CoreDNS v1.14.2-CE-ubuntu24.04-r3 build trail
How ReadyStack built readystack/coredns:v1.14.2-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/coredns:v1.14.2-CE-ubuntu24.04-r3 - Index digestsha256:779e0b46eafb5f06d1b25ffb5c75d0d46c92a48faeb07c5936aa5c7b05d07d84
- linux/amd64 digestsha256:e24b6d98a5ad0c930ec01086ff265858838e12533559da1bea3e5709e21638bf
- Archive
ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.tar.gz - Archive SHA-256 nowf0c7e73fb9dc0935d991e75ff5eb5ad382e075d5230919abbf4a368d975d3428
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-10T07:26:07Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductCoreDNS (coredns) [MANIFEST.json]
- Release tagv1.14.2-CE-ubuntu24.04-r3 [MANIFEST.json]
- Imagereadystack/coredns:v1.14.2-CE-ubuntu24.04-r3 [MANIFEST.json]
- Image index digestsha256:779e0b46eafb5f06d1b25ffb5c75d0d46c92a48faeb07c5936aa5c7b05d07d84 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:e24b6d98a5ad0c930ec01086ff265858838e12533559da1bea3e5709e21638bf [ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.tar.gz (bytes 466101813) [MANIFEST.json]
- Archive sha256 at publishf0c7e73fb9dc0935d991e75ff5eb5ad382e075d5230919abbf4a368d975d3428 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/coredns/coredns [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv1.14.2 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commitdd1df4f5db93767a44e37638df44969503b320d2 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashf69cbed3da6f6a1dbbddc86418a6aae8588c6ecf4c604208b9eba41225f42670 (files 917) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:9e2d2345ba2fab98a2ead946f94dd82e023eeb4b1f276ac72b3a33070c42c58e [ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794290162 (utc 2026-11-10T05:56:02Z) [ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.rebuild.json, engine]
- Engine commit(s)
- commit e3eaace0a74e1a10fea82b44f3849ea9a0e2216a · dirty yes · first drive 4153
- commit 6fed961ca4c69b080b8235683aad09bec590f2c6 · dirty yes · first drive 4160
Why this release exists
Fully recorded- Chain946 (created 2026-11-10T06:16:53Z · trigger customer_request · upstream version v1.14.2) [chains, chains #946]
- Requestbuild request #626 (rebuild) (requested at 2026-11-10T06:02:14Z · requested by kitforge-agent · version v1.14.2) [build_requests, build_requests #626]
- Reasonrevision v1.14.2-CE-ubuntu24.04-r3: same upstream version re-dated by its own release (owner 2026-11-10 "date images correctly") [build_requests, build_requests #626 request_reason]
- Supersedesreadystack/coredns:v1.14.2-CE-ubuntu24.04-r2 (chain 841) [chains, chains #841]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 946 release · ready_to_ship
Created 2026-11-10T06:16:53Z, upstream v1.14.2, build request 626 [chains, chains #946]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4153 | 2026-11-10T06:17:15Z | 17.9 | build host 4 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4153] |
| 4160 | 2026-11-10T07:22:08Z | — | build host 4 publish-held | not recorded [drive_runs, drive_runs #4160] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-10T06:17:26Z | 2026-11-10T06:17:26Z | 1 | 4
|
order_json e1440c46d647… |
acquire |
2026-11-10T06:17:30Z | 2026-11-10T06:17:31Z | 1 | 12
|
source_tree 60dfd4e61987…license_file f0530760b1e2…custody_inputs 059e8d3f3ffe…source_tree_hash aecfaa5c3559…source_file_manifest 84cc5f6a1462… |
plan |
2026-11-10T06:18:06Z | 2026-11-10T06:18:07Z | 1 | 10
|
recon_report 0238e6552e4c…input_pin_plan 5eda2dd7c08c…toolchain_lock 2e6602da33cf… |
assemble_kit |
2026-11-10T06:23:44Z | 2026-11-10T06:23:45Z | 1 | 27
|
dockerfile cd46df0c1f76…build_recipe 5b028555fcec…system_pinning 01ba4719c80b…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health 96827b5b18ed…verify_offline_sh 3e8184ea230c…base_image_digests 660f9f9aac04…dockerfile_offline cd46df0c1f76…first_build_digest d765ce2f16da… |
remediate |
2026-11-10T06:24:19Z | 2026-11-10T06:24:20Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 088b28338273…security_report 0e0a05c00f0e… |
build_kit |
2026-11-10T06:28:23Z | 2026-11-10T06:28:24Z | 1 | 9
|
cosign_stamp c39df1641df3…locked_digest 9d06ef41c5a1…freeze_manifest 07983045832d…offline_rebuild_transcript bb6540a0fd7e… |
verdict |
2026-11-10T06:28:55Z | 2026-11-10T06:28:56Z | 1 | 8
|
scout_verdict 31eb72f6e518… |
publish_image |
2026-11-10T06:29:27Z | 2026-11-10T06:29:27Z | 1 | 7
|
hub_readme e88e9f48cd66…promotion_record cbff5d648bd1… |
boot_instance |
2026-11-10T06:29:34Z | 2026-11-10T06:29:39Z | 2 | 3
|
instance_handle 3d024fb1d68c… |
sbom |
2026-11-10T06:29:49Z | 2026-11-10T06:29:50Z | 1 | 5
|
sbom_md 3abfbaa3ad1c…sbom_json 89caf8c7f203… |
schema_discovery |
2026-11-10T06:29:52Z | 2026-11-10T06:29:53Z | 1 | 7
|
schema_hash 247b0dcbebf8…dependency_tree 678b1ee8a637…table_classification afe0b144fc77… |
admin_handbook |
2026-11-10T06:29:59Z | 2026-11-10T06:30:00Z | 1 | 7
|
api_map 1e6cea19a82d…admin_handbook 9a985c3ac324… |
db_handbook |
2026-11-10T06:30:09Z | 2026-11-10T06:30:10Z | 1 | 8
|
db_handbook 05ed46e415d7…seed_isolation b656e70350e5… |
seed_data |
2026-11-10T06:30:15Z | 2026-11-10T06:30:16Z | 1 | 6
|
seed_data_sql 0fa400569706…seed_cases_json 190608e21522… |
seed_validate |
2026-11-10T06:30:18Z | 2026-11-10T06:30:19Z | 1 | 3
|
seed_data_contract 097597132048… |
usecase_validate |
2026-11-10T06:30:29Z | 2026-11-10T06:30:30Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 71ca6a230ca6…test_results a33d488d1ecc…usecase_contract 459e622b670c… |
finalize_docs |
2026-11-10T06:30:36Z | 2026-11-10T06:30:37Z | 1 | 9
|
defects_json 45fe865add93…release_notes 53d78005dd1c…api_integration_guide 96e426f8409c… |
package_archive invalidated 2026-11-10T07:20:52Z |
2026-11-10T06:35:09Z | 2026-11-10T06:35:11Z | 1 | 35 (final gate PASS)
|
sale_tar c5139d770a67…checksums 3549b066d3f3…verify_md 5a36ef99acc2…rebuild_md c81a38982c5d…manifest_txt 2a214c20e9ea…actions_jsonl 67dabe4ad7d6…provenance_md 4fbf20b60351…assetchain_log_md e9eccaec0c0f…assetchain_log_json aefa4756bc79… |
[stage_runs]
Rewinds
- 2026-11-10T07:20:52Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30266]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-10T06:35:11Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 8511 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 8718 | L-A183, L-A15 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.25 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-10T06:35:51Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1686] | $0.25 | 3 rounds, $40.00 | c5139d770a67… |
Defects
Fully recorded- Ledger entries0 [defects, defects where product_slug=coredns and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
0 ledger entries.
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:e24b6d98a5ad0c930ec01086ff265858838e12533559da1bea3e5709e21638bf · published digest sha256:e24b6d98a5ad0c930ec01086ff265858838e12533559da1bea3e5709e21638bf · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 118) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-10T07:22:29Z · failing Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-10T07:22:18Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3780096971 · transparency-log entry
- log index 3780098216 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3781005334 · transparency-log entry · integrated 2026-11-10T07:24:58Z) [ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:779e0b46eafb5f06d1b25ffb5c75d0d46c92a48faeb07c5936aa5c7b05d07d84 · state attached · log index 3781007532 · transparency-log entry
- kind sbom · digest sha256:779e0b46eafb5f06d1b25ffb5c75d0d46c92a48faeb07c5936aa5c7b05d07d84 · state attached · log index 3781008813 · transparency-log entry
- kind vsa · digest sha256:779e0b46eafb5f06d1b25ffb5c75d0d46c92a48faeb07c5936aa5c7b05d07d84 · state attached · log index 3781010622 · transparency-log entry
- kind provenance · digest sha256:e24b6d98a5ad0c930ec01086ff265858838e12533559da1bea3e5709e21638bf · state attached · log index 3781011837 · transparency-log entry
- kind sbom · digest sha256:e24b6d98a5ad0c930ec01086ff265858838e12533559da1bea3e5709e21638bf · state attached · log index 3781013325 · transparency-log entry
- kind vsa · digest sha256:e24b6d98a5ad0c930ec01086ff265858838e12533559da1bea3e5709e21638bf · state attached · log index 3781014516 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/coredns/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-10T06:35:56Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:e24b6d98a5ad0c930ec01086ff265858838e12533559da1bea3e5709e21638bf [clean-room rebuild ledger, runs[718]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-10T06:29:27Z [stage_runs, stage_runs chain 946 stage publish_image]
- Archive manifests written2026-11-10T07:23:48Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 57 · probed 2026-11-10T06:26:10Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-10T07:26:07Z generated: by KitForge release/build_trail.py · generator commit 7dfd29d7f5001fb8fadf7d3fa0d9223cd56a6365
- 2026-11-10T07:27:23Z publication: promoted at 2026-11-10T07:26:40Z · promoted digest sha256:779e0b46eafb5f06d1b25ffb5c75d0d46c92a48faeb07c5936aa5c7b05d07d84 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 444 · checklist status complete · checklist at 2026-11-10T07:27:23Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/coredns/v1.14.2-CE-ubuntu24.04-r3/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/coredns/v1.14.2-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.rebuild.json | beside the archive (prodasset /data/production/coredns/v1.14.2-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-coredns-v1.14.2-CE-ubuntu24.04-r3.rebuild.json.sigstore | beside the archive (prodasset /data/production/coredns/v1.14.2-CE-ubuntu24.04-r3/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/coredns/v1.14.2-CE-ubuntu24.04-r3/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 626 |
chains | sadb, ReadyStack's engine database (not published) | 946 |
defects | sadb, ReadyStack's engine database (not published) | coredns v1.14.2-CE-ubuntu24.04-r3 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 946 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 946 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 946 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 946 |
release_images | sadb, ReadyStack's engine database (not published) | coredns v1.14.2-CE-ubuntu24.04-r3 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 946 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 946 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |