Consul v1.16.4-CE-ubuntu24.04-r7 build trail

How ReadyStack built readystack/consul:v1.16.4-CE-ubuntu24.04-r7 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/consul:v1.16.4-CE-ubuntu24.04-r7
  • Index digestsha256:bea63f0ff14963838d6fe21b0677b2a3521b4ec7653c3394c675220df59f633f
  • linux/amd64 digestsha256:ad381f96b1260545c1859e59dae9cb95773519f4f048db5bc30cd58580340372
  • ArchiveReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.tar.gz
  • Archive SHA-256 now9b4c5627859bc0e33b3a8588698f5e64c1b03299df203906836495ff88e94bd5
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-11T00:40:25Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.trail.json.sigstore ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.trail.json
ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.trail.jsonReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.trail.json.sigstoreReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.trail.mdConsul product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductConsul (consul) [MANIFEST.json]
  • Release tagv1.16.4-CE-ubuntu24.04-r7 [MANIFEST.json]
  • Imagereadystack/consul:v1.16.4-CE-ubuntu24.04-r7 [MANIFEST.json]
  • Image index digestsha256:bea63f0ff14963838d6fe21b0677b2a3521b4ec7653c3394c675220df59f633f [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:ad381f96b1260545c1859e59dae9cb95773519f4f048db5bc30cd58580340372 [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.tar.gz (bytes 528131168) [MANIFEST.json]
  • Archive sha256 at publish18a17d47ac4fb92511fcd8be9faef9e7bed04ac32c6a3df728024736c8c3a883 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/hashicorp/consul [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv1.16.4 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit2b5841d3f6243fc9b24a5f223daeef69761e0317 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashfed15f67fb0cd2b93301c46ea33c61b4dbab2c7c070eff1fab00b3b4f1f79ec3 (files 10293) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:f2ab7fcfbf453eb59adf8b37871e8374ca43749e5ec5e41ad734f6d88e0de8ca [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794290160 (utc 2026-11-10T05:56:00Z) [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.rebuild.json, engine]
  • Engine commit(s)
    • commit e3eaace0a74e1a10fea82b44f3849ea9a0e2216a · dirty yes · first drive 4152
    • commit 8f330f31aa066ed1381d543d473df5415ecba80a · dirty yes · first drive 4170
    • commit e05220953a8a35bb19afca75bce1637a21d4c290 · dirty yes · first drive 4216
    • commit 012c3daa353c9980746c2c19594c14de64d28de4 · dirty yes · first drive 4224
    • commit f732c2a290affb5aadd84c5b59fb2fccf47c718a · dirty yes · first drive 4232
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain945 (created 2026-11-10T06:15:51Z · trigger customer_request · upstream version 1.16.4) [chains, chains #945]
  • Requestbuild request #623 (rebuild) (requested at 2026-11-10T06:02:09Z · requested by kitforge-agent · version 1.16.4) [build_requests, build_requests #623]
  • Reasonrevision v1.16.4-CE-ubuntu24.04-r7: same upstream version re-dated by its own release (owner 2026-11-10 "date images correctly") [build_requests, build_requests #623 request_reason]
  • Supersedesreadystack/consul:v1.16.4-CE-ubuntu24.04-r6 (chain 858) [chains, chains #858]

The path through the harness

Fully recorded

1 chain · 5 drives · 18 stages · 2 rewinds

Chain 945 release · ready_to_ship

Created 2026-11-10T06:15:51Z, upstream 1.16.4, build request 623 [chains, chains #945]

DriveStartedMinutesBuild hostHow it stopped
41522026-11-10T06:16:19Z43build host 5 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #4152]
41702026-11-10T08:55:36Z0.8build host 5 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #4170]
42162026-11-10T23:15:13Z8.5build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4216]
42242026-11-10T23:58:52Z3.7build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4224]
42322026-11-11T00:35:13Z—build host 5 publish-held not recorded [drive_runs, drive_runs #4232]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-10T06:16:31Z2026-11-10T06:16:31Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json d7f109a15715…
acquire 2026-11-10T06:16:38Z2026-11-10T06:16:40Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 717109e7026b…
license_file 24e598eb434d…
custody_inputs ad43eef85a7a…
source_tree_hash f13be32d07ed…
source_file_manifest 9b94d767e5d4…
plan 2026-11-10T06:17:30Z2026-11-10T06:17:31Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report e71087641924…
input_pin_plan 73b627854b57…
toolchain_lock 0f12715a8213…
assemble_kit 2026-11-10T06:25:04Z2026-11-10T06:25:05Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile cd793c0d781b…
build_recipe a9ca5246540a…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health afdcfc6c0196…
verify_offline_sh 3e8184ea230c…
base_image_digests 89de9e3ffd5b…
dockerfile_offline cd793c0d781b…
first_build_digest 996c45c06a22…
remediate 2026-11-10T06:26:22Z2026-11-10T06:26:23Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log ee6a65ea816c…
security_report a9b157dea184…
build_kit 2026-11-10T06:34:12Z2026-11-10T06:34:12Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp ab2269747af7…
locked_digest f4cfe600d425…
freeze_manifest 7fe66d9c435b…
offline_rebuild_transcript f84b10b1f25e…
verdict 2026-11-10T06:34:59Z2026-11-10T06:35:00Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 091a55fde34f…
publish_image 2026-11-10T06:35:36Z2026-11-10T06:35:36Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 87c8248aa3e6…
promotion_record 1e2fd0cc485e…
boot_instance 2026-11-10T06:35:43Z2026-11-10T06:35:49Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 7278f401153f…
sbom 2026-11-10T06:36:02Z2026-11-10T06:36:03Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 2eb3683a6323…
sbom_json f7fd752a875a…
schema_discovery 2026-11-10T06:36:05Z2026-11-10T06:36:06Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 529982209cdb…
dependency_tree f84ddfe65db2…
table_classification c73681a53618…
admin_handbook 2026-11-10T06:41:32Z2026-11-10T06:41:33Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 1bb72b7d7663…
admin_handbook 108ae21ffdce…
db_handbook 2026-11-10T06:48:15Z2026-11-10T06:48:16Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 3f058a7883b6…
seed_isolation 2e6d352aa326…
seed_data 2026-11-10T06:48:26Z2026-11-10T06:48:27Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 9325a09c0c2e…
seed_cases_json 2a83c1c22f10…
seed_validate 2026-11-10T06:48:30Z2026-11-10T06:48:30Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 8d3f61ddf946…
usecase_validate 2026-11-10T06:49:04Z2026-11-10T06:49:05Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b06472d3fcf6…
passed_tests 4cc6268aef8e…
test_results 87aa86c46eee…
usecase_contract 5f1dbbce1b58…
finalize_docs 2026-11-10T06:55:40Z2026-11-10T06:55:41Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 12983f34f717…
release_notes fa798beeb023…
api_integration_guide 7e40f6c70b24…
package_archive invalidated 2026-11-11T00:34:46Z 2026-11-10T06:59:17Z2026-11-11T00:02:32Z4
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 9bd07019ebb4…
checksums dbf5463ac7ae…
verify_md 2401e236baca…
rebuild_md a7de353c7a55…
manifest_txt 1e68f303c746…
actions_jsonl 949862b08b0b…
provenance_md 70331c4ad51b…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json ba0b4286b518…

[stage_runs]

Rewinds

  • 2026-11-10T23:57:15Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30948]
  • 2026-11-11T00:34:46Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30974]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-11T00:02:32Z.

132 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 016785 —
remediate2001 022933 L-A08, L-038, L-036, L-034, L-032
admin_handbook341203 3127724 —
db_handbook472003 7188031 —
usecase_validate1001 02148 —
finalize_docs462003 6187319 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $2.33 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-10T23:24:20Z 1115 findings to repackage [held_rounds, held_rounds #1715] $1.22 3 rounds, $40.00 6255f14a5a1a…
22026-11-11T00:03:07Z 006 clean to publish [held_rounds, held_rounds #1719] $1.11 3 rounds, $40.00 9bd07019ebb4…

Defects

Fully recorded
  • Ledger entries28 [defects, defects where product_slug=consul and this tag or chain]
  • Disclosed in the archive28 [docs/defects/defects.json, entries]

28 ledger entries: by severity low 26, critical 1, high 1; by status open 6, fixed-before-release 22.

DefectSeverityStatusFound byFixed in
RSD-consul-9b9602eaa1
Documentation: Same class as carried RSD-consul-b8e267fca4/e088cf9546: IMAGE_CONFIG.json label readystack.source_patches and strategy source_patches show the build comes from… [defects, defects #97981]		lowopenheld review (review model)—
RSD-consul-b5b6765d4f
VERIFY.md: Count omits the VEX qualification (carried). [defects, defects #235696]		lowopenheld review (review model)—
RSD-consul-ed8193008b
Docker Hub README: Count omits the VEX qualification (carried). [defects, defects #235697]		lowopenheld review (review model)—
RSD-consul-a1c5f888ba
Release notes: Line 9 names hashicorp/consul as the build source; line 26 says the fork (carried). [defects, defects #235698]		lowopenheld review (review model)—
RSD-consul-b8e267fca4
Docker Hub README: The image is built from the fork, not official upstream source (carried). [defects, defects #235699]		lowopenheld review (review model)—
RSD-consul-e088cf9546
PROVENANCE.md: Provenance omits the fork the image is built from (carried). [defects, defects #235700]		lowopenheld review (review model)—
RSD-consul-a04e3ceab2
Database handbook: Ran on the held digest with a host path that did not exist (Docker creates it root:root 755, as DB:333 and DB:399 say): '==> failed to setup node ID: failed to write NodeID to disk: open… [defects, defects #237788]		criticalfixed-before-releaseheld review (review model)—
RSD-consul-859c1be066
Database handbook: docker export of the held digest: 685 entries, 0 setuid/setgid files, no usr/bin/passwd, gpasswd, su or mount; IMAGE_BINARIES.txt lists none of them. [defects, defects #237789]		highfixed-before-releaseheld review (review model)—
RSD-consul-03b59bb82f
Database handbook: Docker passes nothing for an unset host variable; DB:441 and API:241 say 'no variable at all'. [defects, defects #237790]		lowfixed-before-releaseheld review (review model)—
RSD-consul-383c6ed2c5
Database handbook: DB:439 and DB:795: the binary does not recognise CONSUL_BIND_INTERFACE or CONSUL_DISABLE_PERM_MGMT; the entrypoint script that reads them is not in the image. [defects, defects #237791]		lowfixed-before-releaseheld review (review model)—
RSD-consul-ef9c8ee78c
Admin handbook: Contradicts ADMIN:119, ADMIN:416 and DB:439 ('the Consul binary does not recognize these variables'). [defects, defects #237792]		lowfixed-before-releaseheld review (review model)—
RSD-consul-0c2078575f
Admin handbook: Default container on the held digest: `docker diff` empty, no files under /consul/data; the following 'exits at startup' error applies only to server mode. [defects, defects #237793]		lowfixed-before-releaseheld review (review model)—
RSD-consul-b7ba305102
API guide: Default container on the held digest: `docker diff` printed nothing after 10 s; ADMIN:500 and DB:463 ('No files are written to disk'). [defects, defects #237794]		lowfixed-before-releaseheld review (review model)—
RSD-consul-a54df43c3f
Database handbook: `docker run <image> -hcl 'acl { enabled = true default_policy = "deny" }'` enabled ACLs and `consul acl bootstrap` returned a token. [defects, defects #237795]		lowfixed-before-releaseheld review (review model)—
RSD-consul-ea1480425f
Database handbook: Measured with default_policy deny and a bootstrapped token: /v1/catalog/services without a token -> `{}` [200] (an object, not a list); /v1/catalog/nodes, /catalog/service/consul,… [defects, defects #237796]		lowfixed-before-releaseheld review (review model)—
RSD-consul-78d705df06
API guide: Same measurement as DB:752; the 'for bootstrapping and health checks' purpose is not in any record. [defects, defects #237797]		lowfixed-before-releaseheld review (review model)—
RSD-consul-de96d8461d
Database handbook: Server-mode container without -dev and without -ui: GET /ui/ -> 404 (measured); strategy doc_facts: UI is served 'when the agent runs with -ui or -dev'; ADMIN:313 says the same. [defects, defects #237798]		lowfixed-before-releaseheld review (review model)—
RSD-consul-9b17fdac60
Admin handbook: `+tcp` makes dig use TCP, not UDP; the sentence contradicts itself. [defects, defects #237799]		lowfixed-before-releaseheld review (review model)—
RSD-consul-c4e6748546
Admin handbook: Contradicts ADMIN:101 and DB:881 (ACLs built in, `ACLsEnabled: false`); ACLs enabled and enforced with deny + bootstrap on the held digest. [defects, defects #237800]		lowfixed-before-releaseheld review (review model)—
RSD-consul-af86e06ab6
API guide: `gh api repos/ReadyStackFree/consul/compare/v1.16.4...v1.16.4-cve-r1`: d9d2098100 CoreDNS helper, 4b4e6dfe33 CVE-2024-10005, 0de473d2ce CVE-2024-10006, 10aaa17c1f READYSTACK.md. [defects, defects #237801]		lowfixed-before-releaseheld review (review model)—
RSD-consul-fecfa83676
Admin handbook: Same compare as API:574: the CoreDNS helper commit is not a security patch; ADMIN:759 itself calls it a 'third commit'. [defects, defects #237802]		lowfixed-before-releaseheld review (review model)—
RSD-consul-4f19e7b800
Database handbook: Same compare: the third listed item (CoreDNS reverse-DNS helper) is a dependency-removal change, not a security patch; DB:176 says 'fixes for two CVEs'. [defects, defects #237803]		lowfixed-before-releaseheld review (review model)—
RSD-consul-5992388c9b
API guide: RELEASE_POLICY is not part of the packaged documents or the kit; the reader cannot follow the reference. [defects, defects #237804]		lowfixed-before-releaseheld review (review model)—
RSD-consul-a421118487
Admin handbook: Read literally, "without -dev OR without -ui" says a -dev start without -ui has no UI; the default container (-dev, no -ui) answers GET /ui/ 200 (measured on the held digest), and DB:713 and the… [defects, defects #239610]		lowfixed-before-releaseheld review (review model)—
RSD-consul-c3d355eb35
Admin handbook: gh compare ReadyStackFree/consul v1.16.4...v1.16.4-cve-r1: d9d2098100 is a dependency-removal change, only 4b4e6dfe33 (CVE-2024-10005) and 0de473d2ce (CVE-2024-10006) address CVEs; the round-1… [defects, defects #239611]		lowfixed-before-releaseheld review (review model)—
RSD-consul-f3d3ff3cfa
Admin handbook: No record rates any fixed CVE critical (VEX/SECURITY_REPORT: CVE-2024-10005 HIGH, CVE-2024-10006 MEDIUM); the handbook itself lists four unpatched CVEs at ADMIN:703-710. [defects, defects #239612]		lowfixed-before-releaseheld review (review model)—
RSD-consul-faefe86982
Database handbook: Held digest, -hcl acl{enabled=true default_policy="deny"} + consul acl bootstrap: dig +tcp consul.service.consul -> status: NXDOMAIN, ANSWER: 0 (no token). [defects, defects #239613]		lowfixed-before-releaseheld review (review model)—
RSD-consul-4bbccd0dbf
Database handbook: DOCKERHUB_README.md:68 gives "Support: (address withheld), as set out in the ReadyStack Agreement"; no record says support is community-only. [defects, defects #239614]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:ad381f96b1260545c1859e59dae9cb95773519f4f048db5bc30cd58580340372 · published digest sha256:ad381f96b1260545c1859e59dae9cb95773519f4f048db5bc30cd58580340372 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 233) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseB (percent 72 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-11T00:35:41Z · failing 1 fixable critical/high vulnerability (1 high) in 1 package, e.g. github.com/hashicorp/consul 1.18.0 (fixed in 1.20.1)., Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-11T00:35:24Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3797716084 · transparency-log entry · integrated 2026-11-11T00:39:06Z) [ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:bea63f0ff14963838d6fe21b0677b2a3521b4ec7653c3394c675220df59f633f · state attached · log index 3797719650 · transparency-log entry
    • kind sbom · digest sha256:bea63f0ff14963838d6fe21b0677b2a3521b4ec7653c3394c675220df59f633f · state attached · log index 3797720913 · transparency-log entry
    • kind vsa · digest sha256:bea63f0ff14963838d6fe21b0677b2a3521b4ec7653c3394c675220df59f633f · state attached · log index 3797722884 · transparency-log entry
    • kind provenance · digest sha256:ad381f96b1260545c1859e59dae9cb95773519f4f048db5bc30cd58580340372 · state attached · log index 3797724856 · transparency-log entry
    • kind sbom · digest sha256:ad381f96b1260545c1859e59dae9cb95773519f4f048db5bc30cd58580340372 · state attached · log index 3797726446 · transparency-log entry
    • kind vsa · digest sha256:ad381f96b1260545c1859e59dae9cb95773519f4f048db5bc30cd58580340372 · state attached · log index 3797728365 · transparency-log entry
    (at 2026-11-11T00:39:06Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/consul/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-10T23:24:27Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:ad381f96b1260545c1859e59dae9cb95773519f4f048db5bc30cd58580340372 [clean-room rebuild ledger, runs[736]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-10T06:35:36Z [stage_runs, stage_runs chain 945 stage publish_image]
  • Archive manifests written2026-11-11T00:37:16Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 57 · probed 2026-11-10T06:30:00Z · source build_kit) [release_images, isa_level_hard]

History

3 events
  • 2026-11-11T00:40:25Z generated: by KitForge release/build_trail.py · generator commit f732c2a290affb5aadd84c5b59fb2fccf47c718a
  • 2026-11-11T00:41:57Z publication: promoted at 2026-11-11T00:41:02Z · promoted digest sha256:bea63f0ff14963838d6fe21b0677b2a3521b4ec7653c3394c675220df59f633f · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 458 · checklist status complete · checklist at 2026-11-11T00:41:57Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
  • 2026-11-11T23:36:18Z repack: previous sha256 18a17d47ac4fb92511fcd8be9faef9e7bed04ac32c6a3df728024736c8c3a883 · sha256 9b4c5627859bc0e33b3a8588698f5e64c1b03299df203906836495ff88e94bd5 · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); README.md and FILE_MODES.tsv at the archive root (release/kit_unpack.py), BUILD_OFFLINE.sh putting back the packed file modes, REBUILD.md unpacking with -p and keeping the key and signature outside the kit, and the verifier naming what differs; not image inputs; image and every build input unchanged · label kitfix · replaced BUILD_OFFLINE.sh, docs/REBUILD.md, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, docs/rebuild-bundle/rebuild_bundle.py · added FILE_MODES.tsv, README.md · record MANIFEST.json repack_history

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r7/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r7/), as staged for publishing—
ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.rebuild.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r7/), as staged for publishing—
ReadyStack-consul-v1.16.4-CE-ubuntu24.04-r7.rebuild.json.sigstorebeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r7/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/consul/v1.16.4-CE-ubuntu24.04-r7/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)623
chainssadb, ReadyStack's engine database (not published)945
defectssadb, ReadyStack's engine database (not published)consul v1.16.4-CE-ubuntu24.04-r7
drive_runssadb, ReadyStack's engine database (not published)chain 945
held_roundssadb, ReadyStack's engine database (not published)chain 945
lesson_recallssadb, ReadyStack's engine database (not published)chain 945
micro_step_runssadb, ReadyStack's engine database (not published)chain 945
release_imagessadb, ReadyStack's engine database (not published)consul v1.16.4-CE-ubuntu24.04-r7
stage_eventssadb, ReadyStack's engine database (not published)chain 945
stage_runssadb, ReadyStack's engine database (not published)chain 945
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—