ERPNext v16.53.0-CE-ubuntu24.04-r3 build trail
How ReadyStack built readystack/erpnext:v16.53.0-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/erpnext:v16.53.0-CE-ubuntu24.04-r3 - Index digestsha256:388cf4a90c873a59affc698cbbc06e5662080535fefd8efcecdc1e51a1195910
- linux/amd64 digestsha256:9c8e5e7f01e5644871979bff6e79f9352afbe55d548fd744196b2341dcc674c1
- Archive
ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.tar.gz - Archive SHA-256 nowb24b7fb9fe62ac797b1ae7b20110573567388e09ed17b2b91a0d5074caa13821
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-12T15:49:54Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductERPNext (erpnext) [MANIFEST.json]
- Release tagv16.53.0-CE-ubuntu24.04-r3 [MANIFEST.json]
- Imagereadystack/erpnext:v16.53.0-CE-ubuntu24.04-r3 [MANIFEST.json]
- Image index digestsha256:388cf4a90c873a59affc698cbbc06e5662080535fefd8efcecdc1e51a1195910 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:9c8e5e7f01e5644871979bff6e79f9352afbe55d548fd744196b2341dcc674c1 [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.tar.gz (bytes 788793732) [MANIFEST.json]
- Archive sha256 at publishb24b7fb9fe62ac797b1ae7b20110573567388e09ed17b2b91a0d5074caa13821 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/frappe/erpnext [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv16.53.0 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit9cd11b19575bfc34f092a24f6c8b368c4dd69481 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashe9e194e2af7ed58c0f42e27a67378f1df9b975c9ba880bc0f3cdd898c7896209 (files 5581) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:0b362cb5e27a155271aeda73e347c0900e47369108f0d97d260b80847c17f1f0 [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794391203 (utc 2026-11-11T10:00:03Z) [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.rebuild.json, engine]
- Engine commit(s)
- commit 27badbefbe8aac72eb90e98ea8f843a03c177b52 · dirty yes · first drive 4422
- commit 4ec06344cf47f5b6c4f1894a79db5611e589923c · dirty yes · first drive 4441
- commit d7c629c61d3d1905f2f4aff5c1a3ebd1d543891a · dirty yes · first drive 4450
Why this release exists
Fully recorded- Chain1025 (created 2026-11-12T12:27:35Z · trigger customer_request · upstream version v16.53.0) [chains, chains #1025]
- Requestbuild request #679 (rebuild) (requested at 2026-11-11T10:00:06Z · requested by kitforge-agent · version v16.53.0) [build_requests, build_requests #679]
- Reasonrerelease agenda REVISION -> v16.53.0-CE-ubuntu24.04-r3 (decay loop, IMP-08) [build_requests, build_requests #679 request_reason]
- Supersedesreadystack/erpnext:v16.53.0-CE-ubuntu24.04-r2 (chain 890) [chains, chains #890]
The path through the harness
Fully recorded1 chain · 3 drives · 18 stages · 2 rewinds
Chain 1025 release · ready_to_ship
Created 2026-11-12T12:27:35Z, upstream v16.53.0, build request 679 [chains, chains #1025]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4422 | 2026-11-12T12:28:03Z | 89.3 | build host 5 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4422] |
| 4441 | 2026-11-12T15:06:57Z | 16.7 | build host 5 withhold-publish | ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4441] |
| 4450 | 2026-11-12T15:31:39Z | — | build host 5 publish-held | not recorded [drive_runs, drive_runs #4450] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-12T12:28:15Z | 2026-11-12T12:28:16Z | 1 | 4
|
order_json ef0d954cef4d… |
acquire |
2026-11-12T12:28:27Z | 2026-11-12T12:28:29Z | 1 | 12
|
source_tree 8252b240b9b6…license_file 3972dc9744f6…custody_inputs 83e29df67821…source_tree_hash a53c8047c969…source_file_manifest 71e0a97ba83b… |
plan |
2026-11-12T12:29:19Z | 2026-11-12T12:29:20Z | 1 | 10
|
recon_report f6399805fb33…input_pin_plan 8ccd9a6ea22c…toolchain_lock e8e976d543bb… |
assemble_kit |
2026-11-12T12:54:49Z | 2026-11-12T12:54:50Z | 1 | 27
|
dockerfile d1a5425c70d0…build_recipe 4a5e09e63aa9…system_pinning 01ba4719c80b…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health e5796733f6cd…verify_offline_sh 3e8184ea230c…base_image_digests 314e6ab8ddeb…dockerfile_offline d1a5425c70d0…first_build_digest 24a41db7498a… |
remediate |
2026-11-12T12:55:53Z | 2026-11-12T12:55:54Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 5ae24a613f4d…security_report 973968debabf… |
build_kit |
2026-11-12T13:14:59Z | 2026-11-12T13:15:00Z | 1 | 9
|
cosign_stamp 1e4ca84faed6…locked_digest 90242867f1c2…freeze_manifest 24f94d223a63…offline_rebuild_transcript 0ccaa2a6596e… |
verdict |
2026-11-12T13:20:42Z | 2026-11-12T13:20:43Z | 1 | 8
|
scout_verdict aae3c7c09af9… |
publish_image |
2026-11-12T13:22:47Z | 2026-11-12T13:22:47Z | 1 | 7
|
hub_readme 0679db40b1e3…promotion_record 225a1ee2fc96… |
boot_instance |
2026-11-12T13:28:01Z | 2026-11-12T13:28:05Z | 2 | 3
|
instance_handle 388c404d421f… |
sbom |
2026-11-12T13:29:14Z | 2026-11-12T13:29:15Z | 1 | 5
|
sbom_md 10d11d403f6c…sbom_json 6510ef293ff1… |
schema_discovery |
2026-11-12T13:29:17Z | 2026-11-12T13:29:18Z | 1 | 7
|
schema_hash e3609eb36fb0…dependency_tree 32bb7b317f16…table_classification 5f3814156408… |
admin_handbook |
2026-11-12T13:29:25Z | 2026-11-12T13:29:26Z | 1 | 7
|
api_map 3d71d59687b2…admin_handbook 66a6759b5380… |
db_handbook |
2026-11-12T13:29:36Z | 2026-11-12T13:29:37Z | 1 | 8
|
db_handbook 691a96b635f8…seed_isolation 9914df3bf3f7… |
seed_data |
2026-11-12T13:29:43Z | 2026-11-12T13:29:44Z | 1 | 6
|
seed_data_sql 858950b9e728…seed_cases_json 2cc0951e375d… |
seed_validate |
2026-11-12T13:29:46Z | 2026-11-12T13:29:47Z | 1 | 3
|
seed_data_contract e5811e2ec9b5… |
usecase_validate |
2026-11-12T13:30:07Z | 2026-11-12T13:30:07Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests dc64b4f64b23…test_results cd3e60e3ab93…usecase_contract bd697c6bbe36… |
finalize_docs |
2026-11-12T13:30:13Z | 2026-11-12T13:30:15Z | 1 | 9
|
defects_json bf0aae8b4cf5…release_notes ce3356f039e1…api_integration_guide baf731b11d85… |
package_archive invalidated 2026-11-12T15:31:09Z |
2026-11-12T13:57:20Z | 2026-11-12T15:23:36Z | 2 | 37 (final gate PASS)
|
sale_tar eb44ac15a5d2…checksums 02262d5d3e33…verify_md c4ce1ccf987a…rebuild_md 95fdb3086092…manifest_txt 373dde8595e4…actions_jsonl 10a2cbda316f…provenance_md b503c9160df0…assetchain_log_md e9eccaec0c0f…assetchain_log_json 503b4d7468f1… |
[stage_runs]
Rewinds
- 2026-11-12T14:23:40Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33955] - 2026-11-12T15:31:09Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #34083]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-12T15:23:36Z.
5 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 9665 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 12966 | L-A08, L-038, L-036, L-034, L-032 |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 1655 | — |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
2 rounds, 2 counted, $0.66 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-12T13:59:01Z | 0 | 2 | 0 | findings to repackage [held_rounds, held_rounds #1820] | $0.37 | 3 rounds, $40.00 | 338ace008ac9… |
| 2 | 2026-11-12T15:24:27Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1825] | $0.29 | 3 rounds, $40.00 | eb44ac15a5d2… |
Defects
Fully recorded- Ledger entries4 [defects, defects where product_slug=erpnext and this tag or chain]
- Disclosed in the archive4 [docs/defects/defects.json, entries]
4 ledger entries: by severity medium 1, low 1, high 2; by status open 2, fixed-before-release 2.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-erpnext-b63d7eeaa4Secret written in plain text or to the log by default [defects, defects #269162] | medium | open | build strategy record | — |
RSD-erpnext-d0fc2b3cadAdmin handbook: Round 2 finding still open (RSD-erpnext-bc6dd51421): the product's backup writes only the database dump, site_config_backup.json and the files tarballs, and restore reads only those, so it cannot… [defects, defects #269164] | low | open | held review (review model) | — |
RSD-erpnext-b87be7d89dAdmin handbook: Stale release tag: the sentence tells the customer to re-create from the superseded -r2 image instead of this release -r3. [defects, defects #269767] | high | fixed-before-release | held review (review model) | — |
RSD-erpnext-8be66d5551Admin handbook: Stale release tag: the sentence tells the customer to re-create from the superseded -r2 image instead of this release -r3. [defects, defects #269768] | high | fixed-before-release | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:9c8e5e7f01e5644871979bff6e79f9352afbe55d548fd744196b2341dcc674c1 · published digest sha256:9c8e5e7f01e5644871979bff6e79f9352afbe55d548fd744196b2341dcc674c1 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 465) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T15:33:22Z · failing Docker Scout counts 162 packages with copyleft licences (GPL, LGPL, MPL), 155 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T15:31:49Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3833084930 · transparency-log entry
- log index 3833085746 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3835349092 · transparency-log entry · integrated 2026-11-12T15:48:11Z) [ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:388cf4a90c873a59affc698cbbc06e5662080535fefd8efcecdc1e51a1195910 · state attached · log index 3835353623 · transparency-log entry
- kind sbom · digest sha256:388cf4a90c873a59affc698cbbc06e5662080535fefd8efcecdc1e51a1195910 · state attached · log index 3835356403 · transparency-log entry
- kind vsa · digest sha256:388cf4a90c873a59affc698cbbc06e5662080535fefd8efcecdc1e51a1195910 · state attached · log index 3835360189 · transparency-log entry
- kind provenance · digest sha256:9c8e5e7f01e5644871979bff6e79f9352afbe55d548fd744196b2341dcc674c1 · state attached · log index 3835363590 · transparency-log entry
- kind sbom · digest sha256:9c8e5e7f01e5644871979bff6e79f9352afbe55d548fd744196b2341dcc674c1 · state attached · log index 3835366495 · transparency-log entry
- kind vsa · digest sha256:9c8e5e7f01e5644871979bff6e79f9352afbe55d548fd744196b2341dcc674c1 · state attached · log index 3835369860 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/erpnext/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-12T13:59:07Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:9c8e5e7f01e5644871979bff6e79f9352afbe55d548fd744196b2341dcc674c1 [clean-room rebuild ledger, runs[794]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-12T13:22:47Z [stage_runs, stage_runs chain 1025 stage publish_image]
- Archive manifests written2026-11-12T15:41:46Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 1181 · probed 2026-11-12T13:06:54Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-12T15:49:54Z generated: by KitForge release/build_trail.py · generator commit 5cf3b0594a304e32ae246441aa48f3a4b4d2aaa5
- 2026-11-12T15:52:57Z publication: promoted at 2026-11-12T15:50:35Z · promoted digest sha256:388cf4a90c873a59affc698cbbc06e5662080535fefd8efcecdc1e51a1195910 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 513 · checklist status complete · checklist at 2026-11-12T15:52:57Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r3/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.rebuild.json | beside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-erpnext-v16.53.0-CE-ubuntu24.04-r3.rebuild.json.sigstore | beside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r3/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/erpnext/v16.53.0-CE-ubuntu24.04-r3/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 679 |
chains | sadb, ReadyStack's engine database (not published) | 1025 |
defects | sadb, ReadyStack's engine database (not published) | erpnext v16.53.0-CE-ubuntu24.04-r3 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1025 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1025 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1025 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1025 |
release_images | sadb, ReadyStack's engine database (not published) | erpnext v16.53.0-CE-ubuntu24.04-r3 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1025 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1025 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |