etcd v3.7.3-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/etcd:v3.7.3-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/etcd:v3.7.3-CE-ubuntu24.04-r2
  • Index digestsha256:4d36902b4d88897871df9da220be342299b21b0f216f3e0307e766d9eeb14be4
  • linux/amd64 digestsha256:9a7eeb94f59ccd9fe6f5e1927aa9fe71804ee01b3e2c522bdc368074fd418d25
  • ArchiveReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now159d78f3e182806f73afa3ac4bf05c1f333395afacdd461c6e143af8a36527a1
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-08T11:48:27Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.trail.json
ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.trail.jsonReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.trail.mdetcd product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • Productetcd (etcd) [MANIFEST.json]
  • Release tagv3.7.3-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/etcd:v3.7.3-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:4d36902b4d88897871df9da220be342299b21b0f216f3e0307e766d9eeb14be4 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:9a7eeb94f59ccd9fe6f5e1927aa9fe71804ee01b3e2c522bdc368074fd418d25 [ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.tar.gz (bytes 477160917) [MANIFEST.json]
  • Archive sha256 at publish159d78f3e182806f73afa3ac4bf05c1f333395afacdd461c6e143af8a36527a1 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/etcd-io/etcd [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv3.7.3 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit0a173d0410a96d01091b484daae81365bbcde57e [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash9d253f34dde7e29c5671022e46d0957bbd5e25564c05a974717be372f035996f (files 1493) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:a2c9849f38d8594b91aa1899e38062b81dff5685adc4c2b5b14fcb488673d366 [ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1792710094 (utc 2026-10-22T23:01:34Z) [ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit d7ccff446f52731f23cbe85c44adc1730f1c2bef · dirty yes · first drive 3474
    • commit 21a662bdd6974e1e462fe91e1415f9f9d120bf2d · dirty yes · first drive 3533
    • commit 1b6b66826eaa0cb5f2f833b5a6a84e7c72e9e068 · dirty yes · first drive 3759
    • commit 3d32cc1dd39bba72d2a0135dfa6216cfa284f64a · dirty yes · first drive 3769
    • commit 9a5f84354c4a786c95bbe5664588df2db561f454 · dirty yes · first drive 3785
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain742 (created 2026-10-28T02:00:31Z · trigger customer_request · upstream version v3.7.3) [chains, chains #742]
  • Requestbuild request #438 (rebuild) (requested at 2026-10-28T00:32:05Z · requested by kitforge-agent · version v3.7.3) [build_requests, build_requests #438]
  • Reasonrevision v3.7.3-CE-ubuntu24.04-r2: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #438 request_reason]
  • Supersedesreadystack/etcd:v3.7.3-CE-ubuntu24.04-r1 (chain 698) [chains, chains #698]

The path through the harness

Fully recorded

1 chain · 6 drives · 18 stages · 5 rewinds

Chain 742 release · ready_to_ship

Created 2026-10-28T02:00:31Z, upstream v3.7.3, build request 438 [chains, chains #742]

DriveStartedMinutesBuild hostHow it stopped
8232026-10-28T02:00:51Z72.4build host 4 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #823] rebuilt from a build line's log
34742026-11-03T04:50:40Z26build host 4 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 15 ticks [drive_runs, drive_runs #3474]
35332026-11-07T01:41:04Z5.3build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3533]
37592026-11-08T10:12:50Z14.8build host 4 withhold-publish ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #3759]
37692026-11-08T11:04:17Z4build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3769]
37852026-11-08T11:44:26Z—build host 4 publish-held not recorded [drive_runs, drive_runs #3785]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-28T02:00:57Z2026-10-28T02:00:58Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-28T02:01:01Z2026-10-28T02:01:02Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-28T02:01:52Z2026-10-28T02:01:53Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-28T02:04:26Z2026-11-08T10:15:32Z3
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile e648531b8c2a…
build_recipe bf3e782af2f5…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 8d86f13d93a6…
verify_offline_sh 3e8184ea230c…
base_image_digests 061b60efec95…
dockerfile_offline e648531b8c2a…
first_build_digest 7ddb8a37cdcf…
remediate 2026-10-28T02:05:14Z2026-11-08T10:15:35Z3
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 794a25545c46…
security_report 404ace62e50a…
build_kit 2026-10-28T02:08:41Z2026-11-08T10:19:13Z3
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp fded11de9adb…
locked_digest b630b1f09202…
freeze_manifest 5ab535e1e833…
offline_rebuild_transcript 1db04f0fba2b…
verdict 2026-10-28T02:09:11Z2026-11-08T10:19:50Z3
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict abc9453802fc…
publish_image 2026-10-28T02:09:42Z2026-11-08T10:20:23Z3
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme ed8b03a187c6…
promotion_record 7514fd118db8…
boot_instance 2026-10-28T02:09:55Z2026-11-08T10:20:42Z6
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle b8cf4c8ad737…
sbom 2026-10-28T02:10:05Z2026-11-08T10:20:53Z3
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 31cfa68b8e45…
sbom_json a2c8fe49b6f3…
schema_discovery 2026-10-28T02:10:08Z2026-11-08T10:20:57Z3
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash a30c71c5f904…
dependency_tree 2b73577cc262…
table_classification 9d91948f2293…
admin_handbook 2026-10-28T02:20:34Z2026-11-08T10:21:10Z3
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map e188f51c8986…
admin_handbook b428bf06f05d…
db_handbook 2026-10-28T02:31:38Z2026-11-08T10:21:26Z3
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 5ae357e6dc7f…
seed_isolation 053bf8dd6f19…
seed_data 2026-10-28T02:31:46Z2026-11-08T10:21:34Z3
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql d5cd655d0177…
seed_cases_json 361fb6bd21aa…
seed_validate 2026-10-28T02:31:48Z2026-11-08T10:21:37Z3
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 0a3c553f4d2c…
usecase_validate 2026-10-28T02:32:11Z2026-11-08T10:21:48Z3
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 5ee24fbc47fc…
test_results 8bd7e8522f75…
usecase_contract 813cbbf62ae4…
finalize_docs 2026-10-28T02:49:16Z2026-11-08T10:21:56Z3
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json e81db2174b97…
release_notes 830a26511feb…
api_integration_guide 35b8c1d58a9a…
package_archive invalidated 2026-11-08T11:43:54Z 2026-10-28T03:13:10Z2026-11-08T11:08:14Z5
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 24e99db7515f…
checksums fa08ae95db1b…
verify_md 11ae55a23220…
rebuild_md 8155bf4009c0…
manifest_txt 04670a63524c…
actions_jsonl ab826f7181c1…
provenance_md 2cb9e755ab78…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 39480ffefeee…

[stage_runs]

Rewinds

  • 2026-11-03T04:50:44Z: package_archive to assemble_kit on strategy_changed (strategy changed (c54b9a412cf2 -> d41acccc8575)) [stage_events, stage_events #22107]
  • 2026-11-08T06:11:48Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive --allow-rebuild) [stage_events, stage_events #25262]
  • 2026-11-08T10:12:55Z: package_archive to assemble_kit on strategy_changed (strategy changed (d41acccc8575 -> a5f2ead8c43d)) [stage_events, stage_events #25804]
  • 2026-11-08T10:52:59Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #25928]
  • 2026-11-08T11:43:54Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26068]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-08T11:08:14Z.

386 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook985003 6193695 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook1227003 10314728 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate2001 not recordednot recorded —
finalize_docs1608803 4117035 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $7.24 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-07T01:46:58Z 22113 findings to tests_broken [held_rounds, held_rounds #1415] $2.95 3 rounds, $40.00 407948a3a425…
22026-11-08T10:28:10Z 0011 clean to repackage [held_rounds, held_rounds #1498] $2.17 3 rounds, $40.00 a868c14923a2…
32026-11-08T11:08:47Z 0012 clean to publish [held_rounds, held_rounds #1502] $2.12 3 rounds, $40.00 24e99db7515f…

Defects

Fully recorded
  • Ledger entries58 [defects, defects where product_slug=etcd and this tag or chain]
  • Disclosed in the archive57 [docs/defects/defects.json, entries]

58 ledger entries: by severity low 37, medium 1, critical 2, high 18; by status fixed-in-release 1, open 4, fixed-before-release 53.

DefectSeverityStatusFound byFixed in
RSD-etcd-2b28a098ea
Admin handbook gives the previous release's tag (r2) for this release [defects, defects #157827]		lowfixed-in-releaseheld review (review model)v3.7.3-CE-ubuntu24.04-r2
RSD-etcd-cc8403aa36
etcd serves /metrics on the client port without authentication, and --listen-metrics-urls does not move it off that port [defects, defects #157828]		mediumopenbuild strategy record—
RSD-etcd-077579d670
Database handbook: Documented interactive password-change command has the same backslash-escaped quotes and fails to authenticate. [defects, defects #157920]		criticalfixed-before-releaseheld review (review model)—
RSD-etcd-91c0870703
Database handbook: Documented root-password-change command is written with backslash-escaped quotes and fails (unknown command / authentication failed); the password is not changed. [defects, defects #157921]		criticalfixed-before-releaseheld review (review model)—
RSD-etcd-af3906fdf7
Admin handbook: Example omits --endpoints/--cacert required with TLS (the handbook says so elsewhere) and expands the password on the host. [defects, defects #157922]		highfixed-before-releaseheld review (review model)—
RSD-etcd-6985cf292f
Admin handbook: docker exec command without sh -c: $ETCD_ROOT_PASSWORD is expanded by the host shell (empty), so authentication fails. [defects, defects #157923]		highfixed-before-releaseheld review (review model)—
RSD-etcd-7c08b4dea3
Admin handbook: etcd binaries are not in /usr/local/bin. [defects, defects #157924]		highfixed-before-releaseheld review (review model)—
RSD-etcd-18dd5c9919
Admin handbook: mTLS example omits --endpoints/--cacert and fails with context deadline exceeded. [defects, defects #157925]		highfixed-before-releaseheld review (review model)—
RSD-etcd-90f84b07b9
API guide: Entrypoint override uses a path that does not exist in the image. [defects, defects #157926]		highfixed-before-releaseheld review (review model)—
RSD-etcd-7f4dc2807c
API guide: Sentence in the health-cmd paragraph offers a CA option rs-probe does not have. [defects, defects #157927]		highfixed-before-releaseheld review (review model)—
RSD-etcd-89e35906d3
API guide: States the gRPC API needs no credentials; it does. [defects, defects #157928]		highfixed-before-releaseheld review (review model)—
RSD-etcd-a51accaa7e
API guide: Argument-passing example has no --env-file, so the first start exits with an error. [defects, defects #157929]		highfixed-before-releaseheld review (review model)—
RSD-etcd-d17b1fc47a
API guide: Argument-passing example has no --env-file, so the first start exits with an error. [defects, defects #157930]		highfixed-before-releaseheld review (review model)—
RSD-etcd-62c8db166a
API guide: /v3/auth/status does not answer GET. [defects, defects #157931]		highfixed-before-releaseheld review (review model)—
RSD-etcd-07e7bbb440
Database handbook: Verify-health command runs curl inside the container, which has no curl. [defects, defects #157932]		highfixed-before-releaseheld review (review model)—
RSD-etcd-bf1b0265cc
Database handbook: docker exec command without sh -c: $ETCD_ROOT_PASSWORD is expanded by the host shell (empty), so authentication fails. [defects, defects #157933]		highfixed-before-releaseheld review (review model)—
RSD-etcd-7a87075db1
Database handbook: The documented health-override docker run has no certificate mount or TLS flags; etcd serves plain HTTP and the https probe leaves the container unhealthy. [defects, defects #157934]		highfixed-before-releaseheld review (review model)—
RSD-etcd-bb0c74f80a
Database handbook: mutual-TLS docker run omits --listen-client-urls/--advertise-client-urls https://: etcd serves plain HTTP, client certificates are not required and the container is unhealthy. [defects, defects #157935]		highfixed-before-releaseheld review (review model)—
RSD-etcd-c6ee6ae195
Database handbook: The example etcdctl command that follows omits --endpoints/--cacert. [defects, defects #157936]		highfixed-before-releaseheld review (review model)—
RSD-etcd-fefce88702
Database handbook: Example etcdctl command lacks the TLS endpoint and CA flags. [defects, defects #157937]		highfixed-before-releaseheld review (review model)—
RSD-etcd-5b53cae83c
Database handbook: mTLS endpoint health example expands the password on the host and omits --endpoints/--cacert. [defects, defects #157938]		highfixed-before-releaseheld review (review model)—
RSD-etcd-a59b70a975
Database handbook: Wrong flag name: --insecure-skip-verify does not exist. [defects, defects #157939]		highfixed-before-releaseheld review (review model)—
RSD-etcd-8d1144b022
Admin handbook: Sentence gives etcdctl's flag spelling for the health probe. [defects, defects #157940]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-cc665ef6c0
Admin handbook: Backup uses etcdctl on a running container, not etcdutl on a stopped one. [defects, defects #157941]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-20e0803987
API guide: Misspelled binary name. [defects, defects #157942]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-1b6b031a22
API guide: Unsupported claim of datastore corruption. [defects, defects #157943]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-3ce6080ae5
API guide: Wrong status for missing credentials. [defects, defects #157944]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-6e45ed54a1
Database handbook: `get /` returns only the key named '/', not all keys. [defects, defects #157945]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-1e48b3045c
Database handbook: False statement that the paths accept other methods. [defects, defects #157946]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-fc6035a15c
Database handbook: The container name is not part of the cluster configuration. [defects, defects #157947]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-41f8e1955d
Database handbook: Sentence states the reverse of the behaviour. [defects, defects #157948]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-08ac0bea06
Database handbook: Contradicts the API guide and measured behaviour. [defects, defects #157949]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-4ebf03c15f
Database handbook: Contradictory: docker exec etcdutl while the container is stopped. [defects, defects #157950]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-29ce722945
Database handbook: Entrypoint does not remain; it exec's etcd. [defects, defects #157951]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-0e2e7bb3b2
Database handbook: docker restart does not fail; the stale variable breaks the exec commands. [defects, defects #157952]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-a34dadefdd
Admin handbook: Misspelled binary name: etdctl (the image has etcdctl; IMAGE_BINARIES.txt). [defects, defects #174639]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-378e35db3b
Database handbook: Misspelled binary name: etdctl; also etcdctl is not an offline tool. [defects, defects #174640]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-e82f550036
Admin handbook: Sentence says the restore requires etcdctl with credentials; the documented restore uses only etcdutl in a one-off container, and the backup (not the restore) is the etcdctl step. [defects, defects #174641]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-01d2f5587d
Database handbook: /metrics accepts POST and PUT (HTTP 200), so the statement that the three endpoints answer only GET is false for /metrics. [defects, defects #174642]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-585355dcef
API guide: Listed among the endpoints that "always return successfully without credentials", next to GET-only paths; a GET answers 501 Method Not Allowed (the round-1 finding about GET). [defects, defects #174643]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-bc469df92a
Database handbook: The docker run block under this paragraph has no certificate mount and no TLS flags; run as written, etcd serves plain HTTP and the https probe leaves the container unhealthy. [defects, defects #174644]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-4378095689
Database handbook: The mutual-TLS docker run block at 779-788 lacks --listen-client-urls/--advertise-client-urls https://; run as written it serves plain HTTP, ignores --client-cert-auth and the container is unhealthy. [defects, defects #174645]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-82ade6b163
API guide: The same section then shows `docker exec etcd etcdutl <command>`, which needs a running container, so it contradicts "when the server is not running" (round-1 minor, still present). [defects, defects #174646]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-1e244ea510
API guide: Unsupported security claim: no record measures privilege escalation or Docker-daemon access; IMAGE_EVIDENCE.json records only user=etcd, nonroot=true. [defects, defects #174647]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-db92597a39
Database handbook: The SBOM is an archive file (docs/sbom/SBOM.json) and an attached attestation; there is no such path inside the image. [defects, defects #174648]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-b58d6c0774
Docker Hub README: The README says the build kit is a free download for any registered account (also line 15, "free with an account"), but bundle/MANIFEST.json records free_release false and price_cents 1000 for the… [defects, defects #174649]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-a74087d383
Docker Hub README: Round-2 finding not corrected: the README still says the kit is free for any registered account. [defects, defects #175205]		lowopenheld review (review model)—
RSD-etcd-92564406d8
Docker Hub README: Same uncorrected price claim as line 90 (the round-2 finding named this line too). [defects, defects #175206]		lowopenheld review (review model)—
RSD-etcd-7a123dc49a
Docker Hub README: Contradicts the README's own etcd text below it ('Keep the line in etcd.env afterwards'): removing the password after setup breaks every documented etcdctl command (--password "$ETCD_ROOT_PASSWORD"… [defects, defects #175207]		lowopenheld review (review model)—
RSD-etcd-50b944cd09
Admin handbook: Rewritten section announces an offline backup procedure that uses etcdutl, but the only documented backup is the online 'etcdctl snapshot save' (the next sentence says so); no etcdutl backup exists… [defects, defects #175208]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-e2de81565d
Admin handbook: False 'only': the gateway POST /v3/auth/status answers without credentials (and /v3/auth/authenticate by definition); the API guide (line 1716) and DB_HANDBOOK.md:932 list /v3/auth/status as… [defects, defects #175209]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-89c95fdc9b
Admin handbook: Wrong file name: the documented run command uses --env-file ./etcd.env; the same `.env` wording is at lines 1011 and 1030. [defects, defects #175210]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-4ed8722fda
Database handbook: Contradicts the same handbook ('Using a named volume: Docker creates it with the correct ownership') and measured behaviour: a fresh named volume starts and restores fine as uid 999. [defects, defects #175211]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-c788469f80
API guide: Says two exceptions but names one; the text right after says endpoint health also needs credentials. [defects, defects #175212]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-ae6b517aec
API guide: Paraphrase of the round-2 unsupported security claim: 'restricted privileges' (and 'isolates the etcd process from the host root account', line 1465) is not measured; IMAGE_EVIDENCE.json records… [defects, defects #175213]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-4576e66d74
API guide: Unsupported isolation claim (same class as the corrected 'cannot escalate privileges or access the Docker daemon'). [defects, defects #175214]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-f81dc4e629
API guide: The image has no `id` command; docker exec etcd id fails. [defects, defects #175215]		lowfixed-before-releaseheld review (review model)—
RSD-etcd-5733110de4
API guide: 'respectively' swaps liveness and readiness (/livez is liveness, /readyz readiness; the Admin Handbook orders them correctly). [defects, defects #175216]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:9a7eeb94f59ccd9fe6f5e1927aa9fe71804ee01b3e2c522bdc368074fd418d25 · published digest sha256:9a7eeb94f59ccd9fe6f5e1927aa9fe71804ee01b3e2c522bdc368074fd418d25 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 105) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T11:44:48Z · failing Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T11:44:37Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3754669046 · transparency-log entry · integrated 2026-11-08T11:47:16Z) [ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:4d36902b4d88897871df9da220be342299b21b0f216f3e0307e766d9eeb14be4 · state attached · log index 3754671833 · transparency-log entry
    • kind sbom · digest sha256:4d36902b4d88897871df9da220be342299b21b0f216f3e0307e766d9eeb14be4 · state attached · log index 3754673832 · transparency-log entry
    • kind vsa · digest sha256:4d36902b4d88897871df9da220be342299b21b0f216f3e0307e766d9eeb14be4 · state attached · log index 3754676416 · transparency-log entry
    • kind provenance · digest sha256:9a7eeb94f59ccd9fe6f5e1927aa9fe71804ee01b3e2c522bdc368074fd418d25 · state attached · log index 3754678330 · transparency-log entry
    • kind sbom · digest sha256:9a7eeb94f59ccd9fe6f5e1927aa9fe71804ee01b3e2c522bdc368074fd418d25 · state attached · log index 3754679772 · transparency-log entry
    • kind vsa · digest sha256:9a7eeb94f59ccd9fe6f5e1927aa9fe71804ee01b3e2c522bdc368074fd418d25 · state attached · log index 3754681236 · transparency-log entry
    (at 2026-11-08T11:47:17Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/etcd/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-07T01:47:02Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:20109733fb8c67384629922a705edcf1de5666f2b1ab4398fa9f80ba4e369657 [clean-room rebuild ledger, runs[592]]
  • 2026-11-08T10:28:15Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:9a7eeb94f59ccd9fe6f5e1927aa9fe71804ee01b3e2c522bdc368074fd418d25 [clean-room rebuild ledger, runs[641]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-08T10:20:23Z [stage_runs, stage_runs chain 742 stage publish_image]
  • Archive manifests written2026-11-08T11:46:08Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 59 · probed 2026-11-03T04:55:42Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-08T11:48:27Z generated: by KitForge release/build_trail.py · generator commit 9a5f84354c4a786c95bbe5664588df2db561f454
  • 2026-11-08T11:49:39Z publication: promoted at 2026-11-08T11:49:00Z · promoted digest sha256:4d36902b4d88897871df9da220be342299b21b0f216f3e0307e766d9eeb14be4 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 364 · checklist status complete · checklist at 2026-11-08T11:49:39Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/etcd/v3.7.3-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/etcd/v3.7.3-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/etcd/v3.7.3-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-etcd-v3.7.3-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/etcd/v3.7.3-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/etcd/v3.7.3-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)438
chainssadb, ReadyStack's engine database (not published)742
defectssadb, ReadyStack's engine database (not published)etcd v3.7.3-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 742
held_roundssadb, ReadyStack's engine database (not published)chain 742
lesson_recallssadb, ReadyStack's engine database (not published)chain 742
micro_step_runssadb, ReadyStack's engine database (not published)chain 742
release_imagessadb, ReadyStack's engine database (not published)etcd v3.7.3-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 742
stage_runssadb, ReadyStack's engine database (not published)chain 742
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—