cloudflared 2026.10.7-CE-ubuntu24.04-r4 build trail

How ReadyStack built readystack/cloudflared:2026.10.7-CE-ubuntu24.04-r4 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/cloudflared:2026.10.7-CE-ubuntu24.04-r4
  • Index digestsha256:2bfd7648ae7d573f2c3a9ebfc794412cc3c5886a486446956908da403791edc7
  • linux/amd64 digestsha256:ea00920772ef7cea54a3293a6186009559733f641fc6da7ede0650c02166bac1
  • ArchiveReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.tar.gz
  • Archive SHA-256 nowf8c1aae7031078e20dd4705598b8f9479d5dc866eaad13a938af93cdea6e2b68
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-13T15:33:42Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.trail.json.sigstore ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.trail.json
ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.trail.jsonReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.trail.json.sigstoreReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.trail.mdcloudflared product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • Productcloudflared (cloudflared) [MANIFEST.json]
  • Release tag2026.10.7-CE-ubuntu24.04-r4 [MANIFEST.json]
  • Imagereadystack/cloudflared:2026.10.7-CE-ubuntu24.04-r4 [MANIFEST.json]
  • Image index digestsha256:2bfd7648ae7d573f2c3a9ebfc794412cc3c5886a486446956908da403791edc7 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:ea00920772ef7cea54a3293a6186009559733f641fc6da7ede0650c02166bac1 [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.tar.gz (bytes 459244994) [MANIFEST.json]
  • Archive sha256 at publishf8c1aae7031078e20dd4705598b8f9479d5dc866eaad13a938af93cdea6e2b68 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/cloudflare/cloudflared [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref2026.10.7 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit872b241f94871665c1c157adefcf90c11f0ead96 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashead232ece2af8a12a4909624ac0dae58773921a5bffd4614f61004e56a6c66e3 (files 487) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:9ab04ac65bcc07ae641f3829ebadd39ea2c6d414c67598b536d99a93d495b320 [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794569028 (utc 2026-11-13T11:23:48Z) [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.4-bookworm@sha256:4fa7c968ba93f1635670522dbb01a2c78150443e1385746924566079f36570ea · platform digest sha256:fb7cceb528b47141eccd9b60bf3cbd27d5ef5f8cf5b7d338bec866da495b50dc
    • ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
    [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.rebuild.json, engine]
  • Engine commit(s)
    • commit 1762e17ee8e9761d80444e254bf92fa18d39ea4a · dirty yes · first drive 4578
    • commit 41dea51ac8be37b9ab8104396308a3a5eeee925f · dirty yes · first drive 4594
    • commit f264c5a93fc5fe548e62fe3bfbeb279b813432b8 · dirty yes · first drive 4609
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain1079 (created 2026-11-13T13:18:40Z · trigger customer_request · upstream version 2026.10.7) [chains, chains #1079]
  • Requestbuild request #756 (rebuild) (requested at 2026-11-13T11:23:50Z · requested by kitforge-agent · version 2026.10.7) [build_requests, build_requests #756]
  • Reasonrerelease agenda REVISION -> 2026.10.7-CE-ubuntu24.04-r4 (decay loop, IMP-08) [build_requests, build_requests #756 request_reason]
  • Supersedesreadystack/cloudflared:2026.10.7-CE-ubuntu24.04-r3 (chain 993) [chains, chains #993]

The path through the harness

Fully recorded

1 chain · 3 drives · 18 stages · 2 rewinds

Chain 1079 release · ready_to_ship

Created 2026-11-13T13:18:40Z, upstream 2026.10.7, build request 756 [chains, chains #1079]

DriveStartedMinutesBuild hostHow it stopped
45782026-11-13T13:19:00Z31.8build host 1 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4578]
45942026-11-13T14:26:24Z2.9build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4594]
46092026-11-13T15:29:37Z—build host 1 publish-held not recorded [drive_runs, drive_runs #4609]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-13T13:19:10Z2026-11-13T13:19:11Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 6409188acd96…
acquire 2026-11-13T13:19:15Z2026-11-13T13:19:16Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 6fb32f90eb40…
license_file 58d1e17ffe51…
custody_inputs 6ad976ab0a20…
source_tree_hash ac50f8ad4e88…
source_file_manifest 7968487fb727…
plan 2026-11-13T13:19:47Z2026-11-13T13:19:48Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report b0f634130238…
input_pin_plan 7f8b565f1430…
toolchain_lock fc0b8c3dfe65…
assemble_kit 2026-11-13T13:22:01Z2026-11-13T13:22:01Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile b69b66074115…
build_recipe 8284ce6cd973…
system_pinning aa8db05a9a8a…
build_offline_sh 6ab4f08a6ec7…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 22087d216370…
verify_offline_sh 3e8184ea230c…
base_image_digests ad5da484a3ab…
dockerfile_offline b69b66074115…
first_build_digest 7eed45d4fa54…
remediate 2026-11-13T13:22:42Z2026-11-13T13:22:43Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 5393085315dd…
security_report 31f775efbe37…
build_kit 2026-11-13T13:25:54Z2026-11-13T13:25:55Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 10cb8e7d7fe8…
locked_digest b391c0e2c139…
freeze_manifest bb8ea7a66774…
offline_rebuild_transcript 42eff4239050…
verdict 2026-11-13T13:26:22Z2026-11-13T13:26:23Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 201cf1228135…
publish_image 2026-11-13T13:26:57Z2026-11-13T13:26:58Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 883d2d30c477…
promotion_record 7c6eed37ad15…
boot_instance 2026-11-13T13:27:09Z2026-11-13T13:27:14Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle d3339bae4425…
sbom 2026-11-13T13:27:22Z2026-11-13T13:27:23Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 2d6c51272dc9…
sbom_json 255d8c963a73…
schema_discovery 2026-11-13T13:27:26Z2026-11-13T13:27:26Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 3e14821deba7…
dependency_tree 519ec69aae9f…
table_classification 52a8b59c22a1…
admin_handbook 2026-11-13T13:33:26Z2026-11-13T13:33:27Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 78587680e440…
admin_handbook 9565b3f3596b…
db_handbook 2026-11-13T13:37:47Z2026-11-13T13:37:48Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 2aefaaeb3260…
seed_isolation 9d9634c8d2ba…
seed_data 2026-11-13T13:37:59Z2026-11-13T13:38:00Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 81b58bb65ad3…
seed_cases_json 11c037d9fb78…
seed_validate 2026-11-13T13:38:02Z2026-11-13T13:38:03Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract f5cb319e01b8…
usecase_validate 2026-11-13T13:38:22Z2026-11-13T13:38:23Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests ad65b2d063d5…
test_results b6822c3808b3…
usecase_contract 190318ed9c06…
finalize_docs 2026-11-13T13:45:41Z2026-11-13T13:45:43Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 5514c578bc8d…
release_notes c1edd347aba0…
api_integration_guide 1eadf6303a5f…
package_archive invalidated 2026-11-13T15:28:58Z 2026-11-13T13:50:42Z2026-11-13T14:29:14Z2
37 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 unpack_files
  • G8 scout_grade_a
  • G8 script_copies
  • G8 upgrade_check
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 45608b73c92e…
checksums 449a050dff05…
verify_md 988d3620a6bf…
rebuild_md 426ae11a6b9b…
manifest_txt a3ab79481e0d…
actions_jsonl fa5aec50935f…
provenance_md e9b91a920eb4…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 82c352b356cd…

[stage_runs]

Rewinds

  • 2026-11-13T14:16:02Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36225]
  • 2026-11-13T15:28:58Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36501]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-13T14:29:14Z.

95 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 07664 —
remediate2001 011432 L-A08, L-038, L-036, L-034, L-032
admin_handbook311103 2155302 —
db_handbook23503 1111047 —
usecase_validate1001 01721 —
finalize_docs361203 3178230 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $2.76 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-13T13:51:40Z 0320 findings to repackage [held_rounds, held_rounds #1882] $1.46 3 rounds, $40.00 5457987d85bb…
22026-11-13T14:29:41Z 0013 clean to publish [held_rounds, held_rounds #1888] $1.30 3 rounds, $40.00 45608b73c92e…

Defects

Fully recorded
  • Ledger entries37 [defects, defects where product_slug=cloudflared and this tag or chain]
  • Disclosed in the archive37 [docs/defects/defects.json, entries]

37 ledger entries: by severity medium 1, high 3, low 33; by status open 1, fixed-before-release 36.

DefectSeverityStatusFound byFixed in
RSD-cloudflared-8178cc0c84
Unauthenticated metrics port 20241 by default [defects, defects #282075]		mediumopenbuild strategy record—
RSD-cloudflared-d2b9745fbd
Admin handbook: IMAGE_CONFIG.json Env TUNNEL_METRICS=0.0.0.0:20241; live container log 'Starting metrics server on [::]:20241/metrics'; the handbook's own Operating facts (line 106) say 0.0.0.0. [defects, defects #282574]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-a5f5503f4a
Admin handbook: IMAGE_CONFIG.json Env TUNNEL_METRICS=0.0.0.0:20241; live container log 'Starting metrics server on [::]:20241/metrics'; the handbook's own Operating facts (line 106) say 0.0.0.0; contradicts lines… [defects, defects #282575]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-5b04093d49
Database handbook: IMAGE_CONFIG.json Env TUNNEL_METRICS=0.0.0.0:20241; live container log 'Starting metrics server on [::]:20241/metrics'; the handbook's own Operating facts (line 106) say 0.0.0.0 [defects, defects #282576]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-ed86d777fd
Database handbook: IMAGE_CONFIG.json Env TUNNEL_METRICS=0.0.0.0:20241; live container log 'Starting metrics server on [::]:20241/metrics'; the handbook's own Operating facts (line 106) say 0.0.0.0 [defects, defects #282577]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-4d3eb56bab
Database handbook: Credential-change procedure: the same handbook says at line 168 that restart/start preserve the original environment, so `docker restart` (the reading of 'Restart the container') leaves the old… [defects, defects #282578]		highfixed-before-releaseheld review (review model)—
RSD-cloudflared-43cade4442
Database handbook: IMAGE_CONFIG.json Healthcheck Test: CMD-SHELL /usr/local/bin/rs-probe http://127.0.0.1:20241/ready || exit 1; contradicts DB lines 134 and 275. [defects, defects #282579]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-80bf8226b2
Database handbook: Admin Handbook line 714 says the credentials file is 'not a certificate'; ran a container with only credentials.json + config.yml mounted at /etc/cloudflared and `tunnel --config… [defects, defects #282580]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-25fa406677
Database handbook: Contradicts DB lines 96, 553 and 735, which do document the mode; the Admin Handbook (lines 702-746) and API guide (lines 938-1014) hold the full procedure. [defects, defects #282581]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-445d9ea672
Database handbook: Ran `: > $d/x` as the image user: /home/cloudflared, /tmp, /var/tmp, /dev/shm writable; /etc, /run, /usr, / not. [defects, defects #282582]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-c8bc4557ff
Admin handbook: Same measurement as for DB line 713; contradicts Admin Handbook lines 440-446. [defects, defects #282583]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-cdbb8fb805
Admin handbook: Round-3 finding class 'same fixed tag presented as pulling a newer image': Docker Hub README line 56 and Admin Handbook lines 290 and 816 say release tags never move; this step pulls the same r4 tag. [defects, defects #282584]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-fa8efc9507
Database handbook: Same finding class: the block pulls readystack/cloudflared:2026.10.7-CE-ubuntu24.04-r4 again; DB line 114 says release tags never move. [defects, defects #282585]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-39e3fd5bc8
Database handbook: Round-3 finding 'restart can be read as docker restart': the block below is a `docker run` with --name cloudflared, which fails with 'name already in use' unless the old container is removed (Admin… [defects, defects #282586]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-ebb47d806f
API guide: Same finding class: 'restart the container with a new log level' is the docker restart the sentence then forbids. [defects, defects #282587]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-cebc523d01
API guide: Ran `docker run -e TUNNEL_TOKEN=<well-formed token for a nonexistent tunnel>` (default command): 'Register tunnel error ... [defects, defects #282588]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-db1b105bac
API guide: Compose's `restart:` policy reacts to the process exiting, not to the health status; the compose file on line 1117 only redefines the healthcheck. [defects, defects #282589]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-50c6f08220
API guide: IMAGE_BINARIES.txt lists sh; `docker run --rm --entrypoint /bin/sh <image> -c 'echo hello'` printed hello (and the same guide uses /bin/sh on lines 770 and 1156); `id`, `ls`, `touch`, `mount`,… [defects, defects #282590]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-4a20a5cdfb
API guide: Contradicts API line 173 ('when the container is created, not at each start') and the restart-keeps-old-value statement later in the same paragraph. [defects, defects #282591]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-1cd74bb52a
Admin handbook: Round-3 finding 'localhost:port': cloudflared is PID 1 and the only process (Admin lines 116-118), so 127.0.0.1:8080 is the container itself and the origin connection fails; the docs audit also… [defects, defects #282592]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-81c464bf72
Admin handbook: Admin line 538 and DB lines 449-455 say the entrypoint can be replaced with `docker run --entrypoint`, which drops the flag. [defects, defects #282593]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-b785807737
Database handbook: DB lines 449-455 say `--entrypoint` replaces the entrypoint 'including the --no-autoupdate flag'. [defects, defects #282594]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-57a0328485
Database handbook: Ran rs-probe without -body: prints nothing and exits 0 (DB lines 289 and 657 say so); `docker exec` runs on the Docker host, not 'from another host'. [defects, defects #282595]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-1c4fcf9a4b
Database handbook: Ran `docker run <image> tunnel token mytunnel`: 'Cannot determine default origin certificate path ... [defects, defects #282596]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-ac3bb41d90
Admin handbook: Ran `docker run -e TUNNEL_TOKEN=garbage <image>`: 'Provided Tunnel token is not valid.', exit 255. [defects, defects #284422]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-6b190eefe0
API guide: Same measurement as admin line 509 (garbage token: exit 255; well-formed token for a nonexistent tunnel: 503 on /ready, exit 1 after ~70 s). [defects, defects #284423]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-0710a54050
Admin handbook: Step 2 of the same list pulls `<newer-tag>`, step 3 starts the r4 tag, which step 2 says 'never moves, so pulling it again brings nothing new': following the steps recreates the old release. [defects, defects #284424]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-e042a57b18
Database handbook: Ran rs-probe -body http://127.0.0.1:20241/config in a running container: {"version":-1,"config":{"ingress":[{"hostname":"example.com",..."service":"http://host.docker.internal:8080"...}]}}. [defects, defects #284425]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-fadfbf2ecb
Admin handbook: API guide line 1083 says Docker does not restart an unhealthy container and Compose does not either; a restart policy reacts only to the container's process exiting. [defects, defects #284426]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-e153689e05
Database handbook: Same as admin line 505; contradicts API guide line 1083 and line 417. [defects, defects #284427]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-57e8305d19
Admin handbook: `/metrics` is Prometheus text (admin line 525 table, DB line 319); the line says every endpoint's body prints 'as JSON'. [defects, defects #284428]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-1e175e1dd0
Database handbook: Line 579 says --network=none 'prevents base images from being resolved from any registry'; line 600 of the same handbook (and admin line 846) says --network=none only isolates RUN steps and a plain… [defects, defects #284429]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-bc0b12cad9
Admin handbook: The config.yml example (line 726) routes to http://host.docker.internal:8080 and the run block (737-743) has no --add-host. [defects, defects #284430]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-63e0f3e868
API guide: Admin line 906 says cloudflared 'makes HTTPS connections to api.cloudflare.com:443 during startup'; this line says no other outbound ports are required. [defects, defects #284431]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-8b5e56e8ab
Database handbook: Line 248 lists 'the metrics port 20241' as a credential; the same handbook (lines 84, 88, 252) says that port has no authentication and the token is the only credential (line 620). [defects, defects #284432]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-0caa8986cb
API guide: Ran `docker run --rm --entrypoint /usr/local/bin/rs-probe <image> http://127.0.0.1:20241/ready`: 'dial tcp 127.0.0.1:20241: connect: connection refused', exit 1; the new container runs only… [defects, defects #284433]		lowfixed-before-releaseheld review (review model)—
RSD-cloudflared-1f5058b6c1
API guide: IMAGE_BINARIES.txt lists arch base32 base64 basename cat cloudflared cut dash date env head ... [defects, defects #284434]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:ea00920772ef7cea54a3293a6186009559733f641fc6da7ede0650c02166bac1 · published digest sha256:ea00920772ef7cea54a3293a6186009559733f641fc6da7ede0650c02166bac1 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 88) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T15:29:57Z · failing Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T15:29:47Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3856952552 · transparency-log entry · integrated 2026-11-13T15:32:04Z) [ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:2bfd7648ae7d573f2c3a9ebfc794412cc3c5886a486446956908da403791edc7 · state attached · log index 3856955576 · transparency-log entry
    • kind sbom · digest sha256:2bfd7648ae7d573f2c3a9ebfc794412cc3c5886a486446956908da403791edc7 · state attached · log index 3856957963 · transparency-log entry
    • kind vsa · digest sha256:2bfd7648ae7d573f2c3a9ebfc794412cc3c5886a486446956908da403791edc7 · state attached · log index 3856961189 · transparency-log entry
    • kind provenance · digest sha256:ea00920772ef7cea54a3293a6186009559733f641fc6da7ede0650c02166bac1 · state attached · log index 3856964079 · transparency-log entry
    • kind sbom · digest sha256:ea00920772ef7cea54a3293a6186009559733f641fc6da7ede0650c02166bac1 · state attached · log index 3856966323 · transparency-log entry
    • kind vsa · digest sha256:ea00920772ef7cea54a3293a6186009559733f641fc6da7ede0650c02166bac1 · state attached · log index 3856969355 · transparency-log entry
    (at 2026-11-13T15:32:05Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/cloudflared/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-13T13:51:45Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:ea00920772ef7cea54a3293a6186009559733f641fc6da7ede0650c02166bac1 [clean-room rebuild ledger, runs[837]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-13T13:26:58Z [stage_runs, stage_runs chain 1079 stage publish_image]
  • Archive manifests written2026-11-13T15:31:00Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 57 · probed 2026-11-13T13:24:10Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-13T15:33:42Z generated: by KitForge release/build_trail.py · generator commit d4e6e682ea5cca0602a262047fa770f1c72bf093
  • 2026-11-13T15:35:08Z publication: promoted at 2026-11-13T15:34:27Z · promoted digest sha256:2bfd7648ae7d573f2c3a9ebfc794412cc3c5886a486446956908da403791edc7 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 552 · checklist status complete · checklist at 2026-11-13T15:35:08Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r4/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r4/), as staged for publishing—
ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.rebuild.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r4/), as staged for publishing—
ReadyStack-cloudflared-2026.10.7-CE-ubuntu24.04-r4.rebuild.json.sigstorebeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r4/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/cloudflared/2026.10.7-CE-ubuntu24.04-r4/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)756
chainssadb, ReadyStack's engine database (not published)1079
defectssadb, ReadyStack's engine database (not published)cloudflared 2026.10.7-CE-ubuntu24.04-r4
drive_runssadb, ReadyStack's engine database (not published)chain 1079
held_roundssadb, ReadyStack's engine database (not published)chain 1079
lesson_recallssadb, ReadyStack's engine database (not published)chain 1079
micro_step_runssadb, ReadyStack's engine database (not published)chain 1079
release_imagessadb, ReadyStack's engine database (not published)cloudflared 2026.10.7-CE-ubuntu24.04-r4
stage_eventssadb, ReadyStack's engine database (not published)chain 1079
stage_runssadb, ReadyStack's engine database (not published)chain 1079
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—