Gitea v28.2.0-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/gitea:v28.2.0-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/gitea:v28.2.0-CE-ubuntu24.04-r2
  • Index digestsha256:0ab0f2303257a43f59f942ac9b6d68046bceb5a6859fd7a594889a293e6ac00d
  • linux/amd64 digestsha256:2ed51d5a2ab0feeb0e392b90c626c027da93feaf15fa63770a2c41ed7d909a45
  • ArchiveReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now70a7a651e1194dc7a9e0e28d547cecded7b3d2e3be9df115f80ac674a5c3709f
  • Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
  • Sections9 sections, 4 fully recorded; 10 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.trail.json
ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.trail.jsonReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.trail.mdGitea product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

1 item not recorded
  • ProductGitea (gitea) [MANIFEST.json]
  • Release tagv28.2.0-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/gitea:v28.2.0-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:0ab0f2303257a43f59f942ac9b6d68046bceb5a6859fd7a594889a293e6ac00d [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:2ed51d5a2ab0feeb0e392b90c626c027da93feaf15fa63770a2c41ed7d909a45 [ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.tar.gz (bytes 542130483) [MANIFEST.json]
  • Archive sha256 at publish5dd4fdcf3d9236d468ed8460ceeadc1e6dad0d9d94100c772351423272d3293e [MANIFEST.json, repack_history[0].previous_tarball_sha256]
  • Archive sha256 now70a7a651e1194dc7a9e0e28d547cecded7b3d2e3be9df115f80ac674a5c3709f [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack history
    • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 5dd4fdcf3d9236d468ed8460ceeadc1e6dad0d9d94100c772351423272d3293e · sha256 70a7a651e1194dc7a9e0e28d547cecded7b3d2e3be9df115f80ac674a5c3709f · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
    [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/go-gitea/gitea.git [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv28.2.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit829b49c1ae96015e345f9d2a0eb1ea7acd5f31e1 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash4f6d79cfde19681f67ab5a0d3ba7315c8034a3849c8bc77ce5937781ce5c98a2 (files 6366) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:edbdbcc2ef8624274ac60f97e2a43a7ed8198c9f66de0d8180b302f3ea0a1f77 [ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1792345836 (utc 2026-10-18T17:50:36Z) [ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded
  • Chain653 (created 2026-10-27T01:57:12Z · trigger customer_request · upstream version v28.2.0) [chains, chains #653]
  • Requestbuild request #335 (rebuild) (requested at 2026-10-27T01:49:32Z · requested by kitforge-agent · version v28.2.0) [build_requests, build_requests #335]
  • Reasonrevision v28.2.0-CE-ubuntu24.04-r2: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #335 request_reason]
  • Supersedesreadystack/gitea:v28.2.0-CE-ubuntu24.04-r1 (chain 563) [chains, chains #563]

The path through the harness

2 items not recorded

1 chain · 4 drives · 18 stages · 3 rewinds

Chain 653 release · shipped

Created 2026-10-27T01:57:12Z, upstream v28.2.0, build request 335 [chains, chains #653]

DriveStartedMinutesBuild hostHow it stopped
5992026-10-27T01:57:38Z28build host 3 withhold-publish ready_to_ship [drive_runs, drive_runs #599] rebuilt from a build line's log
6022026-10-27T06:27:27Z30.2build host 3 withhold-publish infra_hub_rate_limit at package_archive [drive_runs, drive_runs #602] rebuilt from a build line's log
6032026-10-27T07:15:24Z4.5build host 3 withhold-publish ready_to_ship [drive_runs, drive_runs #603] rebuilt from a build line's log
6052026-10-27T09:02:03Z7.8build host 3 publish-held shipped [drive_runs, drive_runs #605] rebuilt from a build line's log

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-27T01:57:43Z2026-10-27T01:57:44Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-27T01:57:50Z2026-10-27T01:57:50Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-27T01:58:09Z2026-10-27T01:58:10Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-27T02:06:16Z2026-10-27T06:37:27Z2
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 —
remediate 2026-10-27T02:06:48Z2026-10-27T06:37:29Z2
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 —
build_kit 2026-10-27T02:12:56Z2026-10-27T06:44:09Z2
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 —
verdict 2026-10-27T02:14:25Z2026-10-27T06:45:38Z2
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 —
publish_image 2026-10-27T02:15:06Z2026-10-27T06:47:03Z2
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 —
boot_instance 2026-10-27T02:15:23Z2026-10-27T06:47:21Z4
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 —
sbom 2026-10-27T02:15:39Z2026-10-27T06:47:36Z2
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 —
schema_discovery 2026-10-27T02:15:45Z2026-10-27T06:47:42Z2
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 —
admin_handbook 2026-10-27T02:15:54Z2026-10-27T06:47:52Z2
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 —
db_handbook 2026-10-27T02:16:06Z2026-10-27T06:48:07Z2
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 —
seed_data 2026-10-27T02:16:13Z2026-10-27T06:48:16Z2
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 —
seed_validate 2026-10-27T02:16:18Z2026-10-27T06:48:22Z2
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 —
usecase_validate 2026-10-27T02:17:42Z2026-10-27T06:50:14Z2
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 —
finalize_docs 2026-10-27T02:17:48Z2026-10-27T06:50:21Z2
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 —
package_archive 2026-10-27T02:25:33Z2026-10-27T09:09:41Z3
33 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 scout_grade_a
  • G8 script_copies
  • G8 three_way_sha
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 assetchain_coverage
 —

[stage_runs]

Rewinds

  • 2026-10-27T06:25:55Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #703]
  • 2026-10-27T06:27:32Z: package_archive to assemble_kit on strategy_changed (chain 653: strategy changed — rewound from 'package_archive' to assemble_kit and dropped the vendored tree so the change actually reaches the build.) [stage_events, stage_events #2346]
  • 2026-10-27T09:01:32Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #706]
  • Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
  • Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-10-27T09:09:41Z.

16 calls over 3 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
usecase_validate12001 not recordednot recorded —

[micro_step_runs]

  • Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
  • Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

2 items not recorded

Role: review model.

2 rounds, 2 counted, $0.68 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-10-27T02:26:15Z 000 clean to publish [held_rounds, held_rounds #47] rebuilt from a held-review state file $0.35 not recorded not recorded
22026-10-27T07:20:50Z 000 clean to publish [held_rounds, held_rounds #48] rebuilt from a held-review state file $0.34 not recorded not recorded
  • Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
  • Not recorded: the round cap in force at each round (the state files did not keep it)

Defects

Fully recorded
  • Ledger entries34 [defects, defects where product_slug=gitea and this tag or chain]
  • Disclosed in the archive2 [docs/defects/defects.json, entries]

34 ledger entries: by severity low 31, high 3; by status open 2, fixed-in-release 32.

DefectSeverityStatusFound byFixed in
RSD-gitea-3ad3a0bd20
The image's org.opencontainers.image.version label says 24.04 (inherited from the Ubuntu base), not this release [defects, defects #95282]		lowopenimage scan—
RSD-gitea-e45f88fea9
Admin handbook: Says two directories but lists three (/data/gitea, /data/git/repositories, /data/data). [defects, defects #100840]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-74aa39685f
Database handbook: Says two directories but lists three. [defects, defects #100841]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-352ff144cf
Database handbook: Says two directories but lists three (/data/gitea, /data/git, /data/data). [defects, defects #100842]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-d95e0c1820
Database handbook: Actions secrets are not files under /data/data: Gitea stores them encrypted in the SQLite database. [defects, defects #100843]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-3053d4c7d8
Database handbook: Attributes host-key generation to the entrypoint script (previous round's finding, still present). [defects, defects #100844]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-956e709347
Database handbook: INSTALL_LOCK is not a build-time setting: the entrypoint writes it into /data/gitea/conf/app.ini when that file does not exist yet. [defects, defects #100845]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-9accf0310b
Database handbook: The command shown, `docker run --entrypoint /bin/bash IMAGE`, has no -i/-t, so bash reads end-of-file and exits immediately; it gives no interactive shell. [defects, defects #100846]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-9f73096e6f
Database handbook: Says 'without restarting' and then tells the reader to restart; the running Gitea process only reads the new value after the restart (Operating facts: edit-ini, then docker restart). [defects, defects #100847]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-a412b18a5b
Database handbook: Same contradiction: the steps that follow include restarting the container. [defects, defects #100848]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-633e2d3869
Database handbook: Says 'without restarting' and the next lines restart the container. [defects, defects #100849]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-d37ec3008e
Database handbook: The start period is a grace window, not a delay before the first check (previous round's finding, still present here). [defects, defects #100850]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-2e2640acb0
Database handbook: No 'Personal access tokens' heading exists; the section is 'Manage Access Tokens' (the same handbook says so at L1194). [defects, defects #100851]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-bbad408f09
Database handbook: Unsupported: not every web UI feature has an API endpoint. [defects, defects #100852]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-af0bd4dee2
Database handbook: Reads as if the API allows a password change; it does not. [defects, defects #100853]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-638dbff789
Database handbook: Wrong subject: the entrypoint sets GITEA_WORK_DIR itself (export GITEA_WORK_DIR=/data); it is the docker exec session that does not have it. [defects, defects #100854]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-7eda0189f4
Database handbook: Pull requests are not in the list of what the release's backup test checked (users, organisations, repositories, issues, admin password, API tokens, SECRET_KEY, SSH host key), yet the section says… [defects, defects #100855]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-e0c9eb7132
Admin handbook: The example passes no GITEA__ variable, so as shown it applies no value (edit-ini takes no key or value arguments and exits 0 having changed nothing); the sentence above it says to pass the value as… [defects, defects #100856]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-61711a0e5b
Admin handbook: The Product Overview 'Upgrading' section gives the bare stop/rm/pull/run procedure with no pointer to the pre-v1.27.3 check that every other upgrade section now carries. [defects, defects #100857]		highfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-4755dd148b
Admin handbook: Unqualified claim attached to the same stop/rm/pull/run procedure in 'Backup and Restore Procedures > Upgrading'. [defects, defects #100858]		highfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-17a7aca6fc
Admin handbook: 'In every case ... keep gitea-old' contradicts case (1), whose own steps are `docker stop gitea && docker rm gitea` (no gitea-old exists). The sentence also leaves out that starting gitea-old after… [defects, defects #100859]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-1e51751b49
Admin handbook: Stated for every case, but true only for case (2). [defects, defects #100860]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-df0f298b7d
Admin handbook: Case (3) says only 'turn on SSH at 2222', as if SSH had been off. [defects, defects #100861]		lowopenheld review (review model)—
RSD-gitea-e1edce0196
Release notes: 'and earlier' includes v1.25.4-CE-ubuntu24.04-r1, a published tag, which created no admin account at all (its fallback-password create command fails) and left open registration instead; the… [defects, defects #100862]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-89db77047a
Release notes: False for v1.25.4-CE-ubuntu24.04-r1: sshd listened on port 22 and git@ clones worked. [defects, defects #100863]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-55c93c434d
Admin handbook: The SSH user is not fixed: it is an ordinary app.ini setting (BUILTIN_SSH_SERVER_USER) that the documented GITEA__ mechanism changes; gitea is only the default. [defects, defects #100864]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-839fe152f5
Admin handbook: Same as line 478: 'always' is false; the user is configurable and gitea is the default. [defects, defects #100865]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-56212289dd
Admin handbook: The time field is the time of the current check, set on failure as well; it is not the time of the last successful check, so it cannot be used to tell how long a dependency has been failing. [defects, defects #100866]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-0731f5e7f3
Admin handbook: Unsupported and contradicted by a run: the second instance is refused at startup by Gitea's queue lock; nothing was corrupted or lost. [defects, defects #100867]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-52230d09d3
Admin handbook: Unquoted <value> placeholder: a value with a space makes docker treat the next word as the container name, and a value with $ is silently rewritten by the shell (Pa$sw0rd!9 became Pa!9, exit 0), the… [defects, defects #100868]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-29ddf3f74c
Admin handbook: False claim that directly contradicts the corrected fact established elsewhere in this same document: the published digest DOES define a Docker HEALTHCHECK (CMD-SHELL curl -fsS… [defects, defects #100869]		highfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-6be603ef84
Database handbook: Leftover framing from the pre-correction narrative that this section body no longer supports. [defects, defects #100870]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-66cc49c497
Admin handbook: This subsection (and its TOC entry, line 92: '[Health Checks](#health-checks)') sits inside '## Known Limitations and Exclusions' (line 1017), alongside genuine exclusions like 'No systemd units are… [defects, defects #100871]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2
RSD-gitea-49e9389f34
Database handbook: '### Health Check' occurs seven times in this file (lines 188, 681, 839, 1055, 1110, 1321, 1495) and '### Health Checking' occurs three times (259, 362, 458), but every corresponding TOC entry links… [defects, defects #100872]		lowfixed-in-releaseheld review (review model)v28.2.0-CE-ubuntu24.04-r2

Verification

2 items not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:2ed51d5a2ab0feeb0e392b90c626c027da93feaf15fa63770a2c41ed7d909a45 · published digest sha256:2ed51d5a2ab0feeb0e392b90c626c027da93feaf15fa63770a2c41ed7d909a45 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 185) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 653 package_archive gate_result.g8.result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-27T09:02:27Z · failing Docker Scout counts 122 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • First own scan of the releaseA (at 2026-10-27T09:09:55Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-27T06:30:41Z) [image_scans, image_scans #1317]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-27T09:02:08Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3622647137 · transparency-log entry · integrated 2026-11-01T06:33:15Z) [ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:0ab0f2303257a43f59f942ac9b6d68046bceb5a6859fd7a594889a293e6ac00d · state attached · log index 3511664098 · transparency-log entry
    • kind sbom · digest sha256:0ab0f2303257a43f59f942ac9b6d68046bceb5a6859fd7a594889a293e6ac00d · state attached · log index 3511667487 · transparency-log entry
    • kind vsa · digest sha256:0ab0f2303257a43f59f942ac9b6d68046bceb5a6859fd7a594889a293e6ac00d · state attached · log index 3511670765 · transparency-log entry
    • kind provenance · digest sha256:2ed51d5a2ab0feeb0e392b90c626c027da93feaf15fa63770a2c41ed7d909a45 · state attached · log index 3511673984 · transparency-log entry
    • kind sbom · digest sha256:2ed51d5a2ab0feeb0e392b90c626c027da93feaf15fa63770a2c41ed7d909a45 · state attached · log index 3511676756 · transparency-log entry
    • kind vsa · digest sha256:2ed51d5a2ab0feeb0e392b90c626c027da93feaf15fa63770a2c41ed7d909a45 · state attached · log index 3511679725 · transparency-log entry
    (at 2026-10-27T09:07:22Z) [attestations.json, results]

Offline clean-room rebuilds

  • 2026-10-27T02:26:17Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:2ed51d5a2ab0feeb0e392b90c626c027da93feaf15fa63770a2c41ed7d909a45 [clean-room rebuild ledger, runs[420]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
  • Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

Fully recorded
  • Image pushed (internal tag), publish_image passed2026-10-27T06:47:03Z [stage_runs, stage_runs chain 653 stage publish_image]
  • Release tag promoted2026-10-27T09:09:00Z (method imagetools_create_retag_by_digest_no_rebuild · digest sha256:0ab0f2303257a43f59f942ac9b6d68046bceb5a6859fd7a594889a293e6ac00d · tag readystack/gitea:v28.2.0-CE-ubuntu24.04-r2) [deliverables/provenance/PROMOTION_RECORD.json, promoted_at]
  • Archive manifests written2026-10-27T09:04:48Z [PUBLISH_MANIFEST.json, published_at]
  • Archive cut over on prodasset, package_archive passed2026-10-27T09:09:41Z [stage_runs, stage_runs chain 653 stage package_archive]
  • Cut-over markerpresent (chain 653) [.cutover.json]
  • Release checklist and site event2026-10-27T09:09:39Z (status complete · site event 194 · steps grade a verified done · release tag promoted done · cosign signed done · release evidence recorded done · contract gate passed done · archive published done · hub readme live done · reproducibility recorded done · defects ledger published done · catalog available done · build request fulfilled done · seo regenerated skipped · site catalogue refreshed done · site grade recorded done · site queue synced done · customer requests charged done · owners notified done) [deliverables/provenance/RELEASE_CHECKLIST.json, run_at]

Packages and CPU level

Fully recorded
  • Packages in the image392 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 859 · probed 2026-11-02T17:09:30Z · source backfill) [release_images, isa_level_hard]

History

1 event
  • 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.tar.gz)—
.cutover.jsonbeside the archive (prodasset /data/production/gitea/v28.2.0-CE-ubuntu24.04-r2/)—
MANIFEST.jsonbeside the archive (prodasset /data/production/gitea/v28.2.0-CE-ubuntu24.04-r2/)—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/gitea/v28.2.0-CE-ubuntu24.04-r2/)—
ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/gitea/v28.2.0-CE-ubuntu24.04-r2/)—
ReadyStack-gitea-v28.2.0-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/gitea/v28.2.0-CE-ubuntu24.04-r2/)—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/gitea/v28.2.0-CE-ubuntu24.04-r2/)—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)335
chainssadb, ReadyStack's engine database (not published)653
defectssadb, ReadyStack's engine database (not published)gitea v28.2.0-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 653
held_roundssadb, ReadyStack's engine database (not published)chain 653
image_scanssadb, ReadyStack's engine database (not published)1317
micro_step_runssadb, ReadyStack's engine database (not published)chain 653
release_imagessadb, ReadyStack's engine database (not published)gitea v28.2.0-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 653
stage_runssadb, ReadyStack's engine database (not published)chain 653
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/RELEASE_CHECKLIST.jsonthe chain's workspace on the controller (not published)—