ERPNext v16.53.0-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/erpnext:v16.53.0-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/erpnext:v16.53.0-CE-ubuntu24.04-r2
  • Index digestsha256:61105d4ed44bd28f8ebdc05d5e519eae6387bedbb0f050639abbf04db04aa1e2
  • linux/amd64 digestsha256:baf70b25d24e325ec6440b86ce197a429ae1628547b026ae4d021b59358c848d
  • ArchiveReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now138d99faae9e821aa183a9ffa06eefd6c2cd3f1a50aefae324634eb5cf78a6c8
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-08T17:44:24Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.trail.json
ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.trail.jsonReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.trail.mdERPNext product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductERPNext (erpnext) [MANIFEST.json]
  • Release tagv16.53.0-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/erpnext:v16.53.0-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:61105d4ed44bd28f8ebdc05d5e519eae6387bedbb0f050639abbf04db04aa1e2 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:baf70b25d24e325ec6440b86ce197a429ae1628547b026ae4d021b59358c848d [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.tar.gz (bytes 786800690) [MANIFEST.json]
  • Archive sha256 at publish138d99faae9e821aa183a9ffa06eefd6c2cd3f1a50aefae324634eb5cf78a6c8 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/frappe/erpnext [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv16.53.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit9cd11b19575bfc34f092a24f6c8b368c4dd69481 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashe9e194e2af7ed58c0f42e27a67378f1df9b975c9ba880bc0f3cdd898c7896209 (files 5581) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:206706d7d859367dfec346403de6ce87e033a55b689683e45dc21160436fa2ab [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793220242 (utc 2026-10-28T20:44:02Z) [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit fb3d89dbdf1a4d4d5e6b01f0cfad0b5ef4a697f2 · dirty yes · first drive 3826
    • commit c20aa19bc0ab8c9fef7ff40e1f6a18c4169b166e · dirty yes · first drive 3842
    • commit 3179e9e9e7ff3f9414b596de6e552d260c583056 · dirty yes · first drive 3845
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain890 (created 2026-11-08T15:18:56Z · trigger customer_request · upstream version v16.53.0) [chains, chains #890]
  • Requestbuild request #573 (rebuild) (requested at 2026-11-08T07:25:53Z · requested by kitforge-agent · version v16.53.0) [build_requests, build_requests #573]
  • Reasonrerelease agenda REVISION -> v16.53.0-CE-ubuntu24.04-r2 (decay loop, IMP-08) [build_requests, build_requests #573 request_reason]
  • Supersedesreadystack/erpnext:v16.53.0-CE-ubuntu24.04-r1 (chain 811) [chains, chains #811]

The path through the harness

Fully recorded

1 chain · 3 drives · 18 stages · 2 rewinds

Chain 890 release · ready_to_ship

Created 2026-11-08T15:18:56Z, upstream v16.53.0, build request 573 [chains, chains #890]

DriveStartedMinutesBuild hostHow it stopped
38262026-11-08T15:19:26Z63.8build host 3 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3826]
38422026-11-08T17:13:37Z11.1build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3842]
38452026-11-08T17:31:29Z—build host 3 publish-held not recorded [drive_runs, drive_runs #3845]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-08T15:19:38Z2026-11-08T15:19:38Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 38ccb0f97632…
acquire 2026-11-08T15:19:50Z2026-11-08T15:19:51Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 8252b240b9b6…
license_file 3972dc9744f6…
custody_inputs 83e29df67821…
source_tree_hash a53c8047c969…
source_file_manifest 71e0a97ba83b…
plan 2026-11-08T15:20:34Z2026-11-08T15:20:35Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 68fee3eaed04…
input_pin_plan 1c3edd468673…
toolchain_lock cdaedb86e2a0…
assemble_kit 2026-11-08T15:38:26Z2026-11-08T15:38:27Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile acb42d985e7d…
build_recipe 2eaced9c5718…
system_pinning 01ba4719c80b…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 9a0c2f440ae5…
verify_offline_sh 3e8184ea230c…
base_image_digests 314e6ab8ddeb…
dockerfile_offline acb42d985e7d…
first_build_digest 034067c5bad9…
remediate 2026-11-08T15:39:12Z2026-11-08T15:39:13Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 1f4569b6a457…
security_report f148740beb17…
build_kit 2026-11-08T15:53:45Z2026-11-08T15:53:46Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 12de4702f8d4…
locked_digest da7877e087cd…
freeze_manifest a156f68f220c…
offline_rebuild_transcript b2e1a4f67465…
verdict 2026-11-08T15:57:57Z2026-11-08T15:57:58Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict b8be8b22cdbc…
publish_image 2026-11-08T15:59:24Z2026-11-08T15:59:25Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme d86ffca1699e…
promotion_record a2124ac08395…
boot_instance 2026-11-08T16:02:35Z2026-11-08T16:02:39Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle e825afd994c3…
sbom 2026-11-08T16:03:33Z2026-11-08T16:03:34Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 472513a8669d…
sbom_json db01de6734d0…
schema_discovery 2026-11-08T16:03:37Z2026-11-08T16:03:38Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash e3609eb36fb0…
dependency_tree 32bb7b317f16…
table_classification 5f3814156408…
admin_handbook 2026-11-08T16:03:44Z2026-11-08T16:03:45Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 3d71d59687b2…
admin_handbook 1e4421620514…
db_handbook 2026-11-08T16:03:54Z2026-11-08T16:03:55Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 371a17647318…
seed_isolation 9914df3bf3f7…
seed_data 2026-11-08T16:04:00Z2026-11-08T16:04:01Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 858950b9e728…
seed_cases_json c42cd20ede73…
seed_validate 2026-11-08T16:04:04Z2026-11-08T16:04:05Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract e1e7db128dc3…
usecase_validate 2026-11-08T16:04:23Z2026-11-08T16:04:24Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 5efc7841de3b…
test_results e6563e02e514…
usecase_contract 7c8463f79d07…
finalize_docs 2026-11-08T16:04:30Z2026-11-08T16:04:30Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 57fb471d13d4…
release_notes 5b071e6ddd0c…
api_integration_guide a21efc806bb5…
package_archive invalidated 2026-11-08T17:31:03Z 2026-11-08T16:23:09Z2026-11-08T17:24:44Z2
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 13469ece13cd…
checksums c4174295f1ac…
verify_md a6a3c41f5a64…
rebuild_md 7c11a3da8680…
manifest_txt 3483fb923b98…
actions_jsonl 00e26e9e0b36…
provenance_md 5296067bad1b…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 3d162e2003c0…

[stage_runs]

Rewinds

  • 2026-11-08T16:44:43Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26794]
  • 2026-11-08T17:31:03Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26892]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-08T17:24:44Z.

5 calls over 3 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 08795 L-A183, L-A15
remediate2001 09164 L-A183, L-A15
usecase_validate1001 01811 L-A59

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $0.66 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-08T16:24:43Z 020 findings to repackage [held_rounds, held_rounds #1522] $0.38 3 rounds, $40.00 bceebd7546cb…
22026-11-08T17:25:17Z 000 clean to publish [held_rounds, held_rounds #1527] $0.28 3 rounds, $40.00 13469ece13cd…

Defects

Fully recorded
  • Ledger entries12 [defects, defects where product_slug=erpnext and this tag or chain]
  • Disclosed in the archive4 [docs/defects/defects.json, entries]

12 ledger entries: by severity medium 1, low 9, high 2; by status open 2, fixed-before-release 2, fixed-in-release 8.

DefectSeverityStatusFound byFixed in
RSD-erpnext-748465dd80
Secret written in plain text or to the log by default [defects, defects #179391]		mediumopenbuild strategy record—
RSD-erpnext-745f095f0f
Admin handbook: Round 2 finding still open (RSD-erpnext-bc6dd51421): the product's backup writes only the database dump, site_config_backup.json and the files tarballs, and restore reads only those, so it cannot… [defects, defects #179392]		lowopenheld review (review model)—
RSD-erpnext-fa21e70922
Admin handbook: Stale release tag in a re-create procedure: names r1 (never published) instead of this release r2 [defects, defects #179630]		highfixed-before-releaseheld review (review model)—
RSD-erpnext-aca75c5552
Admin handbook: Stale release tag in a re-create procedure: names r1 (never published) instead of this release r2 [defects, defects #179631]		highfixed-before-releaseheld review (review model)—
RSD-erpnext-9e04ecae62
Admin handbook: 'Internal' for Socket.IO restates the round-2 error in another section: the process listens on *:9000, so it is reachable from any container on the same network. [defects, defects #181469]		lowfixed-in-releaseheld review (review model)v16.53.0-CE-ubuntu24.04-r2
RSD-erpnext-2a07e8afd1
Admin handbook: Same paraphrase of the round-2 finding: Socket.IO is not internal to the container, it listens on *:9000. [defects, defects #181470]		lowfixed-in-releaseheld review (review model)v16.53.0-CE-ubuntu24.04-r2
RSD-erpnext-cd756accf1
Admin handbook: 'Only … more than 100 recipients' is incomplete: EmailQueue.process also enqueues the row-writing job when queue_separately is set, so a lost Redis queue can also drop those emails. [defects, defects #181471]		lowfixed-in-releaseheld review (review model)v16.53.0-CE-ubuntu24.04-r2
RSD-erpnext-def28ef7f8
Database handbook: Same incomplete 'only' as ADMIN_HANDBOOK.md:1227. [defects, defects #181472]		lowfixed-in-releaseheld review (review model)v16.53.0-CE-ubuntu24.04-r2
RSD-erpnext-3bcf71863d
Admin handbook: The command below it is `wait-for-it -t 5 <db_host>:<db_port>`, a TCP check of MariaDB from inside the container; it does not show that the new container is ready. [defects, defects #181473]		lowfixed-in-releaseheld review (review model)v16.53.0-CE-ubuntu24.04-r2
RSD-erpnext-88dc4807bb
Database handbook: bench.log holds command lines, not the container's environment variables; only the values the entrypoint expands into the new-site arguments appear. [defects, defects #181474]		lowfixed-in-releaseheld review (review model)v16.53.0-CE-ubuntu24.04-r2
RSD-erpnext-93dac10ac2
Database handbook: Same paraphrase of the round-2 finding; DB_HANDBOOK.md:809 already states the correct fact. [defects, defects #181475]		lowfixed-in-releaseheld review (review model)v16.53.0-CE-ubuntu24.04-r2
RSD-erpnext-f8592a3669
Database handbook: 'Always' contradicts DB_HANDBOOK.md:974 and 1090 ('on a new volume'): the key is needed only when the sites volume is new. [defects, defects #181476]		lowfixed-in-releaseheld review (review model)v16.53.0-CE-ubuntu24.04-r2

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:baf70b25d24e325ec6440b86ce197a429ae1628547b026ae4d021b59358c848d · published digest sha256:baf70b25d24e325ec6440b86ce197a429ae1628547b026ae4d021b59358c848d · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 352) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T17:32:34Z · failing Docker Scout counts 162 packages with copyleft licences (GPL, LGPL, MPL), 155 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T17:31:40Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3758391131 · transparency-log entry · integrated 2026-11-08T17:43:02Z) [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:61105d4ed44bd28f8ebdc05d5e519eae6387bedbb0f050639abbf04db04aa1e2 · state attached · log index 3758391301 · transparency-log entry
    • kind sbom · digest sha256:61105d4ed44bd28f8ebdc05d5e519eae6387bedbb0f050639abbf04db04aa1e2 · state attached · log index 3758391379 · transparency-log entry
    • kind vsa · digest sha256:61105d4ed44bd28f8ebdc05d5e519eae6387bedbb0f050639abbf04db04aa1e2 · state attached · log index 3758391515 · transparency-log entry
    • kind provenance · digest sha256:baf70b25d24e325ec6440b86ce197a429ae1628547b026ae4d021b59358c848d · state attached · log index 3758391595 · transparency-log entry
    • kind sbom · digest sha256:baf70b25d24e325ec6440b86ce197a429ae1628547b026ae4d021b59358c848d · state attached · log index 3758391663 · transparency-log entry
    • kind vsa · digest sha256:baf70b25d24e325ec6440b86ce197a429ae1628547b026ae4d021b59358c848d · state attached · log index 3758391857 · transparency-log entry
    (at 2026-11-08T17:43:03Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/erpnext/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-08T16:24:49Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:baf70b25d24e325ec6440b86ce197a429ae1628547b026ae4d021b59358c848d [clean-room rebuild ledger, runs[657]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-08T15:59:25Z [stage_runs, stage_runs chain 890 stage publish_image]
  • Archive manifests written2026-11-08T17:38:08Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 1181 · probed 2026-11-08T15:47:38Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-08T17:44:24Z generated: by KitForge release/build_trail.py · generator commit 3179e9e9e7ff3f9414b596de6e552d260c583056
  • 2026-11-08T17:46:41Z publication: promoted at 2026-11-08T17:44:58Z · promoted digest sha256:61105d4ed44bd28f8ebdc05d5e519eae6387bedbb0f050639abbf04db04aa1e2 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 381 · checklist status complete · checklist at 2026-11-08T17:46:41Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)573
chainssadb, ReadyStack's engine database (not published)890
defectssadb, ReadyStack's engine database (not published)erpnext v16.53.0-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 890
held_roundssadb, ReadyStack's engine database (not published)chain 890
lesson_recallssadb, ReadyStack's engine database (not published)chain 890
micro_step_runssadb, ReadyStack's engine database (not published)chain 890
release_imagessadb, ReadyStack's engine database (not published)erpnext v16.53.0-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 890
stage_runssadb, ReadyStack's engine database (not published)chain 890
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—