Ghost v6.75.0-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/ghost:v6.75.0-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/ghost:v6.75.0-CE-ubuntu24.04-r1
  • Index digestsha256:4fbc8f7996f6bcd8c2eb27555d892b6dce5ac0a03fd620dd92d430c22865ff89
  • linux/amd64 digestsha256:e0eb2e9983e8ca09c9101cc5652d2d7cdeed22b24e6f9308fcc85b4b61d3a75f
  • ArchiveReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 nowf2fc370001bf8e6c64fe6c0405aa07b1754c0f0884fd0fe29eacd83c21a2c6fb
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T15:28:06Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.trail.json
ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.trail.jsonReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.trail.mdGhost product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductGhost (ghost) [MANIFEST.json]
  • Release tagv6.75.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/ghost:v6.75.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:4fbc8f7996f6bcd8c2eb27555d892b6dce5ac0a03fd620dd92d430c22865ff89 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:e0eb2e9983e8ca09c9101cc5652d2d7cdeed22b24e6f9308fcc85b4b61d3a75f [ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.tar.gz (bytes 466735483) [MANIFEST.json]
  • Archive sha256 at publishf2fc370001bf8e6c64fe6c0405aa07b1754c0f0884fd0fe29eacd83c21a2c6fb [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/TryGhost/Ghost [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv6.75.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit9f8def4367a6f375ccf83791497f7319c0f233b2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash043a80d77755d9ce3eeb5be0e11cc429c364d3a30ab967417e5ee46106c00809 (files 9267) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:4e55fb42a697b71c9818d6596c2c76cfed5f0fa0920a65dc907355bba70fc29a [ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793810743 (utc 2026-11-04T16:45:43Z) [ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit 798f30ccf4f536be1bc4856d7801ba79970200c0 · dirty yes · first drive 3909
    • commit 92f2f07d6805e851f28fd697333da6ed7c235c16 · dirty yes · first drive 3920
    • commit ad5518ca1c1c954ca1b6beaf515310601159f544 · dirty yes · first drive 3937
    • commit 837c64ac100d91a0c228a7de2f398e67de10932a · dirty yes · first drive 3949
    • commit 222adc4e64adbe156e86c987498df9358fda82f6 · dirty yes · first drive 3959
    • commit fcb013a47b6acf007f0393214805da1af5e637f1 · dirty yes · first drive 3966
    • commit d731c9e0f6a9f36f56d28d09aead99eb92f2b336 · dirty yes · first drive 4032
    • commit 60e683e982890f94be6ec847d4971fb308805ca8 · dirty yes · first drive 4054
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain908 (created 2026-11-09T00:31:39Z · trigger customer_request · upstream version v6.75.0) [chains, chains #908]
  • Requestbuild request #602 (rebuild) (requested at 2026-11-09T00:28:35Z · requested by kitforge-agent · version v6.75.0) [build_requests, build_requests #602]
  • Reasonnew version v6.75.0-CE-ubuntu24.04-r1: Ghost 6.75.0 (follow-redirects CVE-2026-116689 fixed by its lock), apt and libpcre2 floors, PR #266 [build_requests, build_requests #602 request_reason]
  • Supersedesreadystack/ghost:v6.72.0-CE-ubuntu24.04-r5 (chain 796) [chains, chains #796]

The path through the harness

Fully recorded

1 chain · 8 drives · 18 stages · 6 rewinds

Chain 908 release · ready_to_ship

Created 2026-11-09T00:31:39Z, upstream v6.75.0, build request 602 [chains, chains #908]

DriveStartedMinutesBuild hostHow it stopped
39092026-11-09T00:32:03Z66.9build host 5 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3909]
39202026-11-09T01:53:14Z16.7build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3920]
39372026-11-09T03:28:33Z10.6build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3937]
39492026-11-09T04:17:34Z9.3build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3949]
39592026-11-09T05:16:14Z8.7build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3959]
39662026-11-09T06:02:16Z9.1build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3966]
40322026-11-09T14:08:54Z8.7build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4032]
40542026-11-09T15:18:07Z—build host 5 publish-held not recorded [drive_runs, drive_runs #4054]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-09T00:32:14Z2026-11-09T00:32:15Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 2283347141be…
acquire 2026-11-09T00:32:23Z2026-11-09T00:32:24Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 1dea23bfaa71…
license_file 56df280a2607…
custody_inputs c53ebf609685…
source_tree_hash 267e9918ea92…
source_file_manifest 9d084558a7b1…
plan 2026-11-09T00:32:59Z2026-11-09T00:33:00Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report fb58df0ded31…
input_pin_plan 834cb07b18ca…
toolchain_lock 1aaecb387a85…
assemble_kit 2026-11-09T00:45:53Z2026-11-09T00:45:54Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 4b8860d1015f…
build_recipe 0b1c3541911f…
system_pinning 01ba4719c80b…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 1b1a679a13dd…
verify_offline_sh 3e8184ea230c…
base_image_digests ff0edcb8bee3…
dockerfile_offline 5cd353afc89e…
first_build_digest a79aaf237ec7…
remediate 2026-11-09T00:46:21Z2026-11-09T00:46:22Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log ef4c047db84a…
security_report 0f2eccf7dcec…
build_kit 2026-11-09T01:01:53Z2026-11-09T01:01:53Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp fff6e77de0d0…
locked_digest 3240ec245e2b…
freeze_manifest 762b23075591…
offline_rebuild_transcript 44aa912375a4…
verdict 2026-11-09T01:04:22Z2026-11-09T01:04:23Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 015108d16e69…
publish_image 2026-11-09T01:05:37Z2026-11-09T01:05:38Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 90a4c92bf927…
promotion_record 05932e3d5fe1…
boot_instance 2026-11-09T01:06:36Z2026-11-09T01:06:40Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle f27257845559…
sbom 2026-11-09T01:07:23Z2026-11-09T01:07:24Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 42d94ca4665c…
sbom_json 8e177a751a43…
schema_discovery 2026-11-09T01:07:27Z2026-11-09T01:07:27Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 2abb29f42269…
dependency_tree 399a71f52f19…
table_classification 9e1fa117a322…
admin_handbook 2026-11-09T01:21:03Z2026-11-09T01:21:04Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 4339e49cd002…
admin_handbook 2253f33c40d6…
db_handbook 2026-11-09T01:33:24Z2026-11-09T01:33:25Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook a86c02de3df5…
seed_isolation 91cfe50fb268…
seed_data 2026-11-09T01:33:30Z2026-11-09T01:33:31Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 2d6d2e650613…
seed_cases_json 72b23aa7a4e3…
seed_validate 2026-11-09T01:33:33Z2026-11-09T01:33:34Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 03527387cd35…
usecase_validate 2026-11-09T01:33:50Z2026-11-09T01:33:51Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests da9e50c9e120…
test_results a30c14e5279d…
usecase_contract 70fcbc25d0e6…
finalize_docs 2026-11-09T01:33:58Z2026-11-09T01:33:59Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json a76934f814b6…
release_notes 771f0bc2fe8d…
api_integration_guide 95f4efbdd47f…
package_archive invalidated 2026-11-09T15:17:38Z 2026-11-09T01:38:54Z2026-11-09T14:17:32Z7
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 5e102f8d046a…
checksums aa9538d191b9…
verify_md 519754daa026…
rebuild_md e9798724f1ca…
manifest_txt b1b623d418e6…
actions_jsonl 74b4f68e97b8…
provenance_md 0a4f35e0d456…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json fa7f3e04df3c…

[stage_runs]

Rewinds

  • 2026-11-09T02:54:29Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27893]
  • 2026-11-09T04:10:31Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27967]
  • 2026-11-09T05:03:01Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28001]
  • 2026-11-09T05:58:03Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28053]
  • 2026-11-09T07:05:34Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28160]
  • 2026-11-09T15:17:38Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29266]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T14:17:32Z.

120 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 07374 L-A183, L-A15
remediate2001 07425 L-A183, L-A15
admin_handbook591903 4506169 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook562103 6449864 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate1001 01586 L-A59

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

6 rounds, 6 counted, $13.16 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T02:10:59Z 1711 findings to repackage [held_rounds, held_rounds #1565] $2.42 3 rounds, $40.00 a66dfede0336…
22026-11-09T03:40:14Z 068 findings to repackage [held_rounds, held_rounds #1570] $1.99 3 rounds, $40.00 31f38791b64d…
32026-11-09T04:27:56Z 0116 findings to repackage [held_rounds, held_rounds #1578] $2.47 3 rounds, $40.00 1dfb100629f7…
42026-11-09T05:25:56Z 017 findings to repackage [held_rounds, held_rounds #1584] $2.25 3 rounds, $40.00 4ec1a02b0204…
52026-11-09T06:12:26Z 017 findings to repackage [held_rounds, held_rounds #1593] $2.34 3 rounds, $40.00 12867b18d075…
62026-11-09T14:18:26Z 003 clean to publish [held_rounds, held_rounds #1630] $1.69 3 rounds, $40.00 5e102f8d046a…

Defects

Fully recorded
  • Ledger entries70 [defects, defects where product_slug=ghost and this tag or chain]
  • Disclosed in the archive70 [docs/defects/defects.json, entries]

70 ledger entries: by severity high 17, critical 1, low 52; by status open 1, fixed-before-release 69.

DefectSeverityStatusFound byFixed in
RSD-ghost-0303ea13c7
First visitor can claim the administrator account until setup is completed [defects, defects #188606]		highopenbuild strategy record—
RSD-ghost-2f5d99bbc4
Admin handbook: The 'Moving to a New MySQL Server' restore command fails: docker exec needs a container name, and the new server is not in a container here, so it must use a throwaway mysql:8.4 client (as the later… [defects, defects #190337]		criticalfixed-before-releaseheld review (review model)—
RSD-ghost-8fde4db8c1
Admin handbook: --env-file does not interpret quotes: the quote characters become part of the password, so a customer following this sentence with a special-character password gets 'Access denied' and the container… [defects, defects #190338]		highfixed-before-releaseheld review (review model)—
RSD-ghost-be7c631273
Admin handbook: Same defect as line 408: quoting the password line in the env file makes the quotes part of the password and Ghost cannot connect. [defects, defects #190339]		highfixed-before-releaseheld review (review model)—
RSD-ghost-bb5269426d
Database handbook: Tells the customer to quote the --env-file argument and the password line; a quoted password in an env file is taken literally and the database refuses it. [defects, defects #190340]		highfixed-before-releaseheld review (review model)—
RSD-ghost-4a412db53c
Database handbook: Confusing statement that mixes the -e form with the env file and hides the rule that env-file values are not quoted. [defects, defects #190341]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-b19af4f201
Admin handbook: States that the Owner is an account baked into the image, the opposite of the handbook's own credential facts; a customer may look for default credentials that do not exist. [defects, defects #190342]		highfixed-before-releaseheld review (review model)—
RSD-ghost-fcf6092cc4
Database handbook: Says unauthenticated site, admin and health-endpoint requests are never redirected; a health probe written from this sentence gets 301 instead of 200. [defects, defects #190343]		highfixed-before-releaseheld review (review model)—
RSD-ghost-b1b44a8623
Database handbook: Following the advice loses the file log (Ghost keeps the deleted inode open, disk is not freed, no new file appears) while the handbook promises a new file on the next event. [defects, defects #190344]		highfixed-before-releaseheld review (review model)—
RSD-ghost-2de93b7c98
Admin handbook: The documented connectivity check cannot take the password (no -i/-t), so it always reports 'Access denied (using password: NO)' and sends the customer looking for a credential fault that does not… [defects, defects #190345]		highfixed-before-releaseheld review (review model)—
RSD-ghost-d32e934895
Admin handbook: Contradicts the earlier section of the same handbook, and is false when the user may create the database. [defects, defects #190346]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-46aa2d5ff1
Admin handbook: Contradicts the handbook's other health statements: the endpoint does not tell whether the database is accessible. [defects, defects #190347]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-1ea9ea2010
Database handbook: Contradicts the handbook's own explanation of the health endpoint. [defects, defects #190348]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-8470f8a5ed
Admin handbook: `GET /` takes no Content API key, and the quoted error text is not a fixed answer. [defects, defects #190349]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-9d73a499f7
Admin handbook: Confuses the GET answer with the POST payload. [defects, defects #190350]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-fc8a1f0276
Admin handbook: Absolute prohibition contradicted by the handbook's own database-password-change and special-character procedures. [defects, defects #190351]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-0bfd159ccc
Database handbook: False: the user comes from the Dockerfile's USER line, not the ENTRYPOINT, and `docker run --user` changes it. [defects, defects #190352]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-293c1c8ba9
Database handbook: Claims the process has no seccomp restrictions, which is untrue for a default `docker run`. [defects, defects #190353]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-07af31f3b7
Database handbook: Blanket prohibition contradicts the handbook's own logging instructions. [defects, defects #190354]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-1b9a4f85c7
Admin handbook: Describes a per-architecture rebuild and digest that the kit refuses to perform. [defects, defects #190355]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-c6ed1391eb
Admin handbook: Says unauthenticated requests bypass the https redirect, which contradicts the sentence before it and the measured behaviour: the unauthenticated health endpoint and site pages get 301, so a health… [defects, defects #191973]		highfixed-before-releaseheld review (review model)—
RSD-ghost-265ccd2a2c
Admin handbook: Same defect as round 1: 'Unauthenticated requests' answer without a redirect contradicts the bullet list directly above, where the unauthenticated site pages and /ghost/api/admin/site/ are redirected. [defects, defects #191974]		highfixed-before-releaseheld review (review model)—
RSD-ghost-e42b05be14
Admin handbook: Health endpoint described as available regardless of url scheme; with the documented https url a probe without the header gets 301 (contradicts the handbook's own Health Check facts). [defects, defects #191975]		highfixed-before-releaseheld review (review model)—
RSD-ghost-f86532d44f
Admin handbook: False: public site pages are redirected (GET / -> 301) with the documented https url; contradicts the previous paragraph and the Health Monitoring text. [defects, defects #191976]		highfixed-before-releaseheld review (review model)—
RSD-ghost-3cf926eb2e
Database handbook: Same round-1 defect: unauthenticated requests are said not to redirect, but the unauthenticated site pages and health endpoint (listed in the same paragraph) get 301. [defects, defects #191977]		highfixed-before-releaseheld review (review model)—
RSD-ghost-8e981d0eca
Database handbook: False: public site pages get 301 with an https url (contradicts the preceding sentence of the same paragraph and the 'API authentication' section of this handbook). [defects, defects #191978]		highfixed-before-releaseheld review (review model)—
RSD-ghost-b98e4bbe64
Admin handbook: The command above passes the password only through --env-file; there is no -e password argument to quote, and the sentence hides the rule that env-file values are not quoted (round-1 minor,… [defects, defects #191979]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-4007fd81c2
Database handbook: The prohibition contradicts the handbook's own 'Changing the database password' procedure under Configuration and secrets (update ghost.env, then docker run), and step 3 tells the customer to pass… [defects, defects #191980]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-0c457c44c4
Database handbook: Rotation values are wrong for this image: effective config is period 1d, count 10. [defects, defects #191981]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-fbe37d3070
Admin handbook: The example adds stderr to ["file","stdout","stderr"]; it does not redirect or replace anything. [defects, defects #191982]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-ebf79f29f3
Admin handbook: Route does not exist: sign-in is POST /ghost/api/admin/session/. [defects, defects #191983]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-1419da666d
Admin handbook: Contradicted by the procedure two paragraphs below it, which changes the hash from the host with docker exec. [defects, defects #191984]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-e280f69284
Database handbook: Reversed: after setup the endpoint returns status true. [defects, defects #191985]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-6b77ca185c
Admin handbook: Following the restore steps verbatim restores into the container named `mysql` (the old server), not into mysql-new, so Ghost pointed at mysql-new finds an empty database and shows the setup wizard. [defects, defects #191986]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-28479cf415
Admin handbook: Measured on the documented run command (url=https://blog.example.com, no X-Forwarded-Proto): curl http://localhost:2368/ghost/api/admin/site/ -> 301, GET / -> 301, GET /ghost -> 301 (Location… [defects, defects #194494]		highfixed-before-releaseheld review (review model)—
RSD-ghost-0ad21c6e00
Admin handbook: curl -s -o /dev/null -w '%{http_code}' http://localhost:2368/ghost/api/admin/site/ -> 301 on the documented https run command; with -H 'X-Forwarded-Proto: https' -> 200. [defects, defects #194495]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-1a867ff08a
Admin handbook: Health probe stated without the X-Forwarded-Proto condition that the documented https run command needs. [defects, defects #194496]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-f0960225d1
Admin handbook: Contradicts the same section (Unauthenticated users can ... [defects, defects #194497]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-347f9ce364
Admin handbook: The file shown under this step contains only database__connection__password=YOUR_DB_PW; ghost.env never holds the host (the run command passes database__connection__host with -e). [defects, defects #194498]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-8017e9a458
Admin handbook: The standard run command has no password -e argument: it reads the password from --env-file ./ghost.env. [defects, defects #194499]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-a4e82b954c
Admin handbook: Same as the Operating-facts finding: the documented run command reads the password from ghost.env; verified that editing ghost.env works (healthy) and that the old ghost.env fails with exit code 2. [defects, defects #194500]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-d87133ac38
Admin handbook: The documented command passes the password only through --env-file ./ghost.env, so there is no -e argument for the shell to interpret; values in an env file are read literally (tested: ghost.env… [defects, defects #194501]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-c6035567eb
Database handbook: The command shown for this section reads the password through --env-file ./ghost.env; no -e password argument exists to quote. [defects, defects #194502]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-f228f651ba
Docker Hub README: The README's own run command uses --env-file ./ghost.env, and the paragraph above says no quotes in the env file; the single-quote advice applies only to -e. [defects, defects #194503]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-03b751bbfe
Database handbook: The same Configuration and secrets section later (Changing the database password) says to update ghost.env; the standard command has no password argument to replace. [defects, defects #194504]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-fa2626e8c9
Database handbook: Start command differs from the documented run command and from the secrets-file procedure. [defects, defects #194505]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-dbd62fc6f6
Database handbook: stderr does not replace stdout. [defects, defects #194506]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-b12743a9ce
Database handbook: Ran with database__connection__host=nosuchhost: exit code 2, log line 'Invalid database host.' (no access-denied message). [defects, defects #194507]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-85f5490458
Database handbook: Contradicts the Operating facts and the 'Restoring' subsection of the same handbook, which say tar fails with an error message; only mysql restores nothing silently. [defects, defects #194508]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-f84c2b04e7
Database handbook: IMAGE_CONFIG.json: ExposedPorts 2368/tcp, User node; the container ran on this host without extra capabilities. [defects, defects #194509]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-7a4ec94ce3
Admin handbook: The archive's docs/admin-guide holds only ADMIN_HANDBOOK.md (this document) and its transcripts; no separate 'Ghost Admin Handbook' covering Ghost's own admin interface is included. [defects, defects #194510]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-3e42c7dff1
Admin handbook: The example password given for the setup wizard breaks the rule stated in the sentence before it (no 'password'); a customer who types it is refused. [defects, defects #196540]		highfixed-before-releaseheld review (review model)—
RSD-ghost-3160a3774a
Admin handbook: First start on an empty database took far longer than 'a few seconds'. [defects, defects #196541]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-16a891e090
Admin handbook: Readiness on first start is not 'a few seconds'. [defects, defects #196542]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-1047ed72c1
Admin handbook: `docker restart` keeps the container's original -e settings, so the flag stays and device verification stays off; the handbook elsewhere (Starting the container, Sign-in codes) says to stop, remove… [defects, defects #196543]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-22abb4d536
Database handbook: Same as the admin handbook: restarting does not remove an -e variable; the same handbook (Sign-in codes for new devices, line ~1690) says to recreate the container. [defects, defects #196544]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-61efc683da
Admin handbook: The wizard is served by the running container; it cannot be completed before Ghost starts. [defects, defects #196545]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-0977e01ba1
Admin handbook: Unscoped 200: on the documented run command (url=https://blog.example.com) a plain request answers 301. [defects, defects #196546]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-3ca2ca4294
Database handbook: A mail server that requires authentication is a working mail configuration and needs no flag; the flag is for deployments without working mail (as the rest of the handbook says). [defects, defects #196547]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-1f3b34b03d
Admin handbook: Following the 'Moving to a New MySQL Server' procedure in the order printed starts Ghost before the restore, fails on the existing container name and leaves Ghost serving the default settings (site… [defects, defects #199627]		highfixed-before-releaseheld review (review model)—
RSD-ghost-f9d17e6d09
Admin handbook: Says the env file is read at every container start; Docker reads it only at docker run. [defects, defects #199628]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-ec2d61e8e7
Admin handbook: logging__transports is an -e variable; restarting does not apply a new value. [defects, defects #199629]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-890f129afe
Admin handbook: 'Restart the container' after adding an -e flag does not apply the flag. [defects, defects #199630]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-c7554229c8
Database handbook: Fix and restart cannot change the environment of a container that exited with code 2. [defects, defects #199631]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-15fb1cdac9
Database handbook: 'Restart the container with corrected values' is not possible with docker restart. [defects, defects #199632]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-0a33b5d787
Database handbook: States Ghost chooses between serving HTTP and HTTPS from url, contradicting 'Ghost does not serve HTTPS itself'. [defects, defects #199633]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-574f417954
Database handbook: Claims uppercase transport names are not allowed; Ghost accepts them. [defects, defects #199634]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-50c1d004f5
Database handbook: Says --env-file is passed to the container at every start. [defects, defects #212427]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-fb3b4db819
Database handbook: The file is not needed at a plain start or restart, only when the container is created. [defects, defects #212428]		lowfixed-before-releaseheld review (review model)—
RSD-ghost-a742f17e4c
Database handbook: The move procedure points at the Restoring steps, which restore into the old server and already start Ghost, then asks for a further docker run. [defects, defects #212429]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:e0eb2e9983e8ca09c9101cc5652d2d7cdeed22b24e6f9308fcc85b4b61d3a75f · published digest sha256:e0eb2e9983e8ca09c9101cc5652d2d7cdeed22b24e6f9308fcc85b4b61d3a75f · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 402) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T15:19:34Z · failing Docker Scout counts 99 packages with copyleft licences (GPL, LGPL, MPL), 96 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T15:18:17Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3766627109 · transparency-log entry · integrated 2026-11-09T15:26:26Z) [ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:4fbc8f7996f6bcd8c2eb27555d892b6dce5ac0a03fd620dd92d430c22865ff89 · state attached · log index 3766627915 · transparency-log entry
    • kind sbom · digest sha256:4fbc8f7996f6bcd8c2eb27555d892b6dce5ac0a03fd620dd92d430c22865ff89 · state attached · log index 3766628498 · transparency-log entry
    • kind vsa · digest sha256:4fbc8f7996f6bcd8c2eb27555d892b6dce5ac0a03fd620dd92d430c22865ff89 · state attached · log index 3766629062 · transparency-log entry
    • kind provenance · digest sha256:e0eb2e9983e8ca09c9101cc5652d2d7cdeed22b24e6f9308fcc85b4b61d3a75f · state attached · log index 3766629595 · transparency-log entry
    • kind sbom · digest sha256:e0eb2e9983e8ca09c9101cc5652d2d7cdeed22b24e6f9308fcc85b4b61d3a75f · state attached · log index 3766629889 · transparency-log entry
    • kind vsa · digest sha256:e0eb2e9983e8ca09c9101cc5652d2d7cdeed22b24e6f9308fcc85b4b61d3a75f · state attached · log index 3766630238 · transparency-log entry
    (at 2026-11-09T15:26:26Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/ghost/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T02:11:06Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:e0eb2e9983e8ca09c9101cc5652d2d7cdeed22b24e6f9308fcc85b4b61d3a75f [clean-room rebuild ledger, runs[680]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-09T01:05:38Z [stage_runs, stage_runs chain 908 stage publish_image]
  • Archive manifests written2026-11-09T15:22:57Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 756 · probed 2026-11-09T14:17:09Z · source g8) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T15:28:06Z generated: by KitForge release/build_trail.py · generator commit 60a6d2c97ec3cf892fe7edaac0f7a56017938207
  • 2026-11-09T15:30:06Z publication: promoted at 2026-11-09T15:28:45Z · promoted digest sha256:4fbc8f7996f6bcd8c2eb27555d892b6dce5ac0a03fd620dd92d430c22865ff89 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 419 · checklist status complete · checklist at 2026-11-09T15:30:06Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/ghost/v6.75.0-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/ghost/v6.75.0-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/ghost/v6.75.0-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/ghost/v6.75.0-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/ghost/v6.75.0-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)602
chainssadb, ReadyStack's engine database (not published)908
defectssadb, ReadyStack's engine database (not published)ghost v6.75.0-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 908
held_roundssadb, ReadyStack's engine database (not published)chain 908
lesson_recallssadb, ReadyStack's engine database (not published)chain 908
micro_step_runssadb, ReadyStack's engine database (not published)chain 908
release_imagessadb, ReadyStack's engine database (not published)ghost v6.75.0-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 908
stage_runssadb, ReadyStack's engine database (not published)chain 908
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—