Drupal 11.4.12-CE-ubuntu24.04-r2 build trail
How ReadyStack built readystack/drupal:11.4.12-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/drupal:11.4.12-CE-ubuntu24.04-r2 - Index digestsha256:1bbfeaa8f03f8755b973eec39e7f818a92d3b25865e990855843abcafcdcefb5
- linux/amd64 digestsha256:0e0eece183199818bcaf607a52887d5b29621140c4b9294c25f35048d3b0c4d8
- Archive
ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.tar.gz - Archive SHA-256 now8a3a0de7eeb3075f4ffabbc2c671dc1a7bf70eea0c1fc05440d1efba47372e67
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-13T00:08:08Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductDrupal (drupal) [MANIFEST.json]
- Release tag11.4.12-CE-ubuntu24.04-r2 [MANIFEST.json]
- Imagereadystack/drupal:11.4.12-CE-ubuntu24.04-r2 [MANIFEST.json]
- Image index digestsha256:1bbfeaa8f03f8755b973eec39e7f818a92d3b25865e990855843abcafcdcefb5 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:0e0eece183199818bcaf607a52887d5b29621140c4b9294c25f35048d3b0c4d8 [ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.tar.gz (bytes 203367800) [MANIFEST.json]
- Archive sha256 at publish8a3a0de7eeb3075f4ffabbc2c671dc1a7bf70eea0c1fc05440d1efba47372e67 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/drupal/recommended-project [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream ref11.4.12 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit87ad3768f06a35bf27920d4bef277e2e3003f2d4 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashe44288fed4cc8f7380266fa9f98c765a4dba7a944569bb7116f16c55cafb83bb (files 3) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:39d707c7678269eca63d93526f043cc913d68505b1c3b78d43158c90423f755d [ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794451797 (utc 2026-11-12T02:49:57Z) [ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.rebuild.json, engine]
- Engine commit(s)
- commit f90b852f37265087900c9acdca31849ac5b61408 · dirty yes · first drive 4502
Why this release exists
Fully recorded- Chain1045 (created 2026-11-12T22:50:25Z · trigger customer_request · upstream version 11.4.12) [chains, chains #1045]
- Requestbuild request #724 (rebuild) (requested at 2026-11-12T02:49:58Z · requested by kitforge-agent · version 11.4.12) [build_requests, build_requests #724]
- Reasonrevision 11.4.12-CE-ubuntu24.04-r2: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #724 request_reason]
- Supersedesreadystack/drupal:11.4.12-CE-ubuntu24.04-r1 (chain 977) [chains, chains #977]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1045 release · ready_to_ship
Created 2026-11-12T22:50:25Z, upstream 11.4.12, build request 724 [chains, chains #1045]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4502 | 2026-11-12T22:50:48Z | 20.1 | build host 1 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4502] |
| 4512 | 2026-11-13T00:02:41Z | — | build host 1 publish-held | not recorded [drive_runs, drive_runs #4512] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-12T22:50:58Z | 2026-11-12T22:50:59Z | 1 | 4
|
order_json 2f6c4b4fffc9… |
acquire |
2026-11-12T22:51:03Z | 2026-11-12T22:51:04Z | 1 | 12
|
source_tree 8ae8cfc85e56…license_file 87d7c32e09f9…custody_inputs ede1c9750b2a…source_tree_hash 56a0cdb65464…source_file_manifest 7b454c25b997… |
plan |
2026-11-12T22:51:38Z | 2026-11-12T22:51:38Z | 1 | 10
|
recon_report 18132cea1e05…input_pin_plan e89eae01e439…toolchain_lock af342d657202… |
assemble_kit |
2026-11-12T22:55:29Z | 2026-11-12T22:55:30Z | 1 | 27
|
dockerfile e968a6ed77af…build_recipe 78551718c4d6…system_pinning 8ac48ab14748…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health 779f8b0a0d97…verify_offline_sh 3e8184ea230c…base_image_digests 0633357c2a2e…dockerfile_offline e968a6ed77af…first_build_digest b0e0adc0829d… |
remediate |
2026-11-12T22:56:03Z | 2026-11-12T22:56:04Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 6aa6b89bd615…security_report 02cf01afb191… |
build_kit |
2026-11-12T23:01:24Z | 2026-11-12T23:01:26Z | 1 | 9
|
cosign_stamp a12ffaf4a3f8…locked_digest 7619e4aff9e1…freeze_manifest d2619bf93392…offline_rebuild_transcript a7bd84f19f9c… |
verdict |
2026-11-12T23:02:31Z | 2026-11-12T23:02:31Z | 1 | 8
|
scout_verdict 15ba22a20700… |
publish_image |
2026-11-12T23:03:13Z | 2026-11-12T23:03:14Z | 1 | 7
|
hub_readme 9cc2b9de7603…promotion_record c905eb3eda94… |
boot_instance |
2026-11-12T23:03:25Z | 2026-11-12T23:03:29Z | 2 | 3
|
instance_handle d763b0fc59e2… |
sbom |
2026-11-12T23:03:45Z | 2026-11-12T23:03:46Z | 1 | 5
|
sbom_md df0cc60c45dd…sbom_json c908f2a26f59… |
schema_discovery |
2026-11-12T23:03:49Z | 2026-11-12T23:03:50Z | 1 | 7
|
schema_hash 9b29910985ea…dependency_tree d01b24581949…table_classification 41787065d263… |
admin_handbook |
2026-11-12T23:04:00Z | 2026-11-12T23:04:00Z | 1 | 7
|
api_map 865191274d3a…admin_handbook 1fdf7740fd5c… |
db_handbook |
2026-11-12T23:04:12Z | 2026-11-12T23:04:13Z | 1 | 8
|
db_handbook 29ccfc22e522…seed_isolation 1d7a0f92fa1d… |
seed_data |
2026-11-12T23:04:22Z | 2026-11-12T23:04:22Z | 1 | 6
|
seed_data_sql e356ef7f6704…seed_cases_json 02cc36d9756d… |
seed_validate |
2026-11-12T23:04:25Z | 2026-11-12T23:04:26Z | 1 | 3
|
seed_data_contract ed67276aed25… |
usecase_validate |
2026-11-12T23:04:48Z | 2026-11-12T23:04:49Z | 1 | 10
|
failed_tests d1ec6470ab5a…passed_tests 96f2e99c3d27…test_results 9402dfef9e6c…usecase_contract 71e8d22e5aba… |
finalize_docs |
2026-11-12T23:04:55Z | 2026-11-12T23:04:55Z | 1 | 9
|
defects_json 9c041a1501ef…release_notes a20023871673…api_integration_guide 2c051eb0de9b… |
package_archive invalidated 2026-11-13T00:00:35Z |
2026-11-12T23:10:51Z | 2026-11-12T23:10:53Z | 1 | 37 (final gate PASS)
|
sale_tar 446dc32f1f21…checksums 7ad8204c227b…verify_md 4b1532ef2e83…rebuild_md 5d537e1813e6…manifest_txt a0e490980426…actions_jsonl 70ac3d696b3e…provenance_md 1a7434c3f258…assetchain_log_md e9eccaec0c0f…assetchain_log_json c44adccc823a… |
[stage_runs]
Rewinds
- 2026-11-13T00:00:35Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #34983]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-12T23:10:53Z.
5 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 8043 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 10731 | L-A08, L-038, L-036, L-034, L-032 |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 1859 | — |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.32 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-12T23:11:46Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1843] | $0.32 | 3 rounds, $40.00 | 446dc32f1f21… |
Defects
Fully recorded- Ledger entries0 [defects, defects where product_slug=drupal and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
0 ledger entries.
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:0e0eece183199818bcaf607a52887d5b29621140c4b9294c25f35048d3b0c4d8 · published digest sha256:0e0eece183199818bcaf607a52887d5b29621140c4b9294c25f35048d3b0c4d8 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 127) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T00:03:12Z · failing Docker Scout counts 143 packages with copyleft licences (GPL, LGPL, MPL), 138 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T00:02:52Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3840885624 · transparency-log entry
- log index 3840886317 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3841637493 · transparency-log entry · integrated 2026-11-13T00:06:37Z) [ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:1bbfeaa8f03f8755b973eec39e7f818a92d3b25865e990855843abcafcdcefb5 · state attached · log index 3841639960 · transparency-log entry
- kind sbom · digest sha256:1bbfeaa8f03f8755b973eec39e7f818a92d3b25865e990855843abcafcdcefb5 · state attached · log index 3841642877 · transparency-log entry
- kind vsa · digest sha256:1bbfeaa8f03f8755b973eec39e7f818a92d3b25865e990855843abcafcdcefb5 · state attached · log index 3841646663 · transparency-log entry
- kind provenance · digest sha256:0e0eece183199818bcaf607a52887d5b29621140c4b9294c25f35048d3b0c4d8 · state attached · log index 3841649553 · transparency-log entry
- kind sbom · digest sha256:0e0eece183199818bcaf607a52887d5b29621140c4b9294c25f35048d3b0c4d8 · state attached · log index 3841653103 · transparency-log entry
- kind vsa · digest sha256:0e0eece183199818bcaf607a52887d5b29621140c4b9294c25f35048d3b0c4d8 · state attached · log index 3841656051 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/drupal/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-12T23:11:50Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:0e0eece183199818bcaf607a52887d5b29621140c4b9294c25f35048d3b0c4d8 [clean-room rebuild ledger, runs[810]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-12T23:03:14Z [stage_runs, stage_runs chain 1045 stage publish_image]
- Archive manifests written2026-11-13T00:04:45Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 1023 · probed 2026-11-12T22:59:02Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-13T00:08:08Z generated: by KitForge release/build_trail.py · generator commit f90b852f37265087900c9acdca31849ac5b61408
- 2026-11-13T00:09:52Z publication: promoted at 2026-11-13T00:08:51Z · promoted digest sha256:1bbfeaa8f03f8755b973eec39e7f818a92d3b25865e990855843abcafcdcefb5 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 526 · checklist status complete · checklist at 2026-11-13T00:09:52Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/drupal/11.4.12-CE-ubuntu24.04-r2/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/drupal/11.4.12-CE-ubuntu24.04-r2/), as staged for publishing | — |
ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.rebuild.json | beside the archive (prodasset /data/production/drupal/11.4.12-CE-ubuntu24.04-r2/), as staged for publishing | — |
ReadyStack-drupal-11.4.12-CE-ubuntu24.04-r2.rebuild.json.sigstore | beside the archive (prodasset /data/production/drupal/11.4.12-CE-ubuntu24.04-r2/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/drupal/11.4.12-CE-ubuntu24.04-r2/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 724 |
chains | sadb, ReadyStack's engine database (not published) | 1045 |
defects | sadb, ReadyStack's engine database (not published) | drupal 11.4.12-CE-ubuntu24.04-r2 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1045 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1045 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1045 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1045 |
release_images | sadb, ReadyStack's engine database (not published) | drupal 11.4.12-CE-ubuntu24.04-r2 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1045 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1045 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |