Apache CouchDB 3.5.3-CE-ubuntu24.04-r1 build trail
How ReadyStack built readystack/couchdb:3.5.3-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/couchdb:3.5.3-CE-ubuntu24.04-r1 - Index digestsha256:7dba6b330ff11cbb2b260d456ac0c671d165ed562a1cbec4f5ecc20c6be18b14
- linux/amd64 digestsha256:aae9bff0d7d1498b6861126cce244f0825e7fc0e79550c1e357da8ed79bbbdfa
- Archive
ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.tar.gz - Archive SHA-256 now6e8bc30d4ad1ad4f0e2ab4fd8692a71791de3e492b0f11f127faa64e871b1d51
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-13T19:26:04Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductApache CouchDB (couchdb) [MANIFEST.json]
- Release tag3.5.3-CE-ubuntu24.04-r1 [MANIFEST.json]
- Imagereadystack/couchdb:3.5.3-CE-ubuntu24.04-r1 [MANIFEST.json]
- Image index digestsha256:7dba6b330ff11cbb2b260d456ac0c671d165ed562a1cbec4f5ecc20c6be18b14 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:aae9bff0d7d1498b6861126cce244f0825e7fc0e79550c1e357da8ed79bbbdfa [ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.tar.gz (bytes 456132359) [MANIFEST.json]
- Archive sha256 at publish6e8bc30d4ad1ad4f0e2ab4fd8692a71791de3e492b0f11f127faa64e871b1d51 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/apache/couchdb [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream ref3.5.3 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit7a1f97558cea50d7e79604c3f0707d4adfad3708 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashbc80e8228ac6505f45587d14b5ab2e935dc5164e58db5a3694af9063e0cd747b (files 1514) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:a8df507d75642660052f2900fad1ad300fdebc6a820fe3d5fab5cbcb7ac65bbc [ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1791332599 (utc 2026-10-07T00:23:19Z) [ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.rebuild.json, engine]
- Engine commit(s)
- commit 08e7750179761633ff5b3cb629d68932b3db9c8f · dirty yes · first drive 4309
- commit 8c821307b9ef23ad6d52eb7d1945df7515176193 · dirty yes · first drive 4331
- commit 53328f4754ecefc18b308504e3b02f89c9062497 · dirty yes · first drive 4561
- commit 1762e17ee8e9761d80444e254bf92fa18d39ea4a · dirty yes · first drive 4586
- commit 7fdf9096d56f34040c780be3745f50315b7188f1 · dirty yes · first drive 4634
- commit dc101a328dcc26cc1247f63780ab431b4962fa1b · dirty yes · first drive 4635
- commit 9c4253a45dc7d7fe2c593c59f9319e84b043648a · dirty yes · first drive 4636
- commit 70d76fe4dccff54bdbc14c9b213eaca3adf009e4 · dirty yes · first drive 4639
Why this release exists
Fully recorded- Chain983 (created 2026-11-11T21:46:46Z · trigger customer_request · upstream version 3.5.3) [chains, chains #983]
- Requestbuild request #437 (new_product) (requested at 2026-10-28T00:01:35Z · requested by agent · version 3.5.3) [build_requests, build_requests #437]
- Reasonce.rodeo trending tier 1 (no free A/B image), owner 2026-10-27 'all apps queued' (docs/CATALOGUE_EXPANSION.md) [build_requests, build_requests #437 request_reason]
The path through the harness
Fully recorded2 chains · 11 drives · 18 stages · 6 rewinds
Chain 762 behind it · abandoned
Created 2026-10-28T09:34:45Z, completed 2026-11-11T21:45:54Z, upstream 3.5.3, build request 437 [chains, chains #762]
Abandoned: chain 762 abandoned [watch_queue, watch_queue #15494 resolution]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 485 | 2026-10-28T09:34:57Z | 28.2 | build host 2 withhold-publish | stage_failed at build_kit [drive_runs, drive_runs #485] rebuilt from a build line's log |
| 3473 | 2026-11-03T04:50:38Z | 15.5 | build host 2 withhold-publish | stage_failed at build_kit; first failed check exists:freeze_manifest; 1 tick [drive_runs, drive_runs #3473] |
| 4094 | 2026-11-09T18:46:35Z | 57 | build host 2 withhold-publish | stage_failed at package_archive; first failed check g8; 15 ticks [drive_runs, drive_runs #4094] |
Chain 983 release · ready_to_ship
Created 2026-11-11T21:46:46Z, upstream 3.5.3, build request 437 [chains, chains #983]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4309 | 2026-11-11T21:47:02Z | 59.9 | build host 2 withhold-publish | stage_failed at package_archive; first failed check g8; 18 ticks [drive_runs, drive_runs #4309] |
| 4331 | 2026-11-12T00:57:01Z | 14.9 | build host 2 withhold-publish | stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4331] |
| 4561 | 2026-11-13T10:58:16Z | 42.6 | build host 2 withhold-publish | ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #4561] |
| 4586 | 2026-11-13T13:52:04Z | 5.2 | build host 2 withhold-publish | ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4586] |
| 4634 | 2026-11-13T17:44:33Z | 5.3 | build host 2 withhold-publish | ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4634] |
| 4635 | 2026-11-13T18:15:53Z | 5.3 | build host 2 withhold-publish | ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4635] |
| 4636 | 2026-11-13T18:49:04Z | 5.1 | build host 2 withhold-publish | ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4636] |
| 4639 | 2026-11-13T19:18:24Z | — | build host 2 publish-held | not recorded [drive_runs, drive_runs #4639] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-11T21:47:12Z | 2026-11-11T21:47:13Z | 1 | 4
|
order_json 0782d6dd341f… |
acquire |
2026-11-11T21:47:18Z | 2026-11-11T21:47:19Z | 1 | 12
|
source_tree 67dfa2d7898d…license_file 72dfae157734…custody_inputs f5d3611e8e59…source_tree_hash 672101c4c348…source_file_manifest eef7f62bab5e… |
plan |
2026-11-11T21:47:57Z | 2026-11-11T21:47:57Z | 1 | 10
|
recon_report 44d47ed2cfaf…input_pin_plan f73d4c36af5c…toolchain_lock eee4d3cbabb5… |
assemble_kit |
2026-11-11T21:56:11Z | 2026-11-13T11:06:38Z | 2 | 27
|
dockerfile 58eb2d563396…build_recipe ad5f09ec533d…system_pinning e440cf3bd377…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health 3e6d94bb7f80…verify_offline_sh 3e8184ea230c…base_image_digests 431540d66f80…dockerfile_offline 58eb2d563396…first_build_digest 89499821fba5… |
remediate |
2026-11-11T21:57:15Z | 2026-11-13T11:06:42Z | 2 | 8
|
vendored_apt e3b0c44298fc…remediation_log ebcf1d5e1fdd…security_report 9035f094bba2… |
build_kit |
2026-11-11T22:11:48Z | 2026-11-13T11:21:08Z | 2 | 9
|
cosign_stamp f2b6a81a0b7c…locked_digest 078d7ae6e0f6…freeze_manifest e115871cbb01…offline_rebuild_transcript 9c17a444d470… |
verdict |
2026-11-11T22:17:13Z | 2026-11-13T11:26:25Z | 2 | 8
|
scout_verdict ddcf6f036d70… |
publish_image |
2026-11-11T22:17:59Z | 2026-11-13T11:27:15Z | 2 | 7
|
hub_readme c707bcd7bfc6…promotion_record bdc7f5f67ea9… |
boot_instance |
2026-11-11T22:18:11Z | 2026-11-13T11:27:29Z | 4 | 3
|
instance_handle 2b36f8ee1b83… |
sbom |
2026-11-11T22:18:31Z | 2026-11-13T11:27:46Z | 2 | 5
|
sbom_md be86adb7485d…sbom_json c3e4b24cdb46… |
schema_discovery |
2026-11-11T22:18:35Z | 2026-11-13T11:27:50Z | 2 | 7
|
schema_hash a6b36283b9c7…dependency_tree 8c4f8c51beea…table_classification d4ac6e48717d… |
admin_handbook |
2026-11-11T22:24:32Z | 2026-11-13T11:27:57Z | 2 | 7
|
api_map 8f1449e2f045…admin_handbook 0c0b0e5cec5f… |
db_handbook |
2026-11-11T22:27:47Z | 2026-11-13T11:28:06Z | 2 | 8
|
db_handbook 3ca3d3ac2526…seed_isolation 472c7851f880… |
seed_data |
2026-11-11T22:27:59Z | 2026-11-13T11:28:19Z | 2 | 6
|
seed_data_sql ec99d6b518a8…seed_cases_json 45a2920cafb9… |
seed_validate |
2026-11-11T22:28:03Z | 2026-11-13T11:28:22Z | 2 | 3
|
seed_data_contract 640e96971a2b… |
usecase_validate |
2026-11-11T22:28:29Z | 2026-11-13T11:28:39Z | 2 | 10
|
failed_tests b2247b16f5f7…passed_tests 3e7d6485831c…test_results 85432ce0715f…usecase_contract d75b2aec3634… |
finalize_docs |
2026-11-11T22:32:22Z | 2026-11-13T11:28:45Z | 2 | 9
|
defects_json 422e7c898ff0…release_notes 5d9601a21998…api_integration_guide 4eb3c5bc1f07… |
package_archive invalidated 2026-11-13T19:17:59Z |
2026-11-11T22:46:55Z | 2026-11-13T18:54:07Z | 7 | 37 (final gate PASS)
|
sale_tar 73340cd45f41…checksums 4985e99315e5…verify_md c8a1e1d123da…rebuild_md dcf55b079928…manifest_txt 968d1997ae82…actions_jsonl dbe2fcd46026…provenance_md 867a63a3681e…assetchain_log_md e9eccaec0c0f…assetchain_log_json 7043318dde5b… |
[stage_runs]
Rewinds
- 2026-11-13T10:58:24Z:
package_archivetoassemble_kiton strategy_changed (strategy changed (39c49a5c1bf9 -> 9698965a45dd)) [stage_events, stage_events #35672] - 2026-11-13T12:16:00Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #35892] - 2026-11-13T14:25:52Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36243] - 2026-11-13T18:14:27Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36893] - 2026-11-13T18:47:39Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36897] - 2026-11-13T19:17:59Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36908]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-13T18:54:07Z.
76 calls over 6 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 7760 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 12411 | L-A08, L-038, L-036, L-034, L-032 |
admin_handbook | 27 | 10 | 0 | 3 | 2 | 101365 | — |
db_handbook | 20 | 0 | 0 | 1 | 0 | 73660 | — |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 2038 | — |
finalize_docs | 24 | 1 | 0 | 2 | 0 | 91835 | — |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
5 rounds, 5 counted, $9.05 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-13T11:41:49Z | 1 | 21 | 29 | findings to repackage [held_rounds, held_rounds #1871] | $2.21 | 3 rounds, $40.00 | 46df07b2a32e… |
| 2 | 2026-11-13T13:57:54Z | 0 | 14 | 14 | findings to repackage [held_rounds, held_rounds #1883] | $1.87 | 3 rounds, $40.00 | 53abda06866d… |
| 3 | 2026-11-13T17:50:36Z | 0 | 1 | 17 | findings to repackage [held_rounds, held_rounds #1905] | $1.81 | 3 rounds, $40.00 | 8987377eedc8… |
| 4 | 2026-11-13T18:21:57Z | 0 | 4 | 7 | findings to repackage [held_rounds, held_rounds #1906] | $1.80 | 3 rounds, $40.00 | ed8b66b7a668… |
| 5 | 2026-11-13T18:54:50Z | 0 | 0 | 5 | clean to publish [held_rounds, held_rounds #1907] | $1.36 | 3 rounds, $40.00 | 73340cd45f41… |
Defects
Fully recorded- Ledger entries105 [defects, defects where product_slug=couchdb and this tag or chain]
- Disclosed in the archive105 [docs/defects/defects.json, entries]
105 ledger entries: by severity critical 1, high 37, low 67; by status fixed-before-release 104, open 1.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-couchdb-83dca156c4Admin handbook: The documented backup produces root-owned files and the handbook has no ownership step or restore procedure; the restored volume does not start. [defects, defects #280189] | critical | fixed-before-release | held review (review model) | — |
RSD-couchdb-c2596d7798Database handbook: Restore text omits that restored files must be owned by uid 5984. [defects, defects #280190] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-3e0a255320Admin handbook: Contradicts measured behaviour and the Operating facts section. [defects, defects #280191] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-dc7bff55e9Admin handbook: The hash is of the same password, so nothing is 'refused'; hides that the env file is applied again on re-creation without a local.d volume. [defects, defects #280192] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-d5e9225077Database handbook: The documented run command always passes the env file and mounts no local.d, so 'will not override' is false for it. [defects, defects #280193] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-dd1d0dea37Admin handbook: False security statement. [defects, defects #280194] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-b1f6a33c78API guide: False security statement. [defects, defects #280195] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-4b1305cdb1Database handbook: False security statement. [defects, defects #280196] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-c9d3739b25API guide: The env file always contains the plaintext and is read again on re-creation. [defects, defects #280197] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-3354ff897bAPI guide: False: the documented command has no local.d volume; the reset is lost on re-create (measured). [defects, defects #280198] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-a8757466d5API guide: The entrypoint checks on every start. [defects, defects #280199] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-6d5f8cd726API guide: Wrong when the file is lost. [defects, defects #280200] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-30c22a85a7Database handbook: Self-contradictory instruction for a forgotten password. [defects, defects #280201] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-47eac2af6dAdmin handbook: Self-contradictory. [defects, defects #280202] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-53a1dbd9f3Admin handbook: Fact titled 'forgotten password' only gives a reset that needs the password. [defects, defects #280203] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-c2a5ac997bAPI guide: Self-contradictory. [defects, defects #280204] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-939271d0f1API guide: Needs the password. [defects, defects #280205] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-c104aa1358API guide: Self-contradictory. [defects, defects #280206] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-03536a6babAPI guide: Self-contradictory. [defects, defects #280207] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-a8fcc43345Database handbook: 9100 is not a metrics endpoint. [defects, defects #280208] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-339343d64fAdmin handbook: 9100 does not serve metrics. [defects, defects #280209] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-34ccec7e7fAdmin handbook: Same. [defects, defects #280210] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-cc2c6dc43bAdmin handbook: Replication uses 5984. [defects, defects #280211] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-e6cdbc8a54API guide: Same. [defects, defects #280212] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-7c26efbdd9API guide: Unsupported claim. [defects, defects #280213] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-08f80a0149API guide: Same. [defects, defects #280214] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-70444dea26API guide: Clustering procedure omits the variables that make a cluster possible and attributes node authentication to COUCHDB_SECRET. [defects, defects #280215] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-8084b09a0aAPI guide: Unsupported cause of cluster failure. [defects, defects #280216] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-053ff117c2Admin handbook: Contradicts the release notes; publishing the ports without a cookie is unsafe. [defects, defects #280217] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-8f1aa041dfAdmin handbook: Wrong file. [defects, defects #280218] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-fa2f11a9b7API guide: Documented method fails. [defects, defects #280219] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-3bbe3662dbAPI guide: Wrong method/credentials. [defects, defects #280220] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-1b0de9a8caDatabase handbook: Not created automatically. [defects, defects #280221] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-cb511b1e47Database handbook: Three required is wrong. [defects, defects #280222] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-537ea0956fDatabase handbook: Not per start. [defects, defects #280223] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-c240b2b6f2Admin handbook: Overstated. [defects, defects #280224] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-4caf72a6f3API guide: Contradicts the Health Check paragraph below it. [defects, defects #280225] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-789338c85eAPI guide: Overstated. [defects, defects #280226] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-795af23c81Database handbook: Overstated. [defects, defects #280227] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-88e922e90cAdmin handbook: Following command lacks -it. [defects, defects #280228] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-61b1aff469Admin handbook: No TTY/stdin. [defects, defects #280229] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-f0ee105682Admin handbook: local.ini not written. [defects, defects #280230] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-8187cf3f64API guide: local.ini not written. [defects, defects #280231] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-694e714e49Admin handbook: Contradicts line 588. [defects, defects #280232] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-d43862c266Database handbook: Entrypoint execs. [defects, defects #280233] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-3398d70623Admin handbook: Wrong stream. [defects, defects #280234] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-b3064e1f2eDatabase handbook: Wrong stream. [defects, defects #280235] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-f2e329b9d3API guide: Wrong stream. [defects, defects #280236] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-26b4469b35Database handbook: Contradicts the sections that say standard output. [defects, defects #280237] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-59413a3117Admin handbook: Ran the image with -v <host local.ini>:/opt/couchdb/etc/local.ini, then PUT /_node/_local/_config/couchdb/max_document_size: grep showed 'local.d/docker.ini:6:max_document_size = 1234567' while the… [defects, defects #282647] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-f4cd78c273Admin handbook: Ran the image with -v <host local.ini>:/opt/couchdb/etc/local.ini, then PUT /_node/_local/_config/couchdb/max_document_size: grep showed 'local.d/docker.ini:6:max_document_size = 1234567' while the… [defects, defects #282648] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-01e8c86245Admin handbook: Ran the image with -v <host local.ini>:/opt/couchdb/etc/local.ini, then PUT /_node/_local/_config/couchdb/max_document_size: grep showed 'local.d/docker.ini:6:max_document_size = 1234567' while the… [defects, defects #282649] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-555a903059Admin handbook: Ran the image with -v <host local.ini>:/opt/couchdb/etc/local.ini, then PUT /_node/_local/_config/couchdb/max_document_size: grep showed 'local.d/docker.ini:6:max_document_size = 1234567' while the… [defects, defects #282650] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-1f866f8611Admin handbook: Ran the image with -v <host local.ini>:/opt/couchdb/etc/local.ini, then PUT /_node/_local/_config/couchdb/max_document_size: grep showed 'local.d/docker.ini:6:max_document_size = 1234567' while the… [defects, defects #282651] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-3ae04a51ffAdmin handbook: Ran the image with -v <host local.ini>:/opt/couchdb/etc/local.ini, then PUT /_node/_local/_config/couchdb/max_document_size: grep showed 'local.d/docker.ini:6:max_document_size = 1234567' while the… [defects, defects #282652] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-daff4dc9aeDatabase handbook: Ran the image with -v <host local.ini>:/opt/couchdb/etc/local.ini, then PUT /_node/_local/_config/couchdb/max_document_size: grep showed 'local.d/docker.ini:6:max_document_size = 1234567' while the… [defects, defects #282653] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-fecf53fab0Database handbook: Ran the image with -v <host local.ini>:/opt/couchdb/etc/local.ini, then PUT /_node/_local/_config/couchdb/max_document_size: grep showed 'local.d/docker.ini:6:max_document_size = 1234567' while the… [defects, defects #282654] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-50cc1daa10Database handbook: Ran the image with -v <host local.ini>:/opt/couchdb/etc/local.ini, then PUT /_node/_local/_config/couchdb/max_document_size: grep showed 'local.d/docker.ini:6:max_document_size = 1234567' while the… [defects, defects #282655] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-f8b8ea07ffAPI guide: Ran the image with -v <host local.ini>:/opt/couchdb/etc/local.ini, then PUT /_node/_local/_config/couchdb/max_document_size: grep showed 'local.d/docker.ini:6:max_document_size = 1234567' while the… [defects, defects #282656] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-39cdd2ca4bAPI guide: Ran the image with -v <host local.ini>:/opt/couchdb/etc/local.ini, then PUT /_node/_local/_config/couchdb/max_document_size: grep showed 'local.d/docker.ini:6:max_document_size = 1234567' while the… [defects, defects #282657] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-33ecdf54fcAPI guide: Ran the image with -v <host local.ini>:/opt/couchdb/etc/local.ini, then PUT /_node/_local/_config/couchdb/max_document_size: grep showed 'local.d/docker.ini:6:max_document_size = 1234567' while the… [defects, defects #282658] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-88bfb41d4eAdmin handbook: Ran an env file without COUCHDB_USER/PASSWORD on a container whose /opt/couchdb/etc/local.d volume already held the admin: it started healthy and 'admin:my new pass $x!' logged in (200). [defects, defects #282659] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-87fa2fdc90Admin handbook: Ran an env file without COUCHDB_USER/PASSWORD on a container whose /opt/couchdb/etc/local.d volume already held the admin: it started healthy and 'admin:my new pass $x!' logged in (200). [defects, defects #282660] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-e400268956API guide: Ran an env file without COUCHDB_USER/PASSWORD on a container whose /opt/couchdb/etc/local.d volume already held the admin: it started healthy and 'admin:my new pass $x!' logged in (200). [defects, defects #282661] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-0e78c082edDatabase handbook: Ran an env file without COUCHDB_USER/PASSWORD on a container whose /opt/couchdb/etc/local.d volume already held the admin: it started healthy and 'admin:my new pass $x!' logged in (200). [defects, defects #282662] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-bb116fd4beAdmin handbook: docker exec on the running documented container: awk over /proc/net/tcp state 0A listed only 00000000:1760 (5984); /proc/net/tcp6 empty; GET /_membership = nonode@nohost. [defects, defects #282663] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-63f3c8abbaDatabase handbook: docker exec on the running documented container: awk over /proc/net/tcp state 0A listed only 00000000:1760 (5984); /proc/net/tcp6 empty; GET /_membership = nonode@nohost. [defects, defects #282664] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-f33cd29b3cAdmin handbook: RELEASE_NOTES.md 'Before exposing this service' and SECURITY_REPORT.md: 'publish them only between cluster nodes, with COUCHDB_ERLANG_COOKIE set to a shared secret'. [defects, defects #282665] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-477ef3ac30Database handbook: Documented container, 25 s after start: docker logs (stderr) holds 'notice ... [defects, defects #282666] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-632e400a10Admin handbook: Ran 'docker run --entrypoint /bin/bash <image>' without -it: bash read EOF and exited at once (rc=0) with no shell. [defects, defects #282667] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-93d0b2785cAdmin handbook: docker logs split: stdout 0 lines, stderr 85 lines; no log file under /opt/couchdb (log writer is stderr). [defects, defects #282668] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-8d3bd4778eAPI guide: Contradicts the next sentence and API guide line 685/755 and admin line 643. [defects, defects #282669] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-218478fd3aAPI guide: docker run --rm <image> echo hello printed 'hello' (CouchDB did not start); docker-entrypoint.sh ends with exec "$@". [defects, defects #282670] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-f7415e2997API guide: Fresh documented container: GET /rs-demo returned {"error":"not_found"}; test-results.json shows rs-demo was created by the build's own test setup. [defects, defects #282671] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-ddf76a2f38Docker Hub README: Re-created the documented run command (data volume only) with an env file lacking COUCHDB_PASSWORD: container exited 1 with the Admin Party error. [defects, defects #282672] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-1ec53078b0Admin handbook: The documented backup command has a fixed target directory; repeating it (a backup routine) nests the new copy in data/ and the documented restore silently restores the first, stale backup. [defects, defects #288010] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-b23774a307Admin handbook: Restore sentence refers to the fixed couchdb-data-backup directory that the backup sentence should not reuse. [defects, defects #288011] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-0367fb0fc4Docker Hub README: README sentence tells the customer to remove first-start passwords after setup, which is wrong for the documented run command; the handbooks say to keep the file. [defects, defects #288012] | low | open | held review (review model) | — |
RSD-couchdb-b2f828ade8Admin handbook: Contradicts line 287: on a default node only 5984 is bound. [defects, defects #288013] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-def022713fDatabase handbook: Blanket statement contradicts the API behaviour stated in the other guides. [defects, defects #288014] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-e1db42815aDatabase handbook: 'Start it with the new password' cannot be done with docker start; the container must be re-created. [defects, defects #288015] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-87ccc7cef8Admin handbook: Same as DB handbook 416: a plain start keeps the old COUCHDB_PASSWORD. [defects, defects #288016] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-a19c84da1fAdmin handbook: Same: needs a re-created container. [defects, defects #288017] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-6c57ad65d5API guide: Same: needs a re-created container. [defects, defects #288018] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-c03562ae86Database handbook: GET / does not list databases. [defects, defects #288019] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-c0fac37217API guide: Lists system-database endpoints as configuration endpoints. [defects, defects #288020] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-36a16b3a81API guide: PUT /_users creates the database; it does not create or update user documents. [defects, defects #288021] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-c301e98f98Admin handbook: Circular and incomplete: the arguments replace the default command. [defects, defects #288022] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-d2460d7258Admin handbook: Absolute statement contradicts lines 102/224 (an existing [admins] entry is enough). [defects, defects #288023] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-6eac541534API guide: Absolute statement contradicts API guide line 117/276. [defects, defects #288024] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-b14d181915Admin handbook: 'Applies at once' is not what was measured: the new password is rejected for about a second. [defects, defects #288025] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-0557772cd6API guide: Same as admin handbook 166. [defects, defects #288026] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-019965983aDatabase handbook: Measured on the release image: with SpiderMonkey view processes already running (a view had been queried), PUT /_node/_local/_config/couchdb/js_engine "quickjs" returned 200 and the next query of a… [defects, defects #288211] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-a98d4fd530Admin handbook: Measured on the release image: with SpiderMonkey view processes already running (a view had been queried), PUT /_node/_local/_config/couchdb/js_engine "quickjs" returned 200 and the next query of a… [defects, defects #288212] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-d3d09bb8a4API guide: Measured on the release image: with SpiderMonkey view processes already running (a view had been queried), PUT /_node/_local/_config/couchdb/js_engine "quickjs" returned 200 and the next query of a… [defects, defects #288213] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-d503a98409API guide: Measured on the release image: with SpiderMonkey view processes already running (a view had been queried), PUT /_node/_local/_config/couchdb/js_engine "quickjs" returned 200 and the next query of a… [defects, defects #288214] | high | fixed-before-release | held review (review model) | — |
RSD-couchdb-7b461693a6Admin handbook: Fresh container: 6 requests with a wrong password for admin from 127.0.0.1 -> 401 x4, then 403 'Account is temporarily locked...'; the correct password also returned 403 immediately, 20 s and 65 s… [defects, defects #288215] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-ca8a311090Database handbook: Fauxton bundle in the image: the setup addon only adds the header link {title:'Setup',href:'#/setup'}, no redirect on first access; POST /_cluster_setup {action:enable_single_node} then GET… [defects, defects #288216] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-f1dc2d69c2Database handbook: IMAGE_CONFIG.json ExposedPorts 4369/5984/9100; none is a privileged port, so the sysctl is not the reason (the sysctl is 0 in the container, but irrelevant to these ports). [defects, defects #288217] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-53678926ddAdmin handbook: Same as DB handbook 140: ports 5984, 4369, 9100 are unprivileged. [defects, defects #288218] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-81931149c8API guide: docker-entrypoint.sh: `touch /opt/couchdb/etc/local.d/docker.ini` runs unconditionally before the [admins] check; engine change not immediate (see the major findings above). [defects, defects #288219] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-734e57f575Admin handbook: Sentence says the variables are ignored whenever an admin is already defined in a mounted .ini; they are ignored only for the same user name. [defects, defects #288422] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-78b5c119a3Admin handbook: 'Applies changes immediately' contradicts the 'about a second later' wording and the restart requirement for the JavaScript engine elsewhere in the same handbook. [defects, defects #288423] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-9c65ac4383API guide: Line 755 presents the configuration API as an alternative to a restart; line 757 and 685 say the restart is needed. [defects, defects #288424] | low | fixed-before-release | held review (review model) | — |
RSD-couchdb-c881ef3b9fAPI guide: Unsupported, irrelevant platform claim left over in the API guide (round-4 minor not applied here). [defects, defects #288425] | low | fixed-before-release | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:aae9bff0d7d1498b6861126cce244f0825e7fc0e79550c1e357da8ed79bbbdfa · published digest sha256:aae9bff0d7d1498b6861126cce244f0825e7fc0e79550c1e357da8ed79bbbdfa · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 413) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T19:18:48Z · failing Docker Scout counts 98 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T19:18:34Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3852930500 · transparency-log entry
- log index 3852932824 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3860832798 · transparency-log entry · integrated 2026-11-13T19:23:42Z) [ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:7dba6b330ff11cbb2b260d456ac0c671d165ed562a1cbec4f5ecc20c6be18b14 · state attached · log index 3860834977 · transparency-log entry
- kind sbom · digest sha256:7dba6b330ff11cbb2b260d456ac0c671d165ed562a1cbec4f5ecc20c6be18b14 · state attached · log index 3860837030 · transparency-log entry
- kind vsa · digest sha256:7dba6b330ff11cbb2b260d456ac0c671d165ed562a1cbec4f5ecc20c6be18b14 · state attached · log index 3860839272 · transparency-log entry
- kind provenance · digest sha256:aae9bff0d7d1498b6861126cce244f0825e7fc0e79550c1e357da8ed79bbbdfa · state attached · log index 3860841498 · transparency-log entry
- kind sbom · digest sha256:aae9bff0d7d1498b6861126cce244f0825e7fc0e79550c1e357da8ed79bbbdfa · state attached · log index 3860843000 · transparency-log entry
- kind vsa · digest sha256:aae9bff0d7d1498b6861126cce244f0825e7fc0e79550c1e357da8ed79bbbdfa · state attached · log index 3860844902 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/couchdb/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-13T11:41:53Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:aae9bff0d7d1498b6861126cce244f0825e7fc0e79550c1e357da8ed79bbbdfa [clean-room rebuild ledger, runs[828]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-13T11:27:15Z [stage_runs, stage_runs chain 983 stage publish_image]
- Archive manifests written2026-11-13T19:21:53Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 784 · probed 2026-11-11T22:04:39Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-13T19:26:04Z generated: by KitForge release/build_trail.py · generator commit 70d76fe4dccff54bdbc14c9b213eaca3adf009e4
- 2026-11-13T19:27:40Z publication: promoted at 2026-11-13T19:26:44Z · promoted digest sha256:7dba6b330ff11cbb2b260d456ac0c671d165ed562a1cbec4f5ecc20c6be18b14 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 563 · checklist status complete · checklist at 2026-11-13T19:27:40Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
26 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/couchdb/3.5.3-CE-ubuntu24.04-r1/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/couchdb/3.5.3-CE-ubuntu24.04-r1/), as staged for publishing | — |
ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.rebuild.json | beside the archive (prodasset /data/production/couchdb/3.5.3-CE-ubuntu24.04-r1/), as staged for publishing | — |
ReadyStack-couchdb-3.5.3-CE-ubuntu24.04-r1.rebuild.json.sigstore | beside the archive (prodasset /data/production/couchdb/3.5.3-CE-ubuntu24.04-r1/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/couchdb/3.5.3-CE-ubuntu24.04-r1/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 437 |
chains | sadb, ReadyStack's engine database (not published) | 762, 983 |
defects | sadb, ReadyStack's engine database (not published) | couchdb 3.5.3-CE-ubuntu24.04-r1 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 762, chain 983 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 983 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 983 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 983 |
release_images | sadb, ReadyStack's engine database (not published) | couchdb 3.5.3-CE-ubuntu24.04-r1 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 983 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 983 |
watch_queue | sadb, ReadyStack's engine database (not published) | 15494 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |