Fluent Bit v5.1.5-CE-ubuntu24.04-r2 build trail
How ReadyStack built readystack/fluentbit:v5.1.5-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/fluentbit:v5.1.5-CE-ubuntu24.04-r2 - Index digestsha256:43ae9f61c2164e1dd2c479b170652f8426a0552e3f5b94cf2fb006c38a005492
- linux/amd64 digestsha256:502fb090ac9c5783c2d500142e7164348ad3e9d85a43c6e42fd071d5c0d2c7f7
- Archive
ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.tar.gz - Archive SHA-256 nowd1e250af6283c151dda451477ba9c84e8928a40071e2c5752353f01a2877dbc7
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-07T04:20:52Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductFluent Bit (fluentbit) [MANIFEST.json]
- Release tagv5.1.5-CE-ubuntu24.04-r2 [MANIFEST.json]
- Imagereadystack/fluentbit:v5.1.5-CE-ubuntu24.04-r2 [MANIFEST.json]
- Image index digestsha256:43ae9f61c2164e1dd2c479b170652f8426a0552e3f5b94cf2fb006c38a005492 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:502fb090ac9c5783c2d500142e7164348ad3e9d85a43c6e42fd071d5c0d2c7f7 [ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.tar.gz (bytes 348784107) [MANIFEST.json]
- Archive sha256 at publishd1e250af6283c151dda451477ba9c84e8928a40071e2c5752353f01a2877dbc7 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/fluent/fluent-bit [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv5.1.5 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit0039c4f0d1b530bedd8448df2fa4c301d58a5b91 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash7def5b9342ce1b28b634d143f96df76aa9c13767466fc9d8f824eacd3bb0b3c9 (files 12229) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:a08689c4e0aa60fa0e67c8a5609e0de7cc3ae1cd51df1cbf8e6f4285b71958ed [ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1792554706 (utc 2026-10-21T03:51:46Z) [ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.rebuild.json, engine]
- Engine commit(s)
- commit 07abd1e1c1197982ae81cf5d46861dd8f90c3cf6 · dirty yes · first drive 3552
- commit 010aa541a25a24b2cef6b4553320a093daeed530 · dirty yes · first drive 3561
Why this release exists
Fully recorded- Chain832 (created 2026-11-07T03:17:09Z · trigger customer_request · upstream version v5.1.5) [chains, chains #832]
- Requestbuild request #510 (rebuild) (requested at 2026-11-07T02:01:20Z · requested by kitforge-agent · version v5.1.5) [build_requests, build_requests #510]
- Reasonrerelease agenda REVISION -> v5.1.5-CE-ubuntu24.04-r2 (decay loop, IMP-08) [build_requests, build_requests #510 request_reason]
- Supersedesreadystack/fluentbit:v5.1.5-CE-ubuntu24.04-r1 (chain 711) [chains, chains #711]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 832 release · ready_to_ship
Created 2026-11-07T03:17:09Z, upstream v5.1.5, build request 510 [chains, chains #832]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 3552 | 2026-11-07T03:17:34Z | 29.4 | build host 2 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3552] |
| 3561 | 2026-11-07T04:16:18Z | — | build host 2 publish-held | not recorded [drive_runs, drive_runs #3561] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-07T03:17:45Z | 2026-11-07T03:17:45Z | 1 | 4
|
order_json 3b0eda1e2177… |
acquire |
2026-11-07T03:17:53Z | 2026-11-07T03:17:55Z | 1 | 12
|
source_tree b75fc49b5f35…license_file 0d542e0c8804…custody_inputs 1214b5324aed…source_tree_hash 808924c50bf9…source_file_manifest 05ba9610dcf7… |
plan |
2026-11-07T03:18:39Z | 2026-11-07T03:18:40Z | 1 | 10
|
recon_report 1c8827da42a4…input_pin_plan 0847204244d7…toolchain_lock 9ff0a4b28174… |
assemble_kit |
2026-11-07T03:24:52Z | 2026-11-07T03:24:53Z | 1 | 27
|
dockerfile d4ad620b051b…build_recipe 73d0e4af513a…system_pinning 31d355a306d5…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health 394aa8c4127a…verify_offline_sh 3e8184ea230c…base_image_digests fadf8c4c3f3d…dockerfile_offline d4ad620b051b…first_build_digest 5e2c1097f816… |
remediate |
2026-11-07T03:25:28Z | 2026-11-07T03:25:29Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log a1052bb2310c…security_report fb520120cb32… |
build_kit |
2026-11-07T03:35:51Z | 2026-11-07T03:35:52Z | 1 | 9
|
cosign_stamp ca858186ce1a…locked_digest 9e51f2ca5c1f…freeze_manifest 59c6956a1c66…offline_rebuild_transcript fa9f254e62ae… |
verdict |
2026-11-07T03:36:35Z | 2026-11-07T03:36:36Z | 1 | 8
|
scout_verdict 083dd3fe438a… |
publish_image |
2026-11-07T03:37:11Z | 2026-11-07T03:37:12Z | 1 | 7
|
hub_readme fe2904772b72…promotion_record 5bf980f49296… |
boot_instance |
2026-11-07T03:37:17Z | 2026-11-07T03:37:20Z | 2 | 3
|
instance_handle d832dac4dbc2… |
sbom |
2026-11-07T03:37:32Z | 2026-11-07T03:37:32Z | 1 | 5
|
sbom_md 7b413eafd498…sbom_json a5fee19d617f… |
schema_discovery |
2026-11-07T03:37:35Z | 2026-11-07T03:37:36Z | 1 | 7
|
schema_hash 1fc3955c0ec3…dependency_tree a3379f1fc936…table_classification 75ff2279e2b1… |
admin_handbook |
2026-11-07T03:37:52Z | 2026-11-07T03:37:53Z | 1 | 7
|
api_map aa3e65ee3bdc…admin_handbook 460b2ac32937… |
db_handbook |
2026-11-07T03:38:12Z | 2026-11-07T03:38:13Z | 1 | 8
|
db_handbook 1201c90216dd…seed_isolation d75a4857bec5… |
seed_data |
2026-11-07T03:38:22Z | 2026-11-07T03:38:23Z | 1 | 6
|
seed_data_sql 3a40074ec600…seed_cases_json 4dfa418abb17… |
seed_validate |
2026-11-07T03:38:25Z | 2026-11-07T03:38:26Z | 1 | 3
|
seed_data_contract 5aca59b9d9d0… |
usecase_validate |
2026-11-07T03:38:44Z | 2026-11-07T03:38:45Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 3397f73c9edc…test_results efefe6cc96b0…usecase_contract 8b357747b24c… |
finalize_docs |
2026-11-07T03:38:50Z | 2026-11-07T03:38:51Z | 1 | 9
|
defects_json 394a47ec20f9…release_notes 19ed88bbe02a…api_integration_guide dd3950f34e2b… |
package_archive invalidated 2026-11-07T04:15:49Z |
2026-11-07T03:46:53Z | 2026-11-07T03:46:54Z | 1 | 34 (final gate PASS)
|
sale_tar d18255435078…checksums a9bfb13464de…verify_md 9d539cebaa1d…rebuild_md dbccf28bb3e8…manifest_txt 9b34d1ea87d8…actions_jsonl a5fe66d4c9c4…provenance_md 5709d22be7d6…assetchain_log_md e9eccaec0c0f…assetchain_log_json 23c922d30bd7… |
[stage_runs]
Rewinds
- 2026-11-07T04:15:49Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #23664]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-07T03:46:54Z.
5 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 11174 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 10879 | L-A183, L-A15 |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 1831 | L-A59 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.43 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-07T03:47:22Z | 0 | 0 | 1 | clean to publish [held_rounds, held_rounds #1424] | $0.43 | 3 rounds, $40.00 | d18255435078… |
Defects
Fully recorded- Ledger entries2 [defects, defects where product_slug=fluentbit and this tag or chain]
- Disclosed in the archive2 [docs/defects/defects.json, entries]
2 ledger entries: by severity medium 1, low 1; by status open 2.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-fluentbit-edcdd9d680Unauthenticated monitoring API on port 2020 by default [defects, defects #159083] | medium | open | build strategy record | — |
RSD-fluentbit-b28cb8ab45Admin handbook: Overstated: ownership alone does not block access; mode matters. [defects, defects #159617] | low | open | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:502fb090ac9c5783c2d500142e7164348ad3e9d85a43c6e42fd071d5c0d2c7f7 · published digest sha256:502fb090ac9c5783c2d500142e7164348ad3e9d85a43c6e42fd071d5c0d2c7f7 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 293) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-07T04:16:39Z · failing Docker Scout counts 85 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-07T04:16:28Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3728711805 · transparency-log entry
- log index 3728713025 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3729515648 · transparency-log entry · integrated 2026-11-07T04:19:41Z) [ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:43ae9f61c2164e1dd2c479b170652f8426a0552e3f5b94cf2fb006c38a005492 · state attached · log index 3729516258 · transparency-log entry
- kind sbom · digest sha256:43ae9f61c2164e1dd2c479b170652f8426a0552e3f5b94cf2fb006c38a005492 · state attached · log index 3729516623 · transparency-log entry
- kind vsa · digest sha256:43ae9f61c2164e1dd2c479b170652f8426a0552e3f5b94cf2fb006c38a005492 · state attached · log index 3729517412 · transparency-log entry
- kind provenance · digest sha256:502fb090ac9c5783c2d500142e7164348ad3e9d85a43c6e42fd071d5c0d2c7f7 · state attached · log index 3729518407 · transparency-log entry
- kind sbom · digest sha256:502fb090ac9c5783c2d500142e7164348ad3e9d85a43c6e42fd071d5c0d2c7f7 · state attached · log index 3729519380 · transparency-log entry
- kind vsa · digest sha256:502fb090ac9c5783c2d500142e7164348ad3e9d85a43c6e42fd071d5c0d2c7f7 · state attached · log index 3729520428 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/fluentbit/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-07T03:47:26Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:502fb090ac9c5783c2d500142e7164348ad3e9d85a43c6e42fd071d5c0d2c7f7 [clean-room rebuild ledger, runs[600]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-07T03:37:12Z [stage_runs, stage_runs chain 832 stage publish_image]
- Archive manifests written2026-11-07T04:18:10Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 727 · probed 2026-11-07T03:30:44Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-07T04:20:52Z generated: by KitForge release/build_trail.py · generator commit 010aa541a25a24b2cef6b4553320a093daeed530
- 2026-11-07T04:22:10Z publication: promoted at 2026-11-07T04:21:22Z · promoted digest sha256:43ae9f61c2164e1dd2c479b170652f8426a0552e3f5b94cf2fb006c38a005492 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 328 · checklist status complete · checklist at 2026-11-07T04:22:10Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/fluentbit/v5.1.5-CE-ubuntu24.04-r2/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/fluentbit/v5.1.5-CE-ubuntu24.04-r2/), as staged for publishing | — |
ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.rebuild.json | beside the archive (prodasset /data/production/fluentbit/v5.1.5-CE-ubuntu24.04-r2/), as staged for publishing | — |
ReadyStack-fluentbit-v5.1.5-CE-ubuntu24.04-r2.rebuild.json.sigstore | beside the archive (prodasset /data/production/fluentbit/v5.1.5-CE-ubuntu24.04-r2/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/fluentbit/v5.1.5-CE-ubuntu24.04-r2/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 510 |
chains | sadb, ReadyStack's engine database (not published) | 832 |
defects | sadb, ReadyStack's engine database (not published) | fluentbit v5.1.5-CE-ubuntu24.04-r2 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 832 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 832 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 832 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 832 |
release_images | sadb, ReadyStack's engine database (not published) | fluentbit v5.1.5-CE-ubuntu24.04-r2 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 832 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 832 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |