Ghost v6.75.0-CE-ubuntu24.04-r2 build trail
How ReadyStack built readystack/ghost:v6.75.0-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/ghost:v6.75.0-CE-ubuntu24.04-r2 - Index digestsha256:c44a600794e1b7cf01c57542e6219ba559f0e14590ba28168f1fc89ac47233b3
- linux/amd64 digestsha256:ab9a52a09bbde7a05affc1e903d87ee67e4de90f5be3a6ac8d2fcf0946d0bbaf
- Archive
ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.tar.gz - Archive SHA-256 now141ee000a72ffc4cde0023a3dff1146d73f3aad80651963f5066de7f2db203ba
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-11T22:23:23Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductGhost (ghost) [MANIFEST.json]
- Release tagv6.75.0-CE-ubuntu24.04-r2 [MANIFEST.json]
- Imagereadystack/ghost:v6.75.0-CE-ubuntu24.04-r2 [MANIFEST.json]
- Image index digestsha256:c44a600794e1b7cf01c57542e6219ba559f0e14590ba28168f1fc89ac47233b3 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:ab9a52a09bbde7a05affc1e903d87ee67e4de90f5be3a6ac8d2fcf0946d0bbaf [ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.tar.gz (bytes 466726870) [MANIFEST.json]
- Archive sha256 at publish141ee000a72ffc4cde0023a3dff1146d73f3aad80651963f5066de7f2db203ba [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/TryGhost/Ghost [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv6.75.0 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit9f8def4367a6f375ccf83791497f7319c0f233b2 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash043a80d77755d9ce3eeb5be0e11cc429c364d3a30ab967417e5ee46106c00809 (files 9267) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:7fac0b4e20bc10d1c908edddbdc6cda87a9c8ff6599c6397ebed8acb9cea06f7 [ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794391189 (utc 2026-11-11T09:59:49Z) [ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.rebuild.json, engine]
- Engine commit(s)
- commit fb3c8c212feaeb8607d5b295a821989cf0ab3e1e · dirty yes · first drive 4305
- commit 08040de9cc25311cfbe28aaa295df2520044e9e2 · dirty yes · first drive 4311
Why this release exists
Fully recorded- Chain979 (created 2026-11-11T21:17:08Z · trigger customer_request · upstream version v6.75.0) [chains, chains #979]
- Requestbuild request #676 (rebuild) (requested at 2026-11-11T09:59:51Z · requested by kitforge-agent · version v6.75.0) [build_requests, build_requests #676]
- Reasonrerelease agenda REVISION -> v6.75.0-CE-ubuntu24.04-r2 (decay loop, IMP-08) [build_requests, build_requests #676 request_reason]
- Supersedesreadystack/ghost:v6.75.0-CE-ubuntu24.04-r1 (chain 908) [chains, chains #908]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 979 release · ready_to_ship
Created 2026-11-11T21:17:08Z, upstream v6.75.0, build request 676 [chains, chains #979]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4305 | 2026-11-11T21:17:32Z | 38 | build host 4 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4305] |
| 4311 | 2026-11-11T22:10:02Z | — | build host 4 publish-held | not recorded [drive_runs, drive_runs #4311] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-11T21:17:43Z | 2026-11-11T21:17:44Z | 1 | 4
|
order_json b823428b7f97… |
acquire |
2026-11-11T21:17:52Z | 2026-11-11T21:17:53Z | 1 | 12
|
source_tree 1dea23bfaa71…license_file 56df280a2607…custody_inputs c53ebf609685…source_tree_hash 267e9918ea92…source_file_manifest 9d084558a7b1… |
plan |
2026-11-11T21:18:34Z | 2026-11-11T21:18:35Z | 1 | 10
|
recon_report 9662793b2ce1…input_pin_plan 75229322e447…toolchain_lock c02b9954b773… |
assemble_kit |
2026-11-11T21:28:30Z | 2026-11-11T21:28:31Z | 1 | 27
|
dockerfile 90852753a845…build_recipe f38d29b9008e…system_pinning 01ba4719c80b…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health 52bfb5016bea…verify_offline_sh 3e8184ea230c…base_image_digests ff0edcb8bee3…dockerfile_offline b360aa7e6f94…first_build_digest fabfdacf0a82… |
remediate |
2026-11-11T21:29:12Z | 2026-11-11T21:29:13Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 08384bd7b016…security_report 47bdf11c798c… |
build_kit |
2026-11-11T21:40:14Z | 2026-11-11T21:40:15Z | 1 | 9
|
cosign_stamp df0386f6fc79…locked_digest 7a6eaed3bf3f…freeze_manifest 65bda33152d2…offline_rebuild_transcript 60221d232c73… |
verdict |
2026-11-11T21:42:01Z | 2026-11-11T21:42:02Z | 1 | 8
|
scout_verdict 736c28dda411… |
publish_image |
2026-11-11T21:42:58Z | 2026-11-11T21:42:59Z | 1 | 7
|
hub_readme 07965f866fca…promotion_record c71e5870921c… |
boot_instance |
2026-11-11T21:43:38Z | 2026-11-11T21:43:42Z | 2 | 3
|
instance_handle fefc94b2e570… |
sbom |
2026-11-11T21:44:11Z | 2026-11-11T21:44:12Z | 1 | 5
|
sbom_md 6defc3d0ee02…sbom_json 84cabffdbe7d… |
schema_discovery |
2026-11-11T21:44:14Z | 2026-11-11T21:44:15Z | 1 | 7
|
schema_hash 2abb29f42269…dependency_tree 399a71f52f19…table_classification 9e1fa117a322… |
admin_handbook |
2026-11-11T21:44:22Z | 2026-11-11T21:44:22Z | 1 | 7
|
api_map 4339e49cd002…admin_handbook bbe8f93f0745… |
db_handbook |
2026-11-11T21:44:31Z | 2026-11-11T21:44:32Z | 1 | 8
|
db_handbook e84ee5cd2396…seed_isolation 91cfe50fb268… |
seed_data |
2026-11-11T21:44:37Z | 2026-11-11T21:44:37Z | 1 | 6
|
seed_data_sql 2d6d2e650613…seed_cases_json 91331b40c25c… |
seed_validate |
2026-11-11T21:44:40Z | 2026-11-11T21:44:41Z | 1 | 3
|
seed_data_contract ef298b77363b… |
usecase_validate |
2026-11-11T21:44:54Z | 2026-11-11T21:44:55Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 9bbc7e2f7634…test_results 9a5b9c922512…usecase_contract 7c0e52bbf84b… |
finalize_docs |
2026-11-11T21:45:01Z | 2026-11-11T21:45:02Z | 1 | 9
|
defects_json 5adeab86c124…release_notes 6b22d88b92b8…api_integration_guide dd3185d96cdb… |
package_archive invalidated 2026-11-11T22:09:21Z |
2026-11-11T21:55:29Z | 2026-11-11T21:55:31Z | 1 | 35 (final gate PASS)
|
sale_tar 7f13f7f458c4…checksums 2b69df6610f1…verify_md 5dbf091802dd…rebuild_md 9c253ffb6866…manifest_txt b1b623d418e6…actions_jsonl acb5ff3cf306…provenance_md f2eed7a049e8…assetchain_log_md e9eccaec0c0f…assetchain_log_json 7e71f3bbc3a1… |
[stage_runs]
Rewinds
- 2026-11-11T22:09:21Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #32096]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-11T21:55:31Z.
5 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 8247 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 10994 | L-A08, L-038, L-036, L-034, L-032 |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 1503 | — |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.39 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-11T21:56:36Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1760] | $0.39 | 3 rounds, $40.00 | 7f13f7f458c4… |
Defects
Fully recorded- Ledger entries4 [defects, defects where product_slug=ghost and this tag or chain]
- Disclosed in the archive1 [docs/defects/defects.json, entries]
4 ledger entries: by severity high 1, low 3; by status open 1, fixed-in-release 3.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-ghost-dae94fe5c6First visitor can claim the administrator account until setup is completed [defects, defects #252984] | high | open | build strategy record | — |
RSD-ghost-bb3c4a0345Database handbook: Says --env-file is passed to the container at every start. [defects, defects #254245] | low | fixed-in-release | held review (review model) | v6.75.0-CE-ubuntu24.04-r2 |
RSD-ghost-77ce356e04Database handbook: The file is not needed at a plain start or restart, only when the container is created. [defects, defects #254246] | low | fixed-in-release | held review (review model) | v6.75.0-CE-ubuntu24.04-r2 |
RSD-ghost-e928beb5edDatabase handbook: The move procedure points at the Restoring steps, which restore into the old server and already start Ghost, then asks for a further docker run. [defects, defects #254247] | low | fixed-in-release | held review (review model) | v6.75.0-CE-ubuntu24.04-r2 |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:ab9a52a09bbde7a05affc1e903d87ee67e4de90f5be3a6ac8d2fcf0946d0bbaf · published digest sha256:ab9a52a09bbde7a05affc1e903d87ee67e4de90f5be3a6ac8d2fcf0946d0bbaf · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 282) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-11T22:10:58Z · failing Docker Scout counts 99 packages with copyleft licences (GPL, LGPL, MPL), 96 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-11T22:10:12Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3818322830 · transparency-log entry
- log index 3818324359 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3818845462 · transparency-log entry · integrated 2026-11-11T22:22:06Z) [ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:c44a600794e1b7cf01c57542e6219ba559f0e14590ba28168f1fc89ac47233b3 · state attached · log index 3818848182 · transparency-log entry
- kind sbom · digest sha256:c44a600794e1b7cf01c57542e6219ba559f0e14590ba28168f1fc89ac47233b3 · state attached · log index 3818849901 · transparency-log entry
- kind vsa · digest sha256:c44a600794e1b7cf01c57542e6219ba559f0e14590ba28168f1fc89ac47233b3 · state attached · log index 3818851884 · transparency-log entry
- kind provenance · digest sha256:ab9a52a09bbde7a05affc1e903d87ee67e4de90f5be3a6ac8d2fcf0946d0bbaf · state attached · log index 3818854325 · transparency-log entry
- kind sbom · digest sha256:ab9a52a09bbde7a05affc1e903d87ee67e4de90f5be3a6ac8d2fcf0946d0bbaf · state attached · log index 3818856521 · transparency-log entry
- kind vsa · digest sha256:ab9a52a09bbde7a05affc1e903d87ee67e4de90f5be3a6ac8d2fcf0946d0bbaf · state attached · log index 3818859233 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/ghost/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-11T21:56:43Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:ab9a52a09bbde7a05affc1e903d87ee67e4de90f5be3a6ac8d2fcf0946d0bbaf [clean-room rebuild ledger, runs[760]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-11T21:42:59Z [stage_runs, stage_runs chain 979 stage publish_image]
- Archive manifests written2026-11-11T22:13:56Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 756 · probed 2026-11-11T21:35:17Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-11T22:23:23Z generated: by KitForge release/build_trail.py · generator commit 08040de9cc25311cfbe28aaa295df2520044e9e2
- 2026-11-11T22:25:02Z publication: promoted at 2026-11-11T22:23:53Z · promoted digest sha256:c44a600794e1b7cf01c57542e6219ba559f0e14590ba28168f1fc89ac47233b3 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 480 · checklist status complete · checklist at 2026-11-11T22:25:02Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/ghost/v6.75.0-CE-ubuntu24.04-r2/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/ghost/v6.75.0-CE-ubuntu24.04-r2/), as staged for publishing | — |
ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.rebuild.json | beside the archive (prodasset /data/production/ghost/v6.75.0-CE-ubuntu24.04-r2/), as staged for publishing | — |
ReadyStack-ghost-v6.75.0-CE-ubuntu24.04-r2.rebuild.json.sigstore | beside the archive (prodasset /data/production/ghost/v6.75.0-CE-ubuntu24.04-r2/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/ghost/v6.75.0-CE-ubuntu24.04-r2/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 676 |
chains | sadb, ReadyStack's engine database (not published) | 979 |
defects | sadb, ReadyStack's engine database (not published) | ghost v6.75.0-CE-ubuntu24.04-r2 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 979 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 979 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 979 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 979 |
release_images | sadb, ReadyStack's engine database (not published) | ghost v6.75.0-CE-ubuntu24.04-r2 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 979 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 979 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |