flannel v0.28.10-CE-ubuntu24.04-r4 build trail
How ReadyStack built readystack/flannel:v0.28.10-CE-ubuntu24.04-r4 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/flannel:v0.28.10-CE-ubuntu24.04-r4 - Index digestsha256:c2a2a147857b3a6458b50401ebe587588129ea150696345b8d8441e14911118f
- linux/amd64 digestsha256:ba63df10b1e4e259b53711033c6c7e278316097476a307a626c07baaf12862c9
- Archive
ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.tar.gz - Archive SHA-256 now84c8d006419868d49d304fc80a51db345ca484200f7feb161f315d548ca8d39b
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-13T15:25:18Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.trail.json.sigstore ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- Productflannel (flannel) [MANIFEST.json]
- Release tagv0.28.10-CE-ubuntu24.04-r4 [MANIFEST.json]
- Imagereadystack/flannel:v0.28.10-CE-ubuntu24.04-r4 [MANIFEST.json]
- Image index digestsha256:c2a2a147857b3a6458b50401ebe587588129ea150696345b8d8441e14911118f [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:ba63df10b1e4e259b53711033c6c7e278316097476a307a626c07baaf12862c9 [ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.tar.gz (bytes 462849147) [MANIFEST.json]
- Archive sha256 at publish84c8d006419868d49d304fc80a51db345ca484200f7feb161f315d548ca8d39b [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/flannel-io/flannel [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv0.28.10 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit0f70536f15f281279dab39fb9d575c646c7eea34 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashbbe66e8e8707707772a4adfd0736949bd0a08956e8fc55fadf84c9ff7fd05e33 (files 233) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:7029eb48a8e7297b952a5de7a4d5bce5fcfcbecf2550b75dbd1d5a9e34d48451 [ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794578566 (utc 2026-11-13T14:02:46Z) [ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.26.11-bookworm@sha256:dc40a13b61304647ed7e5d581d246b86413dfc29d63c6d018310feb93cd98fc0 · platform digest sha256:79ecd0a7157c7a4cf3b281ced8465350591bf54fedab540e75374a003e1fde7e
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.rebuild.json, engine]
- Engine commit(s)
- commit 3472fe43f1bbcee2e45028c90861e5bdd10a4fdd · dirty yes · first drive 4602
- commit f264c5a93fc5fe548e62fe3bfbeb279b813432b8 · dirty yes · first drive 4605
Why this release exists
Fully recorded- Chain1084 (created 2026-11-13T15:00:29Z · trigger customer_request · upstream version v0.28.10) [chains, chains #1084]
- Requestbuild request #759 (rebuild) (requested at 2026-11-13T14:02:48Z · requested by kitforge-agent · version v0.28.10) [build_requests, build_requests #759]
- Reasonrerelease agenda REVISION -> v0.28.10-CE-ubuntu24.04-r4 (decay loop, IMP-08) [build_requests, build_requests #759 request_reason]
- Supersedesreadystack/flannel:v0.28.10-CE-ubuntu24.04-r3 (chain 1014) [chains, chains #1014]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1084 release · ready_to_ship
Created 2026-11-13T15:00:29Z, upstream v0.28.10, build request 759 [chains, chains #1084]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4602 | 2026-11-13T15:00:53Z | 13.8 | build host 3 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4602] |
| 4605 | 2026-11-13T15:20:48Z | — | build host 3 publish-held | not recorded [drive_runs, drive_runs #4605] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-13T15:01:03Z | 2026-11-13T15:01:04Z | 1 | 4
|
order_json 1dcc545edf5c… |
acquire |
2026-11-13T15:01:08Z | 2026-11-13T15:01:09Z | 1 | 12
|
source_tree b88ace0d8718…license_file cfc7749b96f6…custody_inputs ee5a895d08b9…source_tree_hash 942abfcff1f3…source_file_manifest ca129f84c774… |
plan |
2026-11-13T15:01:37Z | 2026-11-13T15:01:38Z | 1 | 10
|
recon_report c5eac8841fa2…input_pin_plan 29008f37c885…toolchain_lock a585f82c0767… |
assemble_kit |
2026-11-13T15:04:03Z | 2026-11-13T15:04:04Z | 1 | 27
|
dockerfile c57d72cded3c…build_recipe e65b6501a307…system_pinning be0f0e7ecde1…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health 842e264fd0af…verify_offline_sh 3e8184ea230c…base_image_digests 005fd80e5ae9…dockerfile_offline c57d72cded3c…first_build_digest 98812251356e… |
remediate |
2026-11-13T15:04:33Z | 2026-11-13T15:04:34Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 915b1aefaf7b…security_report d321b23ee5e0… |
build_kit |
2026-11-13T15:08:11Z | 2026-11-13T15:08:12Z | 1 | 9
|
cosign_stamp 33ff7c60c1fa…locked_digest f70f0f992367…freeze_manifest c088f6b19307…offline_rebuild_transcript 9eef6c827c6a… |
verdict |
2026-11-13T15:08:54Z | 2026-11-13T15:08:55Z | 1 | 8
|
scout_verdict d5b3fec86ddf… |
publish_image |
2026-11-13T15:09:45Z | 2026-11-13T15:09:45Z | 1 | 7
|
hub_readme f4b191b8a3e5…promotion_record 3f2f47935f6f… |
boot_instance |
2026-11-13T15:09:48Z | 2026-11-13T15:09:49Z | 1 | 3
|
instance_handle 09e1e0aeed4d… |
sbom |
2026-11-13T15:10:00Z | 2026-11-13T15:10:01Z | 1 | 5
|
sbom_md 27488f567f3d…sbom_json bdc40ea2b312… |
schema_discovery |
2026-11-13T15:10:04Z | 2026-11-13T15:10:04Z | 1 | 7
|
schema_hash 870a2db487a6…dependency_tree 8e7270753f36…table_classification 57f6cc7378c7… |
admin_handbook |
2026-11-13T15:10:07Z | 2026-11-13T15:10:08Z | 1 | 7
|
api_map 3a5ce15d2d44…admin_handbook 3b18775908ef… |
db_handbook |
2026-11-13T15:10:10Z | 2026-11-13T15:10:11Z | 1 | 8
|
db_handbook 9506db9e7a68…seed_isolation 14ecd5786378… |
seed_data |
2026-11-13T15:10:13Z | 2026-11-13T15:10:14Z | 1 | 6
|
seed_data_sql 8fc4aaed927b…seed_cases_json 09672f22dee7… |
seed_validate |
2026-11-13T15:10:16Z | 2026-11-13T15:10:17Z | 1 | 3
|
seed_data_contract d52fd1ba9b45… |
usecase_validate |
2026-11-13T15:10:20Z | 2026-11-13T15:10:21Z | 1 | 10
|
failed_tests 3626c8c5755b…passed_tests 0ee163187b3e…test_results b0539dcedcd9…usecase_contract 806a7f2be637… |
finalize_docs |
2026-11-13T15:10:25Z | 2026-11-13T15:10:25Z | 1 | 9
|
defects_json c1f435a85556…release_notes 9ee679c916d2…api_integration_guide a0366c766f3e… |
package_archive invalidated 2026-11-13T15:20:18Z |
2026-11-13T15:14:41Z | 2026-11-13T15:14:43Z | 1 | 37 (final gate PASS)
|
sale_tar 35e609bfae46…checksums c08b7eba8719…verify_md 6f35c17544c4…rebuild_md 8e394366302d…manifest_txt b0ed2c191ce9…actions_jsonl e27518ce139d…provenance_md bf6e7e301a00…assetchain_log_md e9eccaec0c0f…assetchain_log_json d372f5ba8c20… |
[stage_runs]
Rewinds
- 2026-11-13T15:20:18Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36478]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-13T15:14:43Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 6827 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 7341 | L-A183, L-A15 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.21 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-13T15:15:24Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1890] | $0.21 | 3 rounds, $40.00 | 35e609bfae46… |
Defects
Fully recorded- Ledger entries0 [defects, defects where product_slug=flannel and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
0 ledger entries.
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:ba63df10b1e4e259b53711033c6c7e278316097476a307a626c07baaf12862c9 · published digest sha256:ba63df10b1e4e259b53711033c6c7e278316097476a307a626c07baaf12862c9 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 102) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T15:21:10Z · failing Docker Scout counts 106 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T15:20:58Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3856571575 · transparency-log entry
- log index 3856574393 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3856839001 · transparency-log entry · integrated 2026-11-13T15:23:51Z) [ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:c2a2a147857b3a6458b50401ebe587588129ea150696345b8d8441e14911118f · state attached · log index 3856841725 · transparency-log entry
- kind sbom · digest sha256:c2a2a147857b3a6458b50401ebe587588129ea150696345b8d8441e14911118f · state attached · log index 3856843559 · transparency-log entry
- kind vsa · digest sha256:c2a2a147857b3a6458b50401ebe587588129ea150696345b8d8441e14911118f · state attached · log index 3856845222 · transparency-log entry
- kind provenance · digest sha256:ba63df10b1e4e259b53711033c6c7e278316097476a307a626c07baaf12862c9 · state attached · log index 3856846471 · transparency-log entry
- kind sbom · digest sha256:ba63df10b1e4e259b53711033c6c7e278316097476a307a626c07baaf12862c9 · state attached · log index 3856848410 · transparency-log entry
- kind vsa · digest sha256:ba63df10b1e4e259b53711033c6c7e278316097476a307a626c07baaf12862c9 · state attached · log index 3856850529 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/flannel/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-13T15:15:28Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:ba63df10b1e4e259b53711033c6c7e278316097476a307a626c07baaf12862c9 [clean-room rebuild ledger, runs[840]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-13T15:09:45Z [stage_runs, stage_runs chain 1084 stage publish_image]
- Archive manifests written2026-11-13T15:22:23Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 924 · probed 2026-11-13T15:06:14Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-13T15:25:18Z generated: by KitForge release/build_trail.py · generator commit f264c5a93fc5fe548e62fe3bfbeb279b813432b8
- 2026-11-13T15:26:45Z publication: promoted at 2026-11-13T15:25:58Z · promoted digest sha256:c2a2a147857b3a6458b50401ebe587588129ea150696345b8d8441e14911118f · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 551 · checklist status complete · checklist at 2026-11-13T15:26:45Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/flannel/v0.28.10-CE-ubuntu24.04-r4/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/flannel/v0.28.10-CE-ubuntu24.04-r4/), as staged for publishing | — |
ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.rebuild.json | beside the archive (prodasset /data/production/flannel/v0.28.10-CE-ubuntu24.04-r4/), as staged for publishing | — |
ReadyStack-flannel-v0.28.10-CE-ubuntu24.04-r4.rebuild.json.sigstore | beside the archive (prodasset /data/production/flannel/v0.28.10-CE-ubuntu24.04-r4/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/flannel/v0.28.10-CE-ubuntu24.04-r4/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 759 |
chains | sadb, ReadyStack's engine database (not published) | 1084 |
defects | sadb, ReadyStack's engine database (not published) | flannel v0.28.10-CE-ubuntu24.04-r4 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1084 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1084 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1084 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1084 |
release_images | sadb, ReadyStack's engine database (not published) | flannel v0.28.10-CE-ubuntu24.04-r4 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1084 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1084 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |