cloudflared 2026.10.7-CE-ubuntu24.04-r3 build trail

How ReadyStack built readystack/cloudflared:2026.10.7-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/cloudflared:2026.10.7-CE-ubuntu24.04-r3
  • Index digestsha256:2e2a69c0826c278c90ad06e8b686405f245875d401df2d5b53c87bd8a4d96bbe
  • linux/amd64 digestsha256:ea5e9fa2d880d337474b392588f259d49404f30b09869dfa977d08b36cfc8304
  • ArchiveReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.tar.gz
  • Archive SHA-256 now0672d820a884fbfc317a980c30ab30a7470ada38b277b7a028f4c2729373a8c9
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-12T11:09:36Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.trail.json
ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.trail.jsonReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.trail.json.sigstoreReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.trail.mdcloudflared product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • Productcloudflared (cloudflared) [MANIFEST.json]
  • Release tag2026.10.7-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Imagereadystack/cloudflared:2026.10.7-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Image index digestsha256:2e2a69c0826c278c90ad06e8b686405f245875d401df2d5b53c87bd8a4d96bbe [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:ea5e9fa2d880d337474b392588f259d49404f30b09869dfa977d08b36cfc8304 [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.tar.gz (bytes 459249001) [MANIFEST.json]
  • Archive sha256 at publish0672d820a884fbfc317a980c30ab30a7470ada38b277b7a028f4c2729373a8c9 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/cloudflare/cloudflared [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref2026.10.7 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit872b241f94871665c1c157adefcf90c11f0ead96 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashead232ece2af8a12a4909624ac0dae58773921a5bffd4614f61004e56a6c66e3 (files 487) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:c70aa023a0e6f0b931ec12ac06fc1918741b9d17d34f285b378c815774c21e25 [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794448148 (utc 2026-11-12T01:49:08Z) [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.4-bookworm@sha256:4fa7c968ba93f1635670522dbb01a2c78150443e1385746924566079f36570ea · platform digest sha256:fb7cceb528b47141eccd9b60bf3cbd27d5ef5f8cf5b7d338bec866da495b50dc
    • ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
    [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.rebuild.json, engine]
  • Engine commit(s)
    • commit d6acf665ef6d5a2226ab69008894a83a57e0fc08 · dirty yes · first drive 4335
    • commit 0d6cfe73bbf4df66989e87099ed978c9b446fd18 · dirty yes · first drive 4354
    • commit f797cdae453e92790f99eb2f40f256494c09f039 · dirty yes · first drive 4367
    • commit 90a06a5887bb1d16e24cf824619264064842b72d · dirty yes · first drive 4383
    • commit d4a7afb5b3612b0c920b8922d8aaa63e07e805eb · dirty yes · first drive 4405
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain993 (created 2026-11-12T01:54:01Z · trigger customer_request · upstream version 2026.10.7) [chains, chains #993]
  • Requestbuild request #686 (rebuild) (requested at 2026-11-12T01:49:10Z · requested by kitforge-agent · version 2026.10.7) [build_requests, build_requests #686]
  • Reasonrevision 2026.10.7-CE-ubuntu24.04-r3: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #686 request_reason]
  • Supersedesreadystack/cloudflared:2026.10.7-CE-ubuntu24.04-r2 (chain 863) [chains, chains #863]

The path through the harness

Fully recorded

1 chain · 5 drives · 18 stages · 3 rewinds

Chain 993 release · ready_to_ship

Created 2026-11-12T01:54:01Z, upstream 2026.10.7, build request 686 [chains, chains #993]

DriveStartedMinutesBuild hostHow it stopped
43352026-11-12T01:54:23Z31.6build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #4335]
43542026-11-12T06:00:28Z3.9build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4354]
43672026-11-12T07:20:01Z2.6build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4367]
43832026-11-12T09:04:32Z2.9build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4383]
44052026-11-12T11:05:40Z—build host 3 publish-held not recorded [drive_runs, drive_runs #4405]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-12T01:54:33Z2026-11-12T01:54:34Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json e75461a76490…
acquire 2026-11-12T01:54:38Z2026-11-12T01:54:39Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 6fb32f90eb40…
license_file 58d1e17ffe51…
custody_inputs 6ad976ab0a20…
source_tree_hash ac50f8ad4e88…
source_file_manifest 7968487fb727…
plan 2026-11-12T01:55:12Z2026-11-12T01:55:13Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 681438bf8c8f…
input_pin_plan 2a334f8bf79e…
toolchain_lock 2546fd8cd8e1…
assemble_kit 2026-11-12T01:57:14Z2026-11-12T01:57:15Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 0916b316268b…
build_recipe e91ae8ac3756…
system_pinning aa8db05a9a8a…
build_offline_sh 6ab4f08a6ec7…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 099794563516…
verify_offline_sh 3e8184ea230c…
base_image_digests ad5da484a3ab…
dockerfile_offline 0916b316268b…
first_build_digest 623d9dc0a8dd…
remediate 2026-11-12T01:57:56Z2026-11-12T01:57:57Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 90e728ebb4fd…
security_report 8f6aaf1fb10a…
build_kit 2026-11-12T02:00:51Z2026-11-12T02:00:51Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp b1a74e84fd7a…
locked_digest b370662ebdb3…
freeze_manifest 5f72ffc771e2…
offline_rebuild_transcript 0116bdf17f83…
verdict 2026-11-12T02:01:22Z2026-11-12T02:01:23Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 695f48fdcd0d…
publish_image 2026-11-12T02:01:56Z2026-11-12T02:01:57Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme bfa0920f1060…
promotion_record 753efa9bbc1e…
boot_instance 2026-11-12T02:02:08Z2026-11-12T02:02:14Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 8ef7f6ea00ae…
sbom 2026-11-12T02:02:22Z2026-11-12T02:02:23Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 6804a41235d0…
sbom_json f66a46c0da69…
schema_discovery 2026-11-12T02:02:25Z2026-11-12T02:02:26Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 3e14821deba7…
dependency_tree 519ec69aae9f…
table_classification 52a8b59c22a1…
admin_handbook 2026-11-12T02:09:15Z2026-11-12T02:09:16Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 78587680e440…
admin_handbook f4868665384f…
db_handbook 2026-11-12T02:15:31Z2026-11-12T02:15:32Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook ce095f7022fa…
seed_isolation 9d9634c8d2ba…
seed_data 2026-11-12T02:15:43Z2026-11-12T02:15:44Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 81b58bb65ad3…
seed_cases_json 33d646c3618b…
seed_validate 2026-11-12T02:15:46Z2026-11-12T02:15:47Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract c35b4453e4eb…
usecase_validate 2026-11-12T02:16:06Z2026-11-12T02:16:07Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests bba69b3dda7b…
test_results 486d451082f8…
usecase_contract f510d004db31…
finalize_docs 2026-11-12T02:22:52Z2026-11-12T02:22:53Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json e2dd0b99b272…
release_notes 2e4c3a126195…
api_integration_guide b4b81fa91884…
package_archive invalidated 2026-11-12T11:05:09Z 2026-11-12T02:25:58Z2026-11-12T09:07:27Z4
36 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 unpack_files
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 039151de7f5c…
checksums 64c6afac040b…
verify_md c88b33fe1121…
rebuild_md 6a34202f43e4…
manifest_txt 532b0394a399…
actions_jsonl 599e2a045635…
provenance_md b1a8b2aa6256…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 2e4d67cbb647…

[stage_runs]

Rewinds

  • 2026-11-12T06:26:40Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33115]
  • 2026-11-12T07:47:37Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33237]
  • 2026-11-12T11:05:09Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33506]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-12T09:07:27Z.

117 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 07538 —
remediate2001 011277 L-A08, L-038, L-036, L-034, L-032
admin_handbook442003 7231329 —
db_handbook32903 2152778 —
usecase_validate1001 01719 —
finalize_docs361303 2167858 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $4.14 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-12T06:04:57Z 0317 findings to repackage [held_rounds, held_rounds #1781] $1.38 3 rounds, $40.00 5e4be2318260…
22026-11-12T07:23:07Z 0315 findings to repackage [held_rounds, held_rounds #1788] $1.54 3 rounds, $40.00 5fafaee0a99e…
32026-11-12T09:07:42Z 008 clean to publish [held_rounds, held_rounds #1798] $1.23 3 rounds, $40.00 039151de7f5c…

Defects

Fully recorded
  • Ledger entries47 [defects, defects where product_slug=cloudflared and this tag or chain]
  • Disclosed in the archive47 [docs/defects/defects.json, entries]

47 ledger entries: by severity medium 1, high 6, low 40; by status open 1, fixed-before-release 46.

DefectSeverityStatusFound byFixed in
RSD-cloudflared-be817ca7a1
Unauthenticated metrics port 20241 by default [defects, defects #256533]		mediumopenbuild strategy record—
RSD-cloudflared-c06c0b8a90
Database handbook: The documented docker exec example uses a path that does not exist in the image and fails. [defects, defects #258680]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-438c925111
API guide: The documented fix for a permission error (chmod 640) does not make a host-owned file readable by uid 65532 and contradicts the Admin Handbook. [defects, defects #258681]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-3af1e282a0
API guide: The command order given is rejected by cloudflared; --config belongs to `tunnel`, not `run`. [defects, defects #258682]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-287751fc21
Admin handbook: 'only' omits /var/tmp and /dev/shm, which are writable (previous-round finding, not corrected). [defects, defects #258683]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-66203f7b4a
Database handbook: Same uncorrected round-4 finding. [defects, defects #258684]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-d169eca973
Admin handbook: A customer running `docker exec <c> id` gets an error; the quoted output was not produced by this image. [defects, defects #258685]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-adeffc008c
Database handbook: Quotes output of a program the image does not contain. [defects, defects #258686]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-dad0345dea
Database handbook: Contradicts the image contents and the same handbook's /bin/sh example. [defects, defects #258687]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-2b561fa0f0
API guide: The user has a login shell entry; no record says otherwise. [defects, defects #258688]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-fad6a67215
Database handbook: Nothing is written to stdout; all log lines are on stderr. [defects, defects #258689]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-1336dbfac1
API guide: Contradicts the measured response and the guide's own later line. [defects, defects #258690]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-ae4bafa719
API guide: The shown JSON is not valid JSON and is not what the endpoint returns. [defects, defects #258691]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-5da2e58214
API guide: 'create or restart' contradicts the next sentence and every other statement about restart. [defects, defects #258692]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-68ccd3a82a
Admin handbook: 'restart your container with the new token' can be read as docker restart, which does not apply the new token. [defects, defects #258693]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-d85e99c75a
Database handbook: 'restart' contradicts the same handbook's statement that docker restart keeps the old token. [defects, defects #258694]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-f852ed3f74
API guide: The sentence promises a response from a command that prints nothing. [defects, defects #258695]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-df7ed336a2
API guide: The example does not show metrics. [defects, defects #258696]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-e8781e3d22
API guide: Self-contradictory: loopback vs 0.0.0.0. [defects, defects #258697]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-ef88464180
Admin handbook: Contradicts the API guide: cert.pem is not part of the credentials file. [defects, defects #258698]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-6d26ff167b
Admin handbook: Minimum Docker/kernel versions are not supported by any record. [defects, defects #258699]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-b6636ca35d
Admin handbook: The documented `curl http://127.0.0.1:20241/quicktunnel` (line 421) runs on the host, but the Quick Tunnel `docker run --rm ... [defects, defects #260039]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-450d195851
Database handbook: The Quick Tunnel `docker run --rm` at line 721/729 gives the container no name, so the following `docker exec cloudflared ...` (line 743) fails. [defects, defects #260040]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-0974e693ff
API guide: The Quick Tunnel commands in the same guide (lines 518-530) are unnamed `docker run --rm` runs; `docker exec cloudflared ...` at line 540 fails with No such container. [defects, defects #260041]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-83540f26bd
API guide: Says the credentials file contains the certificate; the same guide (line 833) and the Admin Handbook (line 676) say the credentials file holds AccountTag/TunnelSecret/TunnelID and cert.pem is… [defects, defects #260042]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-102643e7df
API guide: Lists cert.pem as something you need and mounts/chowns it (lines 845, 860), while the Admin Handbook (line 676) says it is not needed to run with a credentials file. [defects, defects #260043]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-75281cce0a
API guide: Calls the certificate part of the locally-managed credentials; the container runs without cert.pem (Admin Handbook line 676). [defects, defects #260044]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-d1456e2b52
API guide: Contradicts the guide's own line 449 ('responds to any HTTP method') and the measured behaviour. [defects, defects #260045]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-ca72189f92
API guide: Offers `-e 'TUNNEL_TOKEN=<value>'` and in the next sentence forbids typing the token in a docker run command; also differs from the release notes' `-e TUNNEL_TOKEN`. [defects, defects #260046]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-395b85f754
API guide: No record supports /ready answering until the grace period expires; an idle, connected connector exits at once. [defects, defects #260047]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-9d65cd478c
API guide: 'restarting the container' can be read as `docker restart`, which keeps the old image; the guide's own line 765-771 re-creates it. [defects, defects #260048]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-c4507e889a
Admin handbook: 'restart the container' can be read as `docker restart`, which keeps the old image; the steps below re-create it. [defects, defects #260049]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-ba6279241d
Database handbook: The text introduces this as inspecting the running image tag and says it shows 'the image ID or name'; `{{.Image}}` prints only the image ID, never the tag. [defects, defects #260050]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-207eba1df4
Database handbook: Contradicts the Admin Handbook (line 720: a restart interrupts all tunnel connections for a few seconds); with one connector, stopping it closes the only connection. [defects, defects #260051]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-1fad6a8dee
Database handbook: 'restart' can be read as `docker restart`, which keeps the old token (same handbook, lines 424 and 482). [defects, defects #260052]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-a81576b061
Database handbook: The block is tagged json but `N` is not valid JSON and the shape is not a real response. [defects, defects #260053]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-645baf7a1c
Admin handbook: cloudflared also initiates DNS lookups, a reachability check to api.cloudflare.com:443, and the connections to your local services. [defects, defects #260054]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-425e09a402
Admin handbook: `cloudflared tunnel create` writes the host path into config.yml; the container cannot find that file and the connector does not start. [defects, defects #260055]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-ad511ea84d
Admin handbook: The command that follows passes `--env-file ./cloudflared.env` (the file that holds TUNNEL_TOKEN) in a procedure that is described as 'instead of a token'; the other locally-managed commands (lines… [defects, defects #260056]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-166483bcfa
Admin handbook: Round-2 finding not fixed: the procedure is introduced as 'instead of a token' but still passes --env-file ./cloudflared.env (the file that holds TUNNEL_TOKEN); the other locally-managed commands… [defects, defects #263553]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-9fca604478
Admin handbook: The handbook never says config.yml must name the tunnel; without a `tunnel:` key (or a name/ID argument) the connector does not start. [defects, defects #263554]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-2358613125
API guide: Round-2 finding (host path written by `tunnel create` makes the connector not start) is fixed in the Admin Handbook (line 676) but this guide still never says the path must be the in-container one. [defects, defects #263555]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-276c4af778
Admin handbook: The command pulls the same fixed r3 tag, which the Docker Hub README says never moves; the sentence presents it as pulling a newer/latest image. [defects, defects #263556]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-95a99c34f7
Database handbook: Heading says no downtime, but its own text says that while the old connector is stopped and the new one not yet registered Cloudflare cannot reach the services, and the Admin Handbook (line 720)… [defects, defects #263557]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-95806c63a2
Database handbook: 'restart' can be read as `docker restart`, which keeps the original arguments; the steps below stop, remove and re-run. [defects, defects #263558]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-18a7f0c08a
Database handbook: The container runs only cloudflared (PID 1, no other process), so there is no service 'inside the container' for localhost:port; a customer entering localhost:port for a host service gets a… [defects, defects #263559]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-b86c173256
API guide: Contradicts the same guide's locally-managed section (lines 825-870) where config.yml and a credentials file are required. [defects, defects #263560]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:ea5e9fa2d880d337474b392588f259d49404f30b09869dfa977d08b36cfc8304 · published digest sha256:ea5e9fa2d880d337474b392588f259d49404f30b09869dfa977d08b36cfc8304 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 81) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T11:06:01Z · failing Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T11:05:50Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3830936511 · transparency-log entry · integrated 2026-11-12T11:08:18Z) [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:2e2a69c0826c278c90ad06e8b686405f245875d401df2d5b53c87bd8a4d96bbe · state attached · log index 3830939927 · transparency-log entry
    • kind sbom · digest sha256:2e2a69c0826c278c90ad06e8b686405f245875d401df2d5b53c87bd8a4d96bbe · state attached · log index 3830941983 · transparency-log entry
    • kind vsa · digest sha256:2e2a69c0826c278c90ad06e8b686405f245875d401df2d5b53c87bd8a4d96bbe · state attached · log index 3830944187 · transparency-log entry
    • kind provenance · digest sha256:ea5e9fa2d880d337474b392588f259d49404f30b09869dfa977d08b36cfc8304 · state attached · log index 3830946453 · transparency-log entry
    • kind sbom · digest sha256:ea5e9fa2d880d337474b392588f259d49404f30b09869dfa977d08b36cfc8304 · state attached · log index 3830948660 · transparency-log entry
    • kind vsa · digest sha256:ea5e9fa2d880d337474b392588f259d49404f30b09869dfa977d08b36cfc8304 · state attached · log index 3830951232 · transparency-log entry
    (at 2026-11-12T11:08:21Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/cloudflared/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-12T06:05:01Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:ea5e9fa2d880d337474b392588f259d49404f30b09869dfa977d08b36cfc8304 [clean-room rebuild ledger, runs[775]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-12T02:01:57Z [stage_runs, stage_runs chain 993 stage publish_image]
  • Archive manifests written2026-11-12T11:07:12Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 57 · probed 2026-11-12T01:59:14Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-12T11:09:36Z generated: by KitForge release/build_trail.py · generator commit d4a7afb5b3612b0c920b8922d8aaa63e07e805eb
  • 2026-11-12T11:10:52Z publication: promoted at 2026-11-12T11:10:11Z · promoted digest sha256:2e2a69c0826c278c90ad06e8b686405f245875d401df2d5b53c87bd8a4d96bbe · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 499 · checklist status complete · checklist at 2026-11-12T11:10:52Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r3/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.rebuild.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r3.rebuild.json.sigstorebeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r3/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r3/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)686
chainssadb, ReadyStack's engine database (not published)993
defectssadb, ReadyStack's engine database (not published)cloudflared 2026.10.7-CE-ubuntu24.04-r3
drive_runssadb, ReadyStack's engine database (not published)chain 993
held_roundssadb, ReadyStack's engine database (not published)chain 993
lesson_recallssadb, ReadyStack's engine database (not published)chain 993
micro_step_runssadb, ReadyStack's engine database (not published)chain 993
release_imagessadb, ReadyStack's engine database (not published)cloudflared 2026.10.7-CE-ubuntu24.04-r3
stage_eventssadb, ReadyStack's engine database (not published)chain 993
stage_runssadb, ReadyStack's engine database (not published)chain 993
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—