Consul v1.16.4-CE-ubuntu24.04-r5 build trail

How ReadyStack built readystack/consul:v1.16.4-CE-ubuntu24.04-r5 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/consul:v1.16.4-CE-ubuntu24.04-r5
  • Index digestsha256:02b29d477722cf4010a9a68a151fefaf321b3d6c239e839f8a87778a9086224f
  • linux/amd64 digestsha256:86c509354da0cb8e5f2741148f06ee8c1a0d18589f0618cdc6f66f80d75614a6
  • ArchiveReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.tar.gz
  • Archive SHA-256 nowfe6995e92f637f566353ab2d6ccb6142e9d2038565d6819eec53cf3550661d61
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-03T07:53:34Z by KitForge release/build_trail.py
  • Sections9 sections, 7 fully recorded; 2 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.trail.json.sigstore ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.trail.json
ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.trail.jsonReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.trail.json.sigstoreReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.trail.mdConsul product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductConsul (consul) [MANIFEST.json]
  • Release tagv1.16.4-CE-ubuntu24.04-r5 [MANIFEST.json]
  • Imagereadystack/consul:v1.16.4-CE-ubuntu24.04-r5 [MANIFEST.json]
  • Image index digestsha256:02b29d477722cf4010a9a68a151fefaf321b3d6c239e839f8a87778a9086224f [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:86c509354da0cb8e5f2741148f06ee8c1a0d18589f0618cdc6f66f80d75614a6 [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.tar.gz (bytes 528033942) [MANIFEST.json]
  • Archive sha256 at publishfe6995e92f637f566353ab2d6ccb6142e9d2038565d6819eec53cf3550661d61 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/hashicorp/consul [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv1.16.4 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit2b5841d3f6243fc9b24a5f223daeef69761e0317 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashfed15f67fb0cd2b93301c46ea33c61b4dbab2c7c070eff1fab00b3b4f1f79ec3 (files 10293) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:0e102a3a38b12b1dc7c5e42237c68647c0d56610e4fb327260be63a0f86681e0 [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1702410563 (utc 2023-12-12T19:49:23Z) [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.rebuild.json, engine]
  • Engine commit(s)
    • commit d7ccff446f52731f23cbe85c44adc1730f1c2bef · dirty yes · first drive 3478
    • commit 7e931023ea568f96558f936f9283526980787f41 · dirty yes · first drive 3482
    • commit 5de40211f9b72119301c6110575a6473bf3988f0 · dirty yes · first drive 3484
    • commit ff3112bd2cb03ee39fd394ed644a9522854803de · dirty yes · first drive 3485
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain735 (created 2026-10-27T23:32:52Z · trigger customer_request · upstream version 1.16.4) [chains, chains #735]
  • Requestbuild request #419 (rebuild) (requested at 2026-10-27T20:09:16Z · requested by kitforge-agent · version 1.16.4) [build_requests, build_requests #419]
  • Reasonrevision v1.16.4-CE-ubuntu24.04-r5: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #419 request_reason]
  • Supersedesreadystack/consul:v1.16.4-CE-ubuntu24.04-r4 (chain 651) [chains, chains #651]

The path through the harness

Fully recorded

1 chain · 6 drives · 18 stages · 6 rewinds

Chain 735 release · ready_to_ship

Created 2026-10-27T23:32:52Z, upstream 1.16.4, build request 419 [chains, chains #735]

DriveStartedMinutesBuild hostHow it stopped
9872026-10-27T23:33:19Z45build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #987] rebuilt from a build line's log
9902026-10-28T01:39:22Z0.9build host 5 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #990] rebuilt from a build line's log
34782026-11-03T05:42:24Z28build host 5 withhold-publish ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #3478]
34822026-11-03T06:38:40Z3.5build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3482]
34842026-11-03T07:05:51Z27.1build host 5 withhold-publish ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #3484]
34852026-11-03T07:48:22Z—build host 5 publish-held not recorded [drive_runs, drive_runs #3485]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-27T23:33:25Z2026-10-27T23:33:26Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-27T23:33:57Z2026-10-27T23:33:58Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-27T23:34:53Z2026-10-27T23:34:53Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-27T23:41:37Z2026-11-03T07:13:00Z3
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile d568513ce70f…
build_recipe a81b7687b11b…
system_pinning fa091140511e…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 2dc827957806…
verify_offline_sh 3e8184ea230c…
base_image_digests 89de9e3ffd5b…
dockerfile_offline d568513ce70f…
first_build_digest d60e6de38067…
remediate 2026-10-27T23:42:47Z2026-11-03T07:13:04Z3
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 4deba6adb7f2…
security_report 20d1d4aaffe1…
build_kit 2026-10-27T23:50:47Z2026-11-03T07:22:16Z3
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp e1cbde905504…
locked_digest 03a0e71c8fb8…
freeze_manifest c62c0ce83fdc…
offline_rebuild_transcript 6ce3430df6b3…
verdict 2026-10-27T23:51:32Z2026-11-03T07:23:01Z3
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 1fe4df90c42c…
publish_image 2026-10-27T23:52:09Z2026-11-03T07:23:36Z3
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme d076edcb24b0…
promotion_record 280a37bd1c88…
boot_instance 2026-10-27T23:52:15Z2026-11-03T07:23:43Z6
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle b1c0a5afa63f…
sbom 2026-10-27T23:52:30Z2026-11-03T07:23:56Z3
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 73d77971f3ed…
sbom_json a7a525d47dcf…
schema_discovery 2026-10-27T23:52:34Z2026-11-03T07:23:59Z3
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 529982209cdb…
dependency_tree f84ddfe65db2…
table_classification c73681a53618…
admin_handbook 2026-10-27T23:58:08Z2026-11-03T07:24:08Z3
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 1bb72b7d7663…
admin_handbook 9b5fc5f77eb0…
db_handbook 2026-10-28T00:03:47Z2026-11-03T07:24:19Z3
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 9ceacc09525d…
seed_isolation 2e6d352aa326…
seed_data 2026-10-28T00:03:57Z2026-11-03T07:24:29Z3
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 9325a09c0c2e…
seed_cases_json 09a318706f07…
seed_validate 2026-10-28T00:04:00Z2026-11-03T07:24:32Z3
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 278b520e6e96…
usecase_validate 2026-10-28T00:04:27Z2026-11-03T07:24:48Z3
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 38ab3c9ab499…
test_results 6114661f4b59…
usecase_contract 981b299f0575…
finalize_docs 2026-10-28T00:09:45Z2026-11-03T07:24:55Z3
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 5afbcf770c3d…
release_notes cc0c5a00e5ed…
api_integration_guide 7011b8827a1e…
package_archive invalidated 2026-11-03T07:47:45Z 2026-10-28T00:18:19Z2026-11-03T07:32:56Z5
33 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 assetchain_coverage
 sale_tar aaad1baacbc2…
checksums 1dca5b7c0087…
verify_md 05ffca3a6394…
rebuild_md ebca086acb2f…
manifest_txt 92f95382cdc8…
actions_jsonl dbeb0e4ee712…
provenance_md df5fe86935dc…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json a04d8853d1e5…

[stage_runs]

Rewinds

  • 2026-10-28T00:44:40Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2018]
  • 2026-11-03T05:42:28Z: package_archive to assemble_kit on strategy_changed (strategy changed (1848fc451389 -> fd525a162a81)) [stage_events, stage_events #22267]
  • 2026-11-03T06:34:29Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #22317]
  • 2026-11-03T07:04:27Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive --allow-rebuild) [stage_events, stage_events #22349]
  • 2026-11-03T07:05:55Z: package_archive to assemble_kit on strategy_changed (strategy changed (fd525a162a81 -> be5c54243cce)) [stage_events, stage_events #22364]
  • 2026-11-03T07:47:45Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #22397]

Model work per stage

1 item not recorded

Role: writer model. Calls up to 2026-11-03T07:32:56Z.

118 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook341103 not recordednot recorded —
db_handbook361303 not recordednot recorded —
usecase_validate4001 03590 —
finalize_docs401603 03771 —

[micro_step_runs]

  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

Fully recorded

Role: review model.

4 rounds, 4 counted, $5.14 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-10-28T00:19:19Z 0710 findings to repackage [held_rounds, held_rounds #20] rebuilt from a held-review state file $1.30 not recorded cbd10ae85f0a…
22026-11-03T06:11:30Z 044 findings to repackage [held_rounds, held_rounds #1393] $1.60 3 rounds, $40.00 2f47850e590b…
32026-11-03T06:42:40Z 005 clean to rebuild [held_rounds, held_rounds #1394] $1.28 3 rounds, $40.00 1a88865e36bd…
42026-11-03T07:33:59Z 003 clean to publish [held_rounds, held_rounds #1395] $0.96 3 rounds, $40.00 aaad1baacbc2…

Defects

Fully recorded
  • Ledger entries39 [defects, defects where product_slug=consul and this tag or chain]
  • Disclosed in the archive38 [docs/defects/defects.json, entries]

39 ledger entries: by severity low 28, high 11; by status fixed-before-release 33, open 5, fixed-in-release 1.

DefectSeverityStatusFound byFixed in
RSD-consul-9b9602eaa1
Documentation: Unchanged from round 5: the record published beside the sale tar labels the build as upstream's source. [defects, defects #97981]		lowfixed-before-releaseheld review (review model)—
RSD-consul-e16591e4e8
VERIFY.md: Count omits the VEX qualification (carried). [defects, defects #122484]		lowopenheld review (review model)—
RSD-consul-6dd8dc39b8
Docker Hub README: Count omits the VEX qualification (carried). [defects, defects #122485]		lowopenheld review (review model)—
RSD-consul-0bbb0ab3d8
Release notes: Line 9 names hashicorp/consul as the build source; line 26 says the fork (carried). [defects, defects #122486]		lowopenheld review (review model)—
RSD-consul-63da06587d
Docker Hub README: The image is built from the fork, not official upstream source (carried). [defects, defects #122487]		lowopenheld review (review model)—
RSD-consul-d2422af669
PROVENANCE.md: Provenance omits the fork the image is built from (carried). [defects, defects #122488]		lowopenheld review (review model)—
RSD-consul-458c7cdd55
Documentation: The record published beside the sale tar still labels the build 'Built from upstream's source', but the image is built from the ReadyStackFree/consul fork (tag v1.16.4-cve-r1). [defects, defects #122489]		lowfixed-in-releaseheld review (review model)v1.16.4-CE-ubuntu24.04-r5
RSD-consul-d493dd5122
Admin handbook: The documented shell command fails; -i -t must precede the container name (the same handbook gets it right in 'Running Programs Inside the Container'). [defects, defects #123030]		highfixed-before-releaseheld review (review model)—
RSD-consul-edbf347fbb
API guide: Following this sentence loses all KV data on restart; it also contradicts the Persistent Storage sections of every handbook. [defects, defects #123031]		highfixed-before-releaseheld review (review model)—
RSD-consul-489ef3cdf0
Database handbook: Tells customers re-creating loses data; re-create on the same volume keeps it (verified) and the Admin Handbook says so. [defects, defects #123032]		highfixed-before-releaseheld review (review model)—
RSD-consul-910565b437
Admin handbook: False statement about image contents/attack surface; contradicts the release notes. [defects, defects #123033]		highfixed-before-releaseheld review (review model)—
RSD-consul-a95e08c7dc
Database handbook: Same false claim in the DB Handbook. [defects, defects #123034]		highfixed-before-releaseheld review (review model)—
RSD-consul-3c390b63a6
API guide: Contradicts the guide's own statements and every handbook: a healthy check does not confirm a leader. [defects, defects #123035]		highfixed-before-releaseheld review (review model)—
RSD-consul-a64a786e8c
API guide: Says ACLs exist only in later versions; a customer needing auth would wrongly conclude this release cannot do it; contradicts the Access Control and Authentication sections. [defects, defects #123036]		highfixed-before-releaseheld review (review model)—
RSD-consul-621fe0f5b2
Admin handbook: Overstated and contradicts the 'Volume ownership and permissions' section, which instructs chmod 777. [defects, defects #123037]		lowfixed-before-releaseheld review (review model)—
RSD-consul-d9221a2212
Database handbook: Overstated: write permission is what matters. [defects, defects #123038]		lowfixed-before-releaseheld review (review model)—
RSD-consul-a5c0b0149c
Database handbook: False, and contradicts the Admin Handbook (Environment Variables) which is correct. [defects, defects #123039]		lowfixed-before-releaseheld review (review model)—
RSD-consul-b67c6b63e8
Database handbook: The body is the leader's RPC address, not a node ID. [defects, defects #123040]		lowfixed-before-releaseheld review (review model)—
RSD-consul-4b93b74152
API guide: Literal escape sequence printed instead of a dash in five list items (lines 401-405). [defects, defects #123041]		lowfixed-before-releaseheld review (review model)—
RSD-consul-7ca4d86efa
API guide: Omits -ui, contradicting the other handbooks; the following sentence about coexisting with -dev is also muddled. [defects, defects #123042]		lowfixed-before-releaseheld review (review model)—
RSD-consul-3f92f1e83c
API guide: Contradicts the guide's own Security section (same class as the carried fork defects). [defects, defects #123043]		lowfixed-before-releaseheld review (review model)—
RSD-consul-c6fb671e4d
Database handbook: Contradicts line 110 of the same handbook. [defects, defects #123044]		lowfixed-before-releaseheld review (review model)—
RSD-consul-b8250e5b7c
Admin handbook: Unsupported sizing figure that no record backs and the measurement does not match. [defects, defects #123045]		lowfixed-before-releaseheld review (review model)—
RSD-consul-95ca447031
Database handbook: The documented ownership fix cannot run in this image: it contains no chown (or ls, id, chmod). [defects, defects #152809]		highfixed-before-releaseheld review (review model)—
RSD-consul-8598f1d211
Database handbook: Suggests changing ownership from inside this image as root; the image has no chown. [defects, defects #152810]		lowfixed-before-releaseheld review (review model)—
RSD-consul-6ab7f066c9
Admin handbook: The in-container alternative points at a root container of this image, which has no chown. [defects, defects #152811]		lowfixed-before-releaseheld review (review model)—
RSD-consul-002ff1235e
API guide: In the rewritten 'Web UI' section the server command omits -client 0.0.0.0 and the volume. [defects, defects #152812]		highfixed-before-releaseheld review (review model)—
RSD-consul-1491179386
Database handbook: The example introduced by 'Mount a host directory or named volume' has no -v mount, so the data written to /consul/data is lost with the container (and the port is not published). [defects, defects #152813]		highfixed-before-releaseheld review (review model)—
RSD-consul-f1f752b9bf
Database handbook: Security-relevant false example: the CVE-2024-10005 fix leaves escaped slashes unchanged, so /service%2Fpath is NOT normalized. [defects, defects #152814]		highfixed-before-releaseheld review (review model)—
RSD-consul-8b1d219477
Database handbook: The fix is about header VALUE case and repeated values, not header-name case. [defects, defects #152815]		lowfixed-before-releaseheld review (review model)—
RSD-consul-da217ef25c
API guide: The agent has no ACL flags and `consul agent -help` lists none, so the instruction cannot be followed as written. [defects, defects #152816]		lowfixed-before-releaseheld review (review model)—
RSD-consul-30d849bb61
Admin handbook: Generic claim that URL encoding no longer bypasses L7 intentions; escaped slashes are unchanged. [defects, defects #153185]		lowfixed-before-releaseheld review (review model)—
RSD-consul-8cc5ca1343
Database handbook: Contradicts DB_HANDBOOK.md:569 within the same handbook. [defects, defects #153186]		lowfixed-before-releaseheld review (review model)—
RSD-consul-f3c00dcd97
API guide: Generic claim that URL-encoded bypasses are stopped; escaped slashes are unchanged. [defects, defects #153187]		lowfixed-before-releaseheld review (review model)—
RSD-consul-e3d70fbc98
Security report: Flat claim that URL-encoded paths cannot bypass intentions. [defects, defects #153188]		lowfixed-before-releaseheld review (review model)—
RSD-consul-7bb0d76cb9
Admin handbook: Wrong failure mode quoted. [defects, defects #153189]		lowfixed-before-releaseheld review (review model)—
RSD-consul-7e90451189
Admin handbook: `consul.service.consul` is a service-name query; node names use `<node>.node.consul` (DB_HANDBOOK.md:501). [defects, defects #153568]		lowfixed-before-releaseheld review (review model)—
RSD-consul-4a11ab81ec
API guide: The command at API_INTEGRATION_GUIDE.md:382 already ends with `-ui`; the sentence tells the reader to add a flag that is already there. [defects, defects #153569]		lowfixed-before-releaseheld review (review model)—
RSD-consul-f22cf51222
API guide: Live on the held digest with a root-owned bind mount at /consul/data: `==> failed to setup node ID: failed to write NodeID to disk: open /consul/data/node-id: permission denied`… [defects, defects #153570]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:86c509354da0cb8e5f2741148f06ee8c1a0d18589f0618cdc6f66f80d75614a6 · published digest sha256:86c509354da0cb8e5f2741148f06ee8c1a0d18589f0618cdc6f66f80d75614a6 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 274) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, vex_shipped) [g8_result.json, result]
  • Grade at releaseB (percent 72 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-03T07:48:44Z · failing 1 fixable critical/high vulnerability (1 high) in 1 package, e.g. github.com/hashicorp/consul 1.18.0 (fixed in 1.20.1)., Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-03T07:48:32Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3663172888 · transparency-log entry · integrated 2026-11-03T07:52:08Z) [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:02b29d477722cf4010a9a68a151fefaf321b3d6c239e839f8a87778a9086224f · state attached · log index 3663176361 · transparency-log entry
    • kind sbom · digest sha256:02b29d477722cf4010a9a68a151fefaf321b3d6c239e839f8a87778a9086224f · state attached · log index 3663179252 · transparency-log entry
    • kind vsa · digest sha256:02b29d477722cf4010a9a68a151fefaf321b3d6c239e839f8a87778a9086224f · state attached · log index 3663182950 · transparency-log entry
    • kind provenance · digest sha256:86c509354da0cb8e5f2741148f06ee8c1a0d18589f0618cdc6f66f80d75614a6 · state attached · log index 3663185690 · transparency-log entry
    • kind sbom · digest sha256:86c509354da0cb8e5f2741148f06ee8c1a0d18589f0618cdc6f66f80d75614a6 · state attached · log index 3663188243 · transparency-log entry
    • kind vsa · digest sha256:86c509354da0cb8e5f2741148f06ee8c1a0d18589f0618cdc6f66f80d75614a6 · state attached · log index 3663190686 · transparency-log entry
    (at 2026-11-03T07:52:09Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/consul/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-10-28T00:19:22Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:aa7268861781c745379831775f63177707fe7e2ce1b4ce22265a5226d7cd649b [clean-room rebuild ledger, runs[496]]
  • 2026-11-03T06:11:35Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:86c509354da0cb8e5f2741148f06ee8c1a0d18589f0618cdc6f66f80d75614a6 [clean-room rebuild ledger, runs[579]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-03T07:23:36Z [stage_runs, stage_runs chain 735 stage publish_image]
  • Archive manifests written2026-11-03T07:50:22Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 57 · probed 2026-11-03T07:17:25Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-03T07:53:34Z generated: by KitForge release/build_trail.py · generator commit ff3112bd2cb03ee39fd394ed644a9522854803de
  • 2026-11-03T07:55:06Z publication: promoted at 2026-11-03T07:54:11Z · promoted digest sha256:02b29d477722cf4010a9a68a151fefaf321b3d6c239e839f8a87778a9086224f · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 312 · checklist status complete · checklist at 2026-11-03T07:55:06Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

24 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r5/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r5/), as staged for publishing—
ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.rebuild.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r5/), as staged for publishing—
ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r5.rebuild.json.sigstorebeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r5/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r5/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)419
chainssadb, ReadyStack's engine database (not published)735
defectssadb, ReadyStack's engine database (not published)consul v1.16.4-CE-ubuntu24.04-r5
drive_runssadb, ReadyStack's engine database (not published)chain 735
held_roundssadb, ReadyStack's engine database (not published)chain 735
micro_step_runssadb, ReadyStack's engine database (not published)chain 735
release_imagessadb, ReadyStack's engine database (not published)consul v1.16.4-CE-ubuntu24.04-r5
stage_eventssadb, ReadyStack's engine database (not published)chain 735
stage_runssadb, ReadyStack's engine database (not published)chain 735
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—