CoreDNS v1.14.2-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/coredns:v1.14.2-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/coredns:v1.14.2-CE-ubuntu24.04-r1
  • Index digestsha256:2b014072549ccd0ee67a40fcb34c99b2694bf51d2a62356cb12a8e1ce6d44145
  • linux/amd64 digestsha256:faf5d9691f306d7f318377a2db731aa843ef8ed23866e7c410cdbc001dda2c4b
  • ArchiveReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 now9102bee4b6baecd3a2775ddcc830c7ca3354b098b7f16ad1b29266daabf76fd3
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since 2026-11-03T00:52:44Z)
  • Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
  • Sections9 sections, 4 fully recorded; 11 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.trail.json
ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.trail.jsonReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.trail.mdCoreDNS product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

1 item not recorded
  • ProductCoreDNS (coredns) [MANIFEST.json]
  • Release tagv1.14.2-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/coredns:v1.14.2-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:2b014072549ccd0ee67a40fcb34c99b2694bf51d2a62356cb12a8e1ce6d44145 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:faf5d9691f306d7f318377a2db731aa843ef8ed23866e7c410cdbc001dda2c4b [ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.tar.gz (bytes 466031530) [MANIFEST.json]
  • Archive sha256 at publish30f4cd47c170b3c3c6b868b188cbeacf639934b677b8ca4ba798ca3d5ac49912 [MANIFEST.json, repack_history[0].previous_tarball_sha256]
  • Archive sha256 now9ef5cbc133fcbe04b9288ab673052096cc344c1e8ccd338ef7b1be91793ca309 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack history
    • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 30f4cd47c170b3c3c6b868b188cbeacf639934b677b8ca4ba798ca3d5ac49912 · sha256 9ef5cbc133fcbe04b9288ab673052096cc344c1e8ccd338ef7b1be91793ca309 · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
    [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/coredns/coredns [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv1.14.2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitdd1df4f5db93767a44e37638df44969503b320d2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashf69cbed3da6f6a1dbbddc86418a6aae8588c6ecf4c604208b9eba41225f42670 (files 917) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:d0ce9c3f8c11dca75e507a0f88c66a7f692b8e9e0e4c91f47a9a2393fe18c1c5 [ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1772772585 (utc 2026-03-06T04:49:45Z) [ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded
  • Chain782 (created 2026-10-29T04:34:08Z · trigger customer_request · upstream version v1.14.2) [chains, chains #782]
  • Requestbuild request #457 (new_product) (requested at 2026-10-29T03:13:41Z · requested by agent · version v1.14.2) [build_requests, build_requests #457]
  • ReasonKubernetes VM Stack Kits (DevOps 2026-10-28); owner 2026-10-28 "pause all other efforts. This build list is your top priority"; owner 2026-10-29: publish every component through the normal pipeline, listed only at A (virthandler/virtlauncher may be unlisted, grade disclosed); both bundles ship as images [build_requests, build_requests #457 request_reason]

The path through the harness

2 items not recorded

1 chain · 6 drives · 18 stages · 1 rewind

Chain 782 release · shipped

Created 2026-10-29T04:34:08Z, upstream v1.14.2, build request 457 [chains, chains #782]

DriveStartedMinutesBuild hostHow it stopped
10622026-10-29T04:34:20Z22.4build host 2 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #1062] rebuilt from a build line's log
10672026-10-29T06:33:07Z7.2build host 2 withhold-publish ready_to_ship [drive_runs, drive_runs #1067] rebuilt from a build line's log
10702026-10-29T07:27:59Z7build host 2 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #1070] rebuilt from a build line's log
10722026-10-29T08:19:21Z4.2build host 2 withhold-publish ready_to_ship [drive_runs, drive_runs #1072] rebuilt from a build line's log
10732026-10-29T09:00:33Z4.5build host 2 withhold-publish ready_to_ship [drive_runs, drive_runs #1073] rebuilt from a build line's log
10742026-10-29T09:21:46Z6.3build host 2 publish-held shipped [drive_runs, drive_runs #1074] rebuilt from a build line's log

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-29T04:34:26Z2026-10-29T04:34:27Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-29T04:34:30Z2026-10-29T04:34:31Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-29T04:35:03Z2026-10-29T04:35:04Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-29T04:38:03Z2026-10-29T04:38:04Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 —
remediate 2026-10-29T04:38:54Z2026-10-29T04:38:54Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 —
build_kit 2026-10-29T04:42:43Z2026-10-29T04:42:44Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 —
verdict 2026-10-29T04:43:16Z2026-10-29T04:43:17Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 —
publish_image 2026-10-29T04:43:47Z2026-10-29T04:43:48Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 —
boot_instance 2026-10-29T04:43:53Z2026-10-29T09:00:46Z3 — —
sbom 2026-10-29T04:44:03Z2026-10-29T04:44:04Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 —
schema_discovery 2026-10-29T04:44:06Z2026-10-29T04:44:06Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 —
admin_handbook 2026-10-29T04:47:30Z2026-10-29T04:47:31Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 —
db_handbook 2026-10-29T04:51:01Z2026-10-29T04:51:02Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 —
seed_data 2026-10-29T04:51:08Z2026-10-29T09:00:50Z2
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 —
seed_validate 2026-10-29T04:51:10Z2026-10-29T09:00:53Z2
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 —
usecase_validate 2026-10-29T04:51:21Z2026-10-29T09:01:03Z2
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 —
finalize_docs 2026-10-29T04:54:46Z2026-10-29T09:01:09Z2
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 —
package_archive 2026-10-29T04:56:45Z2026-10-29T09:28:02Z6
33 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 scout_grade_a
  • G8 script_copies
  • G8 three_way_sha
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 assetchain_coverage
 —

[stage_runs]

Rewinds

  • 2026-10-29T09:21:18Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #1273]
  • Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
  • Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-10-29T09:28:02Z.

67 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook20303 not recordednot recorded —
db_handbook22102 not recordednot recorded —
finalize_docs21102 not recordednot recorded —

[micro_step_runs]

  • Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
  • Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

3 items not recorded

Role: review model.

3 rounds, 3 counted, $4.83 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-10-29T06:40:42Z 13312 blocked to blocked [held_rounds, held_rounds #21] rebuilt from a held-review state file $2.02 not recorded not recorded
22026-10-29T08:23:47Z 0522 blocked to blocked [held_rounds, held_rounds #22] rebuilt from a held-review state file $1.80 not recorded not recorded
32026-10-29T09:05:18Z 004 clean to publish [held_rounds, held_rounds #23] rebuilt from a held-review state file $1.00 not recorded not recorded

Overrides

  • max_rounds: — to 6; by not recorded; why: not recorded predates override recording (2026-11-02): found in runstate/held-auto/coredns.json, last written 2026-10-29T09:20Z; who set it, why, when and the value before are not known [review_overrides, review_overrides #2]
  • Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
  • Not recorded: the round cap in force at each round (the state files did not keep it)
  • Not recorded: who raised max_rounds to 6 and why (review_overrides #2 was backfilled from a state file; overrides are recorded with who and why from 2026-11-02)

Defects

Fully recorded
  • Ledger entries69 [defects, defects where product_slug=coredns and this tag or chain]
  • Disclosed in the archive69 [docs/defects/defects.json, entries]

69 ledger entries: by severity critical 1, high 36, low 32; by status fixed-before-release 69.

DefectSeverityStatusFound byFixed in
RSD-coredns-6cfe80bba8
API guide: The worked example that follows this sentence appends `-log json`, which CoreDNS does not have; the container exits immediately instead of starting. [defects, defects #134598]		criticalfixed-before-releaseheld review (review model)—
RSD-coredns-efe4b6f7c7
Admin handbook: Following the advice maps host port 53 to the HTTP health listener, so DNS clients get no DNS service; also the image declares no 8080 (see the ports-table finding). [defects, defects #134599]		highfixed-before-releaseheld review (review model)—
RSD-coredns-781fe05e31
Admin handbook: Presented directly after the plain `docker run` start command as what that container does; the hardening is only applied with --cap-drop ALL --cap-add NET_BIND_SERVICE --security-opt… [defects, defects #134600]		highfixed-before-releaseheld review (review model)—
RSD-coredns-f427d2b179
Admin handbook: Lists 'all capabilities dropped, read-only root filesystem, privilege escalation disabled' as properties of the image/default start command; they are run-time flags. [defects, defects #134601]		highfixed-before-releaseheld review (review model)—
RSD-coredns-f3e706aa84
Admin handbook: Same default-vs-flags error, stated for the plain start command above it. [defects, defects #134602]		highfixed-before-releaseheld review (review model)—
RSD-coredns-741a6f158b
Admin handbook: Says the capability is not needed at runtime. [defects, defects #134603]		highfixed-before-releaseheld review (review model)—
RSD-coredns-e99f9d0182
API guide: Same false claim in the Security Model; the following sentence ('However, ... [defects, defects #134604]		highfixed-before-releaseheld review (review model)—
RSD-coredns-0dd2761db3
API guide: Same false claim again; `--cap-drop ALL` alone makes the container exit. [defects, defects #134605]		highfixed-before-releaseheld review (review model)—
RSD-coredns-3fc98b67f6
API guide: Overview claims the image itself enforces these; they are run flags. [defects, defects #134606]		highfixed-before-releaseheld review (review model)—
RSD-coredns-853a25be1b
API guide: The 'image enforces' list (read-only root, no-new-privileges, dropped capabilities) is not image configuration; the default run has none of them. [defects, defects #134607]		highfixed-before-releaseheld review (review model)—
RSD-coredns-7e86190447
API guide: Says no flags are needed and the container already enforces them; the default run enforces none. [defects, defects #134608]		highfixed-before-releaseheld review (review model)—
RSD-coredns-ebc35b95b3
API guide: Unconditional claim; false for the documented start command. [defects, defects #134609]		highfixed-before-releaseheld review (review model)—
RSD-coredns-ef2507341b
Database handbook: Claims the image already has the posture and needs no flags; docker inspect shows none applied by default. [defects, defects #134610]		highfixed-before-releaseheld review (review model)—
RSD-coredns-1969a4cc23
Database handbook: Not a property of the image. [defects, defects #134611]		highfixed-before-releaseheld review (review model)—
RSD-coredns-03a6033b84
Database handbook: Unconditional claim; default run drops nothing. [defects, defects #134612]		highfixed-before-releaseheld review (review model)—
RSD-coredns-a2f9920a04
Database handbook: Listed under 'The image runs with these properties' with Security options 'no-new-privileges, read-only root filesystem'; they are not image properties (IMAGE_CONFIG.json has no such settings). [defects, defects #134613]		highfixed-before-releaseheld review (review model)—
RSD-coredns-ef061cf7e5
Database handbook: A default Docker run grants Docker's default capability set. [defects, defects #134614]		highfixed-before-releaseheld review (review model)—
RSD-coredns-fb73d2d8ea
Admin handbook: The example Corefile has no `health` or `ready` plugin, so a container started with it turns unhealthy (the image HEALTHCHECK probes :8080/health) and Kubernetes probes fail. [defects, defects #134615]		highfixed-before-releaseheld review (review model)—
RSD-coredns-6951a9c385
Admin handbook: Image has dash/sh and coreutils-style tools; the curated fact says only curl, bash, dig, nslookup are absent. [defects, defects #134616]		highfixed-before-releaseheld review (review model)—
RSD-coredns-90f1428685
Admin handbook: Same false 'no shell' claim; contradicts line 597. [defects, defects #134617]		highfixed-before-releaseheld review (review model)—
RSD-coredns-251f805f4c
Database handbook: False 'no shell'. [defects, defects #134618]		highfixed-before-releaseheld review (review model)—
RSD-coredns-9a4829eabf
Database handbook: Names `sh` as absent; it is present. [defects, defects #134619]		highfixed-before-releaseheld review (review model)—
RSD-coredns-897ae4ac97
Database handbook: Names `sh` as absent; it is present. [defects, defects #134620]		highfixed-before-releaseheld review (review model)—
RSD-coredns-a61db8453a
API guide: False 'no shell'. [defects, defects #134621]		highfixed-before-releaseheld review (review model)—
RSD-coredns-722e1f5c9d
API guide: False 'no shell / additional utilities'. [defects, defects #134622]		highfixed-before-releaseheld review (review model)—
RSD-coredns-708b53e6d2
API guide: Claims no shells and gives an impossible instruction (`docker exec` to run a separate container). [defects, defects #134623]		highfixed-before-releaseheld review (review model)—
RSD-coredns-9e55dee3d3
API guide: False 'no shell'. [defects, defects #134624]		highfixed-before-releaseheld review (review model)—
RSD-coredns-ea59a2d51d
API guide: The `id` command does not exist in the image, and a root account is present in /etc/passwd. [defects, defects #134625]		highfixed-before-releaseheld review (review model)—
RSD-coredns-0ce8ad8695
Database handbook: Says the endpoint answers only on 127.0.0.1; a published port reached it from the host. [defects, defects #134626]		highfixed-before-releaseheld review (review model)—
RSD-coredns-de48269dc1
Admin handbook: They are not loopback-only. [defects, defects #134627]		highfixed-before-releaseheld review (review model)—
RSD-coredns-e2d1522644
Admin handbook: The sentence says loopback-only and, in the next breath, any client can reach them; the loopback claim is false. [defects, defects #134628]		highfixed-before-releaseheld review (review model)—
RSD-coredns-3796c7bad7
Database handbook: Not loopback-only. [defects, defects #134629]		highfixed-before-releaseheld review (review model)—
RSD-coredns-18e07ce18f
Admin handbook: Lists runAsNonRoot: true as a setting kubeadm applies and 'enforces'; kubeadm does not set it. [defects, defects #134630]		highfixed-before-releaseheld review (review model)—
RSD-coredns-1c3fe5f6cd
Release notes: Round-1 major still stands: the intended behaviour is published to customers as a failed build-time check and a Known issue. [defects, defects #134631]		highfixed-before-releaseheld review (review model)—
RSD-coredns-8817d57c69
Test records: Record lists the intended behaviour as a failed test (round-1 minor, unchanged). [defects, defects #134632]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-36f3a3497b
Admin handbook: The image declares only 53/tcp and 53/udp; 8080 is served but not declared. [defects, defects #134633]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-456f7abb6a
API guide: Lists 8080, 8181, 9153 as exposed ports; only 53 is declared. [defects, defects #134634]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-85f789921b
Admin handbook: whoami returns the client's address and port, not the server's name. [defects, defects #134635]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-07bd558f59
Admin handbook: Suggests a writable Corefile mount, contradicting the rest of the handbook. [defects, defects #134636]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-1b1cefdf83
Database handbook: Contradicts the other handbooks on which endpoint is liveness. [defects, defects #134637]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-e402f3cb29
Admin handbook: Both endpoints are placed on port 8080. [defects, defects #134638]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-71d0f63a8c
Database handbook: The next bullet says /ready is served on 8181. [defects, defects #134639]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-eef67e81a8
Admin handbook: Attributes the UID to kubeadm's Deployment. [defects, defects #134640]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-a5c688f0fe
API guide: Lists the image user and `no-new-privileges` as kubeadm settings; kubeadm sets allowPrivilegeEscalation: false only. [defects, defects #134641]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-8f1fc069cd
API guide: Kubernetes Integration tells readers to use `<your-registry>` while the Quick Start uses `readystack`; a registry host alone would resolve to the wrong image path (this also applies to 'your… [defects, defects #134642]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-5e7d9a1f18
API guide: The corrected round-1 example (`-quiet` after the image name) does not append a flag: Docker replaces the image CMD, so CoreDNS no longer reads the mounted /etc/coredns/Corefile, falls back to the… [defects, defects #135052]		highfixed-before-releaseheld review (review model)—
RSD-coredns-fb818120fd
Admin handbook: "Additional arguments" suggests they are added to the default `-conf` argument; they replace it. [defects, defects #135053]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-5c42a4710f
Database handbook: Same CMD-replacement trap as the API guide example. [defects, defects #135054]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-2eb724e23d
Admin handbook: The example runs the image with a path that does not exist inside it, so the container exits at once; the path must be mounted. [defects, defects #135055]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-ab1df2ec13
API guide: The command points -conf at a file that does not exist in the image; the container exits. [defects, defects #135056]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-5f92d6066b
Admin handbook: "v1.14.2 is the latest patch of that line" is false: v1.14.3-v1.14.7 have been published upstream. [defects, defects #135057]		highfixed-before-releaseheld review (review model)—
RSD-coredns-f6856332b9
Database handbook: "No shell interpreters ... [defects, defects #135058]		highfixed-before-releaseheld review (review model)—
RSD-coredns-654f4c4875
Admin handbook: Credits kubeadm's Deployment with enforcing "non-root user execution" (and with "no-new-privileges enabled" as a separate property); kubeadm sets no user (round-1 finding, still present). [defects, defects #135059]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-5fa097f75d
Admin handbook: Attributes uid 65532 to the kubeadm Deployment (round-1 minor, still present). [defects, defects #135060]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-3d6f313ac1
Database handbook: Same misattribution of the UID to kubeadm. [defects, defects #135061]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-04fb8d4af1
Admin handbook: Round-1 minor, still present: telling readers to replace the value with "your container registry" (a host alone) resolves to <host>/coredns, not readystack/coredns; contradicts the API guide, which… [defects, defects #135062]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-3d1b8536ae
Database handbook: Same: "image registry hostname" resolves to the wrong image path. [defects, defects #135063]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-80e8427cac
API guide: Claims only the CoreDNS binary and runtime libraries; the image also has sh, rs-probe and coreutils-style tools (round-1 class). [defects, defects #135064]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-1cd327749a
API guide: Same. [defects, defects #135065]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-d92c2af43a
Database handbook: Refers to an internal record name with no path. [defects, defects #135066]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-d6672ccc77
Admin handbook: Lines 596-606 present a shell session as a way to run "a shell or diagnostic tool", but without -i/-t both commands exit immediately; the image has no diagnostic tools. [defects, defects #135067]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-edddd56d67
Admin handbook: Round-1 minor, still present: "exposes" lists 8080/8181/9153 as image-exposed ports; the image declares only 53 (DB_HANDBOOK.md:221 and API guide "Exposed Ports" state it correctly). [defects, defects #135068]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-8a5e757a5e
Admin handbook: Round-1 minor, still present: "exposes" lists 8080/8181/9153 as image-exposed ports; the image declares only 53 (DB_HANDBOOK.md:221 and API guide "Exposed Ports" state it correctly). [defects, defects #135069]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-74ede53f29
Admin handbook: Round-1 minor, still present: "exposes" lists 8080/8181/9153 as image-exposed ports; the image declares only 53 (DB_HANDBOOK.md:221 and API guide "Exposed Ports" state it correctly). [defects, defects #135070]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-3a0a34373c
Database handbook: The documented command publishes only port 53, so it does not provide the health endpoint on port 8080 to the host. [defects, defects #135071]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-890b41bea9
Database handbook: Presents 8080/8181 as image-exposed ports (round-1/2 class, still present here). [defects, defects #135233]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-35b35272cc
Database handbook: Round-1/2 finding still present: kubeadm builds the image as <dns.imageRepository>/coredns:<tag>, so a registry host alone resolves to <host>/coredns, not readystack/coredns. [defects, defects #135234]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-4e90bba379
Admin handbook: The image HEALTHCHECK probes only http://127.0.0.1:8080/health; it does not need the ready plugin on 8181. [defects, defects #135235]		lowfixed-before-releaseheld review (review model)—
RSD-coredns-d2e11f5c51
API guide: The 'apply these security settings' command has no image argument, so docker run rejects it (requires at least 1 argument); a customer pasting it gets an error. [defects, defects #135236]		lowfixed-before-releaseheld review (review model)—

Verification

2 items not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:faf5d9691f306d7f318377a2db731aa843ef8ed23866e7c410cdbc001dda2c4b · published digest sha256:faf5d9691f306d7f318377a2db731aa843ef8ed23866e7c410cdbc001dda2c4b · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 112) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 782 package_archive gate_result.g8.result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-29T09:22:01Z · failing Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • First own scan of the releaseA (at 2026-10-29T09:28:13Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-29T06:23:34Z) [image_scans, image_scans #1548]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-29T09:21:51Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3621753996 · transparency-log entry · integrated 2026-11-01T05:49:23Z) [ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:2b014072549ccd0ee67a40fcb34c99b2694bf51d2a62356cb12a8e1ce6d44145 · state attached · log index 3563741796 · transparency-log entry
    • kind sbom · digest sha256:2b014072549ccd0ee67a40fcb34c99b2694bf51d2a62356cb12a8e1ce6d44145 · state attached · log index 3563743812 · transparency-log entry
    • kind vsa · digest sha256:2b014072549ccd0ee67a40fcb34c99b2694bf51d2a62356cb12a8e1ce6d44145 · state attached · log index 3563746656 · transparency-log entry
    • kind provenance · digest sha256:faf5d9691f306d7f318377a2db731aa843ef8ed23866e7c410cdbc001dda2c4b · state attached · log index 3563748778 · transparency-log entry
    • kind sbom · digest sha256:faf5d9691f306d7f318377a2db731aa843ef8ed23866e7c410cdbc001dda2c4b · state attached · log index 3563750387 · transparency-log entry
    • kind vsa · digest sha256:faf5d9691f306d7f318377a2db731aa843ef8ed23866e7c410cdbc001dda2c4b · state attached · log index 3563752841 · transparency-log entry
    (at 2026-10-29T09:26:00Z) [attestations.json, results]

Offline clean-room rebuilds

  • 2026-10-29T06:40:44Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:faf5d9691f306d7f318377a2db731aa843ef8ed23866e7c410cdbc001dda2c4b [clean-room rebuild ledger, runs[541]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
  • Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

Fully recorded
  • Image pushed (internal tag), publish_image passed2026-10-29T04:43:48Z [stage_runs, stage_runs chain 782 stage publish_image]
  • Release tag promoted2026-10-29T09:27:31Z (method imagetools_create_retag_by_digest_no_rebuild · digest sha256:2b014072549ccd0ee67a40fcb34c99b2694bf51d2a62356cb12a8e1ce6d44145 · tag readystack/coredns:v1.14.2-CE-ubuntu24.04-r1) [deliverables/provenance/PROMOTION_RECORD.json, promoted_at]
  • Archive manifests written2026-10-29T09:24:49Z [PUBLISH_MANIFEST.json, published_at]
  • Archive cut over on prodasset, package_archive passed2026-10-29T09:28:02Z [stage_runs, stage_runs chain 782 stage package_archive]
  • Cut-over markerpresent (chain 782) [.cutover.json]
  • Release checklist and site event2026-10-29T09:28:00Z (status complete · site event 272 · steps grade a verified done · release tag promoted done · cosign signed done · release evidence recorded done · contract gate passed done · archive published done · hub readme live done · reproducibility recorded done · defects ledger published done · catalog available done · build request fulfilled done · seo regenerated skipped · site catalogue refreshed done · site grade recorded done · site queue synced done · customer requests charged done · owners notified done) [deliverables/provenance/RELEASE_CHECKLIST.json, run_at]

Packages and CPU level

Fully recorded
  • Packages in the image192 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 57 · probed 2026-11-02T17:12:00Z · source backfill) [release_images, isa_level_hard]

History

2 events
  • 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records
  • 2026-11-03T00:52:44Z repack: previous sha256 9ef5cbc133fcbe04b9288ab673052096cc344c1e8ccd338ef7b1be91793ca309 · sha256 9102bee4b6baecd3a2775ddcc830c7ca3354b098b7f16ad1b29266daabf76fd3 · reason customer kit files brought up to the current engine: every pinned input's reason (docs/PINS.md, docs/provenance/PINS.json) and docs/PROVENANCE.md's section pointing at it, rendered by release/pin_reasons.py; docs/PROVENANCE.md's 'Build trail' section pointing at the signed build trail beside the archive (release/build_trail.py); not image inputs; image and every build input unchanged · label kitfix · replaced docs/PROVENANCE.md · added docs/PINS.md, docs/provenance/PINS.json · record MANIFEST.json repack_history

Records

26 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.tar.gz)—
.cutover.jsonbeside the archive (prodasset /data/production/coredns/v1.14.2-CE-ubuntu24.04-r1/)—
MANIFEST.jsonbeside the archive (prodasset /data/production/coredns/v1.14.2-CE-ubuntu24.04-r1/)—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/coredns/v1.14.2-CE-ubuntu24.04-r1/)—
ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/coredns/v1.14.2-CE-ubuntu24.04-r1/)—
ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/coredns/v1.14.2-CE-ubuntu24.04-r1/)—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/coredns/v1.14.2-CE-ubuntu24.04-r1/)—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)457
chainssadb, ReadyStack's engine database (not published)782
defectssadb, ReadyStack's engine database (not published)coredns v1.14.2-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 782
held_roundssadb, ReadyStack's engine database (not published)chain 782
image_scanssadb, ReadyStack's engine database (not published)1548
micro_step_runssadb, ReadyStack's engine database (not published)chain 782
release_imagessadb, ReadyStack's engine database (not published)coredns v1.14.2-CE-ubuntu24.04-r1
review_overridessadb, ReadyStack's engine database (not published)2
stage_eventssadb, ReadyStack's engine database (not published)chain 782
stage_runssadb, ReadyStack's engine database (not published)chain 782
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/RELEASE_CHECKLIST.jsonthe chain's workspace on the controller (not published)—