], Cmd [tunnel,run]. [defects, defects #170112]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-7399e4efb7
Admin handbook: IMAGE_CONFIG.json Healthcheck Interval 5000000000 ns (5 s), Timeout 10 s, StartPeriod 30 s; docker inspect on the live container: Interval 5000000000. [defects, defects #170113]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-310d48cd2d
Admin handbook: Ran it on the live image: `cloudflared tunnel info` -> '"cloudflared tunnel info" accepts exactly one argument, the ID or name of the tunnel to get info about.' rc=255. [defects, defects #170114]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-1422ab91f5
Admin handbook: Under 'To check readiness from outside the container' the documented run command (line 108) publishes no port (Ports section line 274: 'not published to the Docker host by default'), so a host curl… [defects, defects #170115]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-9792d746e1
Admin handbook: Docker never restarts a container for a failing HEALTHCHECK; the same handbook says the opposite at lines 418 and 974 ('A failing health check marks the container unhealthy but does not stop it'). [defects, defects #170116]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-32d942d69c
Admin handbook: IMAGE_CONFIG.json Entrypoint/Cmd; `--no-autoupdate` is a flag, it takes no arguments, so 'arguments to --no-autoupdate' is wrong (line 753 gives the correct command line). [defects, defects #170117]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-967c743c80
Admin handbook: IMAGE_BINARIES.txt lists dash and sh; live `docker exec ... [defects, defects #170118]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-5f20469219
Admin handbook: `cloudflared tunnel create` writes only the credentials JSON (and uses cert.pem from `tunnel login`); it does not create config.yml. [defects, defects #170119]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-1c3172934c
Admin handbook: No record supports a token expiring from disuse. [defects, defects #170120]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-027ed8bf46
Database handbook: Live: `docker exec ... id` -> 'exec: "id": executable file not found in $PATH' (rc 127). IMAGE_BINARIES.txt has no id; RELEASE_NOTES.md line 21: 'no bash, curl, grep, ls or id'. The shown output… [defects, defects #170121]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-330661160e
Database handbook: Contradicts the handbook's own lines 358 and 727 and the strategy doc_rule ('a host service bound only to 127.0.0.1 is unreachable from the container through host.docker.internal (connection times… [defects, defects #170122]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-9cdc35d5e3
Database handbook: Same defect as line 343: a localhost-only host service is unreachable through host.docker.internal (this handbook line 358). [defects, defects #170123]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-a47386fe42
Database handbook: IMAGE_BINARIES.txt lists sh and dash; live `docker exec ... [defects, defects #170124]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-786fb51b6d
Database handbook: Inside the cloudflared container 127.0.0.1 is the container itself, where nothing listens on 8080, so the exposed address would serve only errors; the strategy doc_rule 'localhost inside the… [defects, defects #170125]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-75e3e3b05d
Database handbook: No record supports a statement about Quick Tunnel inactivity expiry (strategy doc_rule: 'no record supports an inactivity expiry for Quick Tunnels; say they may be terminated at any time'). [defects, defects #170126]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-85681a712d
Database handbook: Live: env-file TUNNEL_TOKEN=garbage -> container Exited (255) after ~1 s, log 'Provided Tunnel token is not valid.\nSee cloudflared tunnel run --help.'; there is no running health endpoint to report… [defects, defects #170127]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-fb57715a3a
API guide: In the token-setup step the first command is `docker rm cloudflared` followed by `docker run ... [defects, defects #170128]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-bf215518b9
API guide: Live: `docker run -p 10.0.0.0/8:20241:20241 IMAGE --version` is rejected by the docker CLI (invalid host IP: a CIDR range is not a bind address); -p takes one IP address. [defects, defects #170129]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-20aa4a2bbc
API guide: Live: `rs-probe -body http://127.0.0.1:20241/quicktunnel` on a --hello-world container -> {"hostname":"forty-pty-latter-phd.trycloudflare.com"} (no scheme, JSON-wrapped). [defects, defects #170130]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-c963ddb78d
API guide: No record names cdn.cloudflare.com as a tunnel endpoint; the connector connects to Cloudflare's argotunnel edge on 7844 (the handbooks say port 7844). [defects, defects #170131]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-fcae2de8f4
API guide: Live: a credentials file mode 640 owned by another uid, bind-mounted at /etc/cloudflared, run with `tunnel --config /etc/cloudflared/config.yml run` -> "couldn't read tunnel credentials from… [defects, defects #170132]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-507d60c555
API guide: No record shows a 'Rotate Token' control or that running connectors are disconnected; line 330 of the same guide describes a different procedure (delete the old token, generate a new one). [defects, defects #170133]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-bebc5d5b41
API guide: No record supports 'within seconds' or that existing connectors are invalidated; unsupported timing claim. [defects, defects #170134]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-775c283272
Admin handbook: Live on the image (default-command hello-world container): `docker exec c cloudflared tunnel info foo` -> 'ERR Cannot determine default origin certificate path. [defects, defects #170996]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-f4387777ed
Admin handbook: The stated requirement is wrong: the failure is the missing origin cert (cert.pem), not the credentials file (see the item for line 335). [defects, defects #170997]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-4b7186cb91
Admin handbook: Live: a well-formed token (base64 {a,t,s}) for a nonexistent tunnel -> container 'Up 14 seconds (health: starting)', log 'ERR Register tunnel error from server side error="Failed to get tunnel" ... [defects, defects #170998]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-2cf77c2c04
Admin handbook: A user-defined network's gateway address is the host side of the bridge; it reaches host services, not another container. [defects, defects #170999]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-6c9ee420e9
Admin handbook: Live (held-run, this image): `docker run IMAGE tunnel create foo` -> 'failed to create tunnel: couldn't create client to talk to Cloudflare Tunnel backend: Error locating origin cert: client didn't… [defects, defects #171000]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-ff53c62149
Admin handbook: Live: the documented mount layout (/etc/cloudflared/<UUID>.json + config.yml) with a config.yml holding only `ingress:` -> '"cloudflared tunnel run" requires the ID or name of the tunnel to run as… [defects, defects #171001]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-5312e307f5
API guide: rs-probe.go:86-103 and live: `rs-probe -body http://127.0.0.1:20241/ready` prints only {"status":200,"readyConnections":1,...}; `-code` prints 200. [defects, defects #171002]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-077983263c
API guide: Live: `rs-probe http://127.0.0.1:20241/ready` prints nothing, rc=0; `rs-probe -code http://127.0.0.1:20241/healthcheck` prints 200 (rs-probe.go:94-103). [defects, defects #171003]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-5e23406e74
API guide: The metrics server is part of the cloudflared process; a stopped/crashed container has no listener (the token-run container with an invalid token exits 255 with no endpoint). [defects, defects #171004]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-c4129ec3e5
API guide: Live: `docker run --entrypoint cloudflared -v config.yml ... [defects, defects #171005]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-34798df6e0
API guide: The rotation procedure ends with `docker restart cloudflared` after editing cloudflared.env; the restarted connector still holds the old (compromised) token. [defects, defects #175060]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-f2a974485a
API guide: Sentence introduces the plain rs-probe form as the way to query readiness; the example prints no status or body (same class as the round-2 finding). [defects, defects #175061]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-8e37ba9833
API guide: 'add -code:' is followed by a command without -code, which prints nothing. [defects, defects #175062]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-6c699a3a33
Database handbook: The 'query' example is the plain form, which returns no data. [defects, defects #175063]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-3aed056e5d
API guide: Endpoint is present in every mode; it only carries a hostname during a Quick Tunnel. [defects, defects #175064]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-77785554fb
API guide: 'an appropriate response indicating that no tunnel is currently running' is unspecific; the real response is 200 with an empty hostname, which a script could mistake for success. [defects, defects #175065]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-058357b0c2
API guide: The credentials file does not contain a certificate. [defects, defects #175066]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-8bee66116b
Database handbook: 'persists your tunnel's certificate and key' is wrong. [defects, defects #175067]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-6020403bd2
API guide: The rewritten Locally-Managed section never says config.yml needs `tunnel:` and `credentials-file:`; following it alone fails to start. [defects, defects #175068]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-809d0ae6cb
API guide: 'you must publish port 20241' contradicts the guide's own docker exec examples. [defects, defects #175069]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-317437df28
API guide: 'beyond its working directory' omits /tmp, which is also writable. [defects, defects #175070]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-57966b2034
Database handbook: 'read fresh at each container start' is false for docker start/restart (the same claim recurs in API 78/154 and admin 'reads ... [defects, defects #175071]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-9b5252ecaf
Admin handbook: docker restart/start keep the container's environment from creation: measured on the review host, a container created with --env-file, whose file was then rewritten to TUNNEL_TOKEN=CHANGED, still… [defects, defects #175864]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-213cd2eb4b
Admin handbook: docker restart/start keep the container's environment from creation: measured on the review host, a container created with --env-file, whose file was then rewritten to TUNNEL_TOKEN=CHANGED, still… [defects, defects #175865]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-38e6dd764c
API guide: docker restart/start keep the container's environment from creation: measured on the review host, a container created with --env-file, whose file was then rewritten to TUNNEL_TOKEN=CHANGED, still… [defects, defects #175866]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-8437317c4b
Database handbook: docker restart/start keep the container's environment from creation: measured on the review host, a container created with --env-file, whose file was then rewritten to TUNNEL_TOKEN=CHANGED, still… [defects, defects #175867]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-244822275e
Database handbook: docker restart/start keep the container's environment from creation: measured on the review host, a container created with --env-file, whose file was then rewritten to TUNNEL_TOKEN=CHANGED, still… [defects, defects #175868]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-f50249d34c
Docker Hub README: docker restart/start keep the container's environment from creation: measured on the review host, a container created with --env-file, whose file was then rewritten to TUNNEL_TOKEN=CHANGED, still… [defects, defects #175869]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-98efcee10a
API guide: Measured: `rs-probe http://127.0.0.1:20241/ready` printed nothing to stdout and exited 1 on a 503 (only stderr 'rs-probe: HTTP 503'). [defects, defects #175870]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-7811369a42
API guide: Measured in a running container as the image user: printf x > file succeeded in /tmp, /var/tmp, /home/cloudflared and /dev/shm; failed in /etc, /run, /var/lock, /usr/local/bin and / (scratch t2.sh). [defects, defects #175871]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-9eac5340e3
Admin handbook: Contradicts the same handbook: lines 167, 258, 641, 697-702 document /healthcheck, /metrics, /config, /quicktunnel and /debug/pprof on the same port, and IMAGE test-results.json passes all five… [defects, defects #175872]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-a30ad2e3c0
Database handbook: Measured with `tunnel --hello-world`: GET /quicktunnel returned {"hostname":"assessment-beginners-winter-pixel.trycloudflare.com"} (no scheme, no https://) and, in a token-run container,… [defects, defects #175873]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-2572f32a99
Database handbook: The two sentences contradict each other ('cannot ... [defects, defects #175874]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:ef1b064483decfc5c5323c3e5f2c850cd17b200b11951fe3e935b4c9d9c25215 · published digest sha256:ef1b064483decfc5c5323c3e5f2c850cd17b200b11951fe3e935b4c9d9c25215 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 121) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T12:17:27Z · failing Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T12:17:17Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3755030414 · transparency-log entry · integrated 2026-11-08T12:19:42Z) [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:62b79484cca90003252cf9a092b839fcbe99fcb47835b035ed64ac7c693d578a · state attached · log index 3755032516 · transparency-log entry
    • kind sbom · digest sha256:62b79484cca90003252cf9a092b839fcbe99fcb47835b035ed64ac7c693d578a · state attached · log index 3755034084 · transparency-log entry
    • kind vsa · digest sha256:62b79484cca90003252cf9a092b839fcbe99fcb47835b035ed64ac7c693d578a · state attached · log index 3755035866 · transparency-log entry
    • kind provenance · digest sha256:ef1b064483decfc5c5323c3e5f2c850cd17b200b11951fe3e935b4c9d9c25215 · state attached · log index 3755037894 · transparency-log entry
    • kind sbom · digest sha256:ef1b064483decfc5c5323c3e5f2c850cd17b200b11951fe3e935b4c9d9c25215 · state attached · log index 3755039637 · transparency-log entry
    • kind vsa · digest sha256:ef1b064483decfc5c5323c3e5f2c850cd17b200b11951fe3e935b4c9d9c25215 · state attached · log index 3755041414 · transparency-log entry
    (at 2026-11-08T12:19:43Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/cloudflared/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-08T03:29:00Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:ef1b064483decfc5c5323c3e5f2c850cd17b200b11951fe3e935b4c9d9c25215 [clean-room rebuild ledger, runs[627]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-08T03:06:05Z [stage_runs, stage_runs chain 863 stage publish_image]
  • Archive manifests written2026-11-08T12:18:33Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 57 · probed 2026-11-08T03:02:33Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-08T12:20:50Z generated: by KitForge release/build_trail.py · generator commit 14ac19f4178268c2dbfa7e7cae4be76d466ea445
  • 2026-11-08T12:22:03Z publication: promoted at 2026-11-08T12:21:23Z · promoted digest sha256:62b79484cca90003252cf9a092b839fcbe99fcb47835b035ed64ac7c693d578a · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 370 · checklist status complete · checklist at 2026-11-08T12:22:03Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)539
chainssadb, ReadyStack's engine database (not published)863
defectssadb, ReadyStack's engine database (not published)cloudflared 2026.10.7-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 863
held_roundssadb, ReadyStack's engine database (not published)chain 863
lesson_recallssadb, ReadyStack's engine database (not published)chain 863
micro_step_runssadb, ReadyStack's engine database (not published)chain 863
release_imagessadb, ReadyStack's engine database (not published)cloudflared 2026.10.7-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 863
stage_runssadb, ReadyStack's engine database (not published)chain 863
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—