Gitea v28.3.0-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/gitea:v28.3.0-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/gitea:v28.3.0-CE-ubuntu24.04-r1
  • Index digestsha256:f6bdd508ee992253c897f1f4768c206745c88f0357bdb9432553c99f81713e0e
  • linux/amd64 digestsha256:b80d6c7290be1e9121d9b818660d8f4083fbed6788caa92d1adb322bbc0c2993
  • ArchiveReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 nowc0cafa0f4eff0257ec556fc48bb46be334c140d8001bf88d9fb4e4645133f2f6
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-10T22:46:54Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.trail.json
ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.trail.jsonReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.trail.mdGitea product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductGitea (gitea) [MANIFEST.json]
  • Release tagv28.3.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/gitea:v28.3.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:f6bdd508ee992253c897f1f4768c206745c88f0357bdb9432553c99f81713e0e [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:b80d6c7290be1e9121d9b818660d8f4083fbed6788caa92d1adb322bbc0c2993 [ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.tar.gz (bytes 544860077) [MANIFEST.json]
  • Archive sha256 at publishc0cafa0f4eff0257ec556fc48bb46be334c140d8001bf88d9fb4e4645133f2f6 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/go-gitea/gitea.git [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv28.3.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit4f5a3e13e5f3aca85d830e3a9024c893b0bbf1e1 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash632ea632f44e8a37aa4169dbe5c3c25b5a631eb6a32cf0c4b5ef54df7ce4aa2e (files 6372) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:5daa33869cd08be129be4dc5a961dbad41e6da73a70efa733d622754db2759c0 [ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793521224 (utc 2026-11-01T08:20:24Z) [ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit 1278c060ea6c2f19ac7bf1a6c8c2d47805be6cef · dirty yes · first drive 3721
    • commit 25f176d1e4c68bf0eaed5fe5103af4b3ad61b7fd · dirty yes · first drive 3763
    • commit 182984d38fc2822b1b65f61c9546104003bca50e · dirty yes · first drive 3901
    • commit ba66d135fc96464ab9d6f92177351d3049931108 · dirty yes · first drive 3913
    • commit 102f2cb2483a25dd5f31f98f8653ad1a9d42a282 · dirty yes · first drive 3922
    • commit 837c64ac100d91a0c228a7de2f398e67de10932a · dirty yes · first drive 3947
    • commit fcb013a47b6acf007f0393214805da1af5e637f1 · dirty yes · first drive 3965
    • commit d5dd95cc70cbde883ad7cde173904a80a5a6a342 · dirty yes · first drive 4008
    • commit 33f90e4df8880eb3af828fc61ea626b22c124785 · dirty yes · first drive 4045
    • commit 762b14205276731d25047ecbc7e53d9425b5b471 · dirty yes · first drive 4065
    • commit af2b965a4592cf93f865060c2ed1124a061bab44 · dirty yes · first drive 4121
    • commit 1731b7e18c93f091c85731eff750ca26c7171295 · dirty yes · first drive 4127
    • commit 0f8a821e4349baa05fea06b68154db7b57bf0ede · dirty yes · first drive 4133
    • commit 8f330f31aa066ed1381d543d473df5415ecba80a · dirty yes · first drive 4168
    • commit 3229f1ea8cfcd13de34bf28d50f8a54074118509 · dirty yes · first drive 4188
    • commit 54655941a57a669c75e2d14cb2734b5d7d8cddac · dirty yes · first drive 4198
    • commit c6766955b9cc7015f3fb0e2dfbef7c56443ec83b · dirty yes · first drive 4203
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain869 (created 2026-11-08T06:55:31Z · trigger customer_request · upstream version v28.3.0) [chains, chains #869]
  • Requestbuild request #560 (rebuild) (requested at 2026-11-08T06:14:41Z · requested by kitforge-agent · version v28.3.0) [build_requests, build_requests #560]
  • Reasonretarget to v28.3.0: a newer upstream release (rule 1) [build_requests, build_requests #560 request_reason]
  • Supersedesreadystack/gitea:v28.2.0-CE-ubuntu24.04-r2 (chain 653) [chains, chains #653]

The path through the harness

Fully recorded

1 chain · 17 drives · 18 stages · 7 rewinds

Chain 869 release · ready_to_ship

Created 2026-11-08T06:55:31Z, upstream v28.3.0, build request 560 [chains, chains #869]

DriveStartedMinutesBuild hostHow it stopped
37212026-11-08T06:56:12Z18.7build host 1 withhold-publish stage_failed at verdict; first failed check scout_verdict:release_check_passed; 7 ticks [drive_runs, drive_runs #3721]
37632026-11-08T10:23:20Z1.9build host 1 withhold-publish stage_failed at verdict; first failed check scout_verdict:release_check_passed; 1 tick [drive_runs, drive_runs #3763]
39012026-11-08T23:58:13Z58build host 1 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 15 ticks [drive_runs, drive_runs #3901]
39132026-11-09T01:08:03Z8.1build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3913]
39222026-11-09T02:10:14Z4.7build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3922]
39472026-11-09T04:10:31Z2.2build host 1 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3947]
39652026-11-09T06:02:12Z4.8build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3965]
40082026-11-09T11:44:26Z2.4build host 1 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4008]
40452026-11-09T14:56:16Z0.5build host 1 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4045]
40652026-11-09T16:05:48Z0.4build host 1 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4065]
41212026-11-09T22:26:27Z4.6build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4121]
41272026-11-09T22:52:30Z4.1build host 1 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4127]
41332026-11-09T23:16:38Z1.9build host 1 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4133]
41682026-11-10T08:51:13Z2.4build host 1 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4168]
41882026-11-10T21:31:49Z4.6build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4188]
41982026-11-10T22:07:14Z8.7build host 1 publish-held stage_failed at package_archive; first failed check runner_ok; 1 tick [drive_runs, drive_runs #4198]
42032026-11-10T22:40:54Z—build host 1 publish-held not recorded [drive_runs, drive_runs #4203]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-08T06:56:33Z2026-11-08T06:56:35Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json e6176c66ab88…
acquire 2026-11-08T06:57:04Z2026-11-08T06:57:07Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 6cfca8ab133f…
license_file ed2f10a9d78b…
custody_inputs e02803ff6fe9…
source_tree_hash ea0199f1dcca…
source_file_manifest 1e0f47aa19b7…
plan 2026-11-08T06:57:36Z2026-11-08T06:57:38Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 9bff03bc9f3d…
input_pin_plan 50a0ce277a3e…
toolchain_lock 31f1f1fc1cca…
assemble_kit 2026-11-08T07:05:18Z2026-11-09T00:05:40Z2
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 807136dfc81d…
build_recipe c34a2f2e307a…
system_pinning 37e9f8d94846…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health bfc8bd7dc687…
verify_offline_sh 3e8184ea230c…
base_image_digests f19d82cf77e6…
dockerfile_offline 82fa6e80a074…
first_build_digest bb6f40d8e6ec…
remediate 2026-11-08T07:06:20Z2026-11-09T00:05:44Z2
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log d3f256ef2c00…
security_report 1b3da9d173d1…
build_kit 2026-11-08T07:13:18Z2026-11-09T00:11:39Z2
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 2f2e5950030a…
locked_digest 34952e2a4add…
freeze_manifest eb829f21eeb4…
offline_rebuild_transcript 5297d28c73ef…
verdict 2026-11-08T07:14:51Z2026-11-09T00:12:42Z3
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 51573efe42ce…
publish_image 2026-11-09T00:13:23Z2026-11-09T00:13:24Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 9acfe28d160c…
promotion_record d6a6db429d13…
boot_instance 2026-11-09T00:13:35Z2026-11-09T00:13:38Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle a4dea6708fb6…
sbom 2026-11-09T00:13:52Z2026-11-09T00:13:53Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md d0b7f98813be…
sbom_json bacb3c29f606…
schema_discovery 2026-11-09T00:13:59Z2026-11-09T00:13:59Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 26159325db1b…
dependency_tree b1e932b58bfa…
table_classification df776d2b46eb…
admin_handbook 2026-11-09T00:23:56Z2026-11-09T00:23:57Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map e55cf295c01d…
admin_handbook ffe86721df40…
db_handbook 2026-11-09T00:45:14Z2026-11-09T00:45:15Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 2ba38207f219…
seed_isolation e2c85656d63d…
seed_data 2026-11-09T00:45:22Z2026-11-09T00:45:23Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql ff03db6c5e44…
seed_cases_json 4edefee41a19…
seed_validate 2026-11-09T00:45:28Z2026-11-09T00:45:29Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 25b2551f615d…
usecase_validate 2026-11-09T00:47:00Z2026-11-09T00:47:01Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests e47699be5e63…
passed_tests f865cb8932c2…
test_results 60422d45bb4c…
usecase_contract c64284e7886a…
finalize_docs 2026-11-09T00:47:07Z2026-11-09T00:47:08Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json c8fd28697a3e…
release_notes 991d0adadbec…
api_integration_guide 206b5296a2ab…
package_archive 2026-11-09T00:56:12Zfailed14
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar f5f5335dbac0…
checksums 4d8438caa7aa…
verify_md b4e26fff5196…
rebuild_md a2584c67b775…
manifest_txt 380a98300888…
actions_jsonl 63052de409fc…
provenance_md 7345bca84332…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json dbc427693388…

[stage_runs]

Rewinds

  • 2026-11-08T23:58:17Z: verdict to assemble_kit on strategy_changed (strategy changed (0d77469abaa1 -> bb1c18251a53)) [stage_events, stage_events #27621]
  • 2026-11-09T02:03:16Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27837]
  • 2026-11-09T02:47:54Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27885]
  • 2026-11-09T06:57:03Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28153]
  • 2026-11-09T22:50:57Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29919]
  • 2026-11-10T22:06:31Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30789]
  • 2026-11-10T22:40:31Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30852]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-10T22:46:47Z.

211 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 04200 —
remediate2001 07182 L-A08, L-038, L-036, L-034, L-032
admin_handbook582703 8449972 —
db_handbook1436603 201940841 —
usecase_validate6001 019219 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

5 rounds, 5 counted, $13.84 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T01:16:41Z 02731 findings to repackage [held_rounds, held_rounds #1561] $3.84 3 rounds, $40.00 7cf8e93550be…
22026-11-09T02:15:24Z 0134 findings to repackage [held_rounds, held_rounds #1564] $2.75 3 rounds, $40.00 898c6e2cd305…
32026-11-09T06:07:32Z 0021 clean to repackage [held_rounds, held_rounds #1592] $2.38 3 rounds, $40.00 c1502b12d119…
42026-11-09T22:31:30Z 0021 clean to repackage [held_rounds, held_rounds #1674] $2.17 3 rounds, $40.00 8fa652c44080…
52026-11-10T21:37:00Z 0010 clean to publish [held_rounds, held_rounds #1697] $2.69 3 rounds, $40.00 f5f5335dbac0…

Defects

Fully recorded
  • Ledger entries145 [defects, defects where product_slug=gitea and this tag or chain]
  • Disclosed in the archive143 [docs/defects/defects.json, entries]

145 ledger entries: by severity critical 1, low 117, high 27; by status fixed-in-release 2, fixed-before-release 143.

DefectSeverityStatusFound byFixed in
RSD-gitea-533e1cd1cc
CVE-2026-111497 in github.com/andybalholm/brotli v1.2.1 is on CISA's Known Exploited Vulnerabilities list [defects, defects #188186]		criticalfixed-in-releaseimage scanv28.3.0-CE-ubuntu24.04-r1
RSD-gitea-46ca06d50e
Admin handbook: Case (3) says only 'turn on SSH at 2222', as if SSH had been off. [defects, defects #188187]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-c27c23f9c3
The image's org.opencontainers.image.version label says 24.04 (inherited from the Ubuntu base), not this release [defects, defects #188188]		lowfixed-in-releaseimage scanv28.3.0-CE-ubuntu24.04-r1
RSD-gitea-6f9a9188eb
Admin handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188905]		highfixed-before-releaseheld review (review model)—
RSD-gitea-e7680c10a9
Admin handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188906]		highfixed-before-releaseheld review (review model)—
RSD-gitea-dd46ed3e80
Admin handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188907]		highfixed-before-releaseheld review (review model)—
RSD-gitea-e416c4666b
Admin handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188908]		highfixed-before-releaseheld review (review model)—
RSD-gitea-3d3f5d78ae
Admin handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188909]		highfixed-before-releaseheld review (review model)—
RSD-gitea-7872406377
Admin handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188910]		highfixed-before-releaseheld review (review model)—
RSD-gitea-e372dc2b0b
Database handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188911]		highfixed-before-releaseheld review (review model)—
RSD-gitea-e65d24b0c9
Database handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188912]		highfixed-before-releaseheld review (review model)—
RSD-gitea-c3b829843e
Database handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188913]		highfixed-before-releaseheld review (review model)—
RSD-gitea-023b70ac74
Database handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188914]		highfixed-before-releaseheld review (review model)—
RSD-gitea-e83419cf8e
Database handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188915]		highfixed-before-releaseheld review (review model)—
RSD-gitea-37447da7c4
Database handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188916]		highfixed-before-releaseheld review (review model)—
RSD-gitea-44875d709f
Database handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188917]		highfixed-before-releaseheld review (review model)—
RSD-gitea-7f0e3ef2c3
Database handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188918]		highfixed-before-releaseheld review (review model)—
RSD-gitea-e5390f8848
Database handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188919]		highfixed-before-releaseheld review (review model)—
RSD-gitea-2ba81567ea
Database handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188920]		highfixed-before-releaseheld review (review model)—
RSD-gitea-eb37fbbfe8
Database handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188921]		highfixed-before-releaseheld review (review model)—
RSD-gitea-a89cbb599a
Database handbook: Documents say web login sessions are held in memory and a restart signs everyone out except 'Remember this device'; the image stores sessions as files on the volume, so a restart (or a restore)… [defects, defects #188922]		highfixed-before-releaseheld review (review model)—
RSD-gitea-5dcbc962d5
Database handbook: States that both services bind to 127.0.0.1; they bind to all interfaces. [defects, defects #188923]		highfixed-before-releaseheld review (review model)—
RSD-gitea-d687c80b98
Database handbook: Contradicts the rest of both handbooks: GITEA__ variables are persisted into app.ini (including secrets such as SECRET_KEY set that way), so a customer who passes a secret this way believes it is… [defects, defects #188924]		highfixed-before-releaseheld review (review model)—
RSD-gitea-41b12ec733
Database handbook: The recovery block reads the key from `gitea-old`, a container the same section's steps removed; the empty $KEY would then be passed as -e GITEA__security__SECRET_KEY=. [defects, defects #188925]		highfixed-before-releaseheld review (review model)—
RSD-gitea-59e580e777
Database handbook: Removing the old container leaves no way to recover SECRET_KEY if the copy step was wrong or skipped. [defects, defects #188926]		highfixed-before-releaseheld review (review model)—
RSD-gitea-fd1497eb0a
Database handbook: Sends every on-volume volume to the direct upgrade, including the uid-912 volume that needs the chown step; the new container then exits with permission denied. [defects, defects #188927]		highfixed-before-releaseheld review (review model)—
RSD-gitea-cd399d0a62
Database handbook: The suggested alternative output path fails because the directory does not exist. [defects, defects #188928]		highfixed-before-releaseheld review (review model)—
RSD-gitea-3a372172bd
Admin handbook: Advises mounting app.ini from the host; a host file is not owned by uid 999, so the container exits or cannot edit it. [defects, defects #188929]		highfixed-before-releaseheld review (review model)—
RSD-gitea-6abac07fbe
Database handbook: Says the dump excludes SSH host keys; it contains the private host keys and app.ini (SECRET_KEY), and the handbooks contradict each other. [defects, defects #188930]		highfixed-before-releaseheld review (review model)—
RSD-gitea-1e741e23e4
Admin handbook: Contradicts the same handbook (Clone URLs: 'contains no DOMAIN line'). [defects, defects #188931]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-8241d80d13
Database handbook: False statement about the generated config; contradicts the same handbook's 'no DOMAIN line' sentences. [defects, defects #188932]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-26435d542e
Database handbook: False statement about the generated config; contradicts the same handbook's 'no DOMAIN line' sentences. [defects, defects #188933]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-524c73daf5
Database handbook: False statement about the generated config; contradicts the same handbook's 'no DOMAIN line' sentences. [defects, defects #188934]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-b648ee451a
Database handbook: False statement about the generated config; contradicts the same handbook's 'no DOMAIN line' sentences. [defects, defects #188935]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-b57e34722a
Database handbook: False statement about the generated config; contradicts the same handbook's 'no DOMAIN line' sentences. [defects, defects #188936]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-d502a28c57
Database handbook: False statement about the generated config; contradicts the same handbook's 'no DOMAIN line' sentences. [defects, defects #188937]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-774fc06428
Database handbook: False statement about the generated config; contradicts the same handbook's 'no DOMAIN line' sentences. [defects, defects #188938]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-de7469eef8
Database handbook: Wrong default ROOT_URL. [defects, defects #188939]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-0be4d6dd38
Database handbook: DOMAIN does not supply the host when it differs from ROOT_URL's host name. [defects, defects #188940]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-f8166a19d4
Database handbook: Contradicts sentences that say DOMAIN is optional for an IP ROOT_URL. [defects, defects #188941]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-be2e52e5f2
Admin handbook: HTTP clone URLs are not taken from ROOT_URL (PUBLIC_URL_DETECTION auto uses the request host). [defects, defects #188942]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-4f57260fca
Database handbook: HTTP clone URL claim contradicted by measurement. [defects, defects #188943]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-5b966758b2
Database handbook: The API cannot change the forced initial password; DB line 3530 says so. [defects, defects #188944]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-ec75755eee
Database handbook: Contradicts the handbook's own statement that the container serves HTTP only. [defects, defects #188945]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-2271a525fc
Database handbook: Says the port serves HTTPS. [defects, defects #188946]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-5f28583276
Database handbook: Wrong value of GITEA_WORK_DIR. [defects, defects #188947]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-8e02513ca4
Database handbook: Contradicts other sections. [defects, defects #188948]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-ce03821283
Database handbook: Typo in the sample output ('timeszdata'). [defects, defects #188949]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-dca6c8f6f8
Database handbook: Endpoint count is wrong. [defects, defects #188950]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-2d7cc2830c
Database handbook: Quoted greeting is not what the server prints. [defects, defects #188951]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-5707c4c51e
Database handbook: The handbook gives both 25 s and 12 s for the same event. [defects, defects #188952]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-929de21a3b
Database handbook: Timing is stated relative to a different event than other sections. [defects, defects #188953]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-c269d53b84
Database handbook: Unconditional claim contradicted by the following paragraph. [defects, defects #188954]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-c93baf25ff
Database handbook: Refers to a document that does not exist. [defects, defects #188955]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-ffdec919e6
Database handbook: Wrong version boundary (v28.3.0 is the release being installed). [defects, defects #188956]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-c68308e361
Database handbook: Refers to a document that does not exist. [defects, defects #188957]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-3fe07c9ee7
Admin handbook: Heading says 'while running' but the procedure stops the container. [defects, defects #188958]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-de16d2562e
Admin handbook: Heading contradicts the procedure. [defects, defects #188959]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-85e995538a
Admin handbook: Suggests editing the file inside the container, which has no editor. [defects, defects #188960]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-bcc4c99747
Release notes: Attributes upstream's own x/net bump to ReadyStack's floor. [defects, defects #188961]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-05655a986b
Database handbook: Contradicts the handbook's own (round-1-corrected) statement that session files are part of the volume backup; repeats the round-1 major hazard (a restore keeps sessions). [defects, defects #189995]		highfixed-before-releaseheld review (review model)—
RSD-gitea-482301d4e1
Admin handbook: States DOMAIN is also used for the SSH clone host when ROOT_URL is a name; contradicts the same handbook ('DOMAIN is ignored when ROOT_URL has a host name') and measurement. [defects, defects #189996]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-5799d13b37
Admin handbook: 'using whatever you set in DOMAIN ... [defects, defects #189997]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-dc2191e134
Admin handbook: DOMAIN does not give a different name in SSH clone URLs even for an IP ROOT_URL (measured ssh://[email protected] with DOMAIN=git.internal.local). [defects, defects #189998]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-f50500d582
Admin handbook: Says port 3000 gives HTTPS clone access; contradicts 'The container serves HTTP only'. [defects, defects #189999]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-243007486b
Admin handbook: Describes the greeting as 'welcoming you to Gitea'; the server prints an authentication confirmation and a no-shell notice. [defects, defects #190000]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-745dede871
Database handbook: Labels port 3000 HTTP/HTTPS; the container serves plain HTTP only. [defects, defects #190001]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-0d08b6b582
Database handbook: HTTP clone URLs are not taken from ROOT_URL and DOMAIN does not control the displayed URLs; the sentence also contradicts line 729 ('HTTP clone URLs use the address you browse with'). [defects, defects #190002]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-6459f18ce4
Database handbook: Says ROOT_URL controls all clone URLs; HTTP clone URLs follow the request host. [defects, defects #190003]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-4255a83529
Database handbook: DOMAIN does not change SSH clone URLs even for an IP ROOT_URL. [defects, defects #190004]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-5727b6160f
Database handbook: Contradicts the next paragraph ('DOMAIN is optional') and measurement (IP ROOT_URL without DOMAIN gave ssh://[email protected]:2222/...). [defects, defects #190005]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-544f46c552
Database handbook: Contradicts 'DOMAIN is optional' elsewhere in the handbook and measurement. [defects, defects #190006]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-08ca6addb3
Database handbook: Example ROOT_URL=http://192.0.2.10:3000/ with DOMAIN=git.internal.local still gave ssh://[email protected]:2222/... [defects, defects #190007]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-d4760e1c15
Database handbook: HTTP clone URLs follow the request host (measured), contradicting line 1132 and line 729. [defects, defects #190008]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-03ff0d1d31
Database handbook: With an IP ROOT_URL, DOMAIN=git.internal.local did not change the SSH clone URL. [defects, defects #190009]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-f869125433
Database handbook: DOMAIN does not take part (ROOT_URL host wins; for an IP ROOT_URL the IP is used regardless of DOMAIN). [defects, defects #190010]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-64ce214655
Database handbook: DOMAIN does not override the clone host when ROOT_URL is an IP. [defects, defects #190011]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-948f984ce7
Database handbook: HTTP clone URLs use the request host, not ROOT_URL (measured http://10.1.2.3:3000/admin/r1.git with ROOT_URL=https://git.example.com/). [defects, defects #190012]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-5c6a62aac6
Database handbook: DOMAIN does not change SSH clone URLs for an IP ROOT_URL. [defects, defects #190013]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-a65f3508e9
Database handbook: IP ROOT_URL without DOMAIN gave ssh://[email protected]:2222/...; contradicts 'DOMAIN is optional'. [defects, defects #190014]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-111c60f635
Database handbook: IP ROOT_URL without DOMAIN works (ssh://[email protected]:2222/...); contradicts 'DOMAIN is optional' later in the same section. [defects, defects #190015]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-23248055e7
Database handbook: Measured: DOMAIN=other.example.org changed neither the SSH nor the HTTP clone URL. [defects, defects #190016]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-4a839bd75b
Database handbook: Two different values for the same event. [defects, defects #190017]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-94362f277f
Database handbook: Two different values for the same event. [defects, defects #190018]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-89a38582bf
Database handbook: Using the API with the forced initial password fails; contradicts the same handbook ('the API can change the password only after that first change'). [defects, defects #190019]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-8a1be25086
Database handbook: Deleting the file is not a precondition of the API call. [defects, defects #190020]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-1270d2b70b
Database handbook: Wrong cause for the 'pre-receive hook declined' symptom; contradicts the Operating facts paragraph. [defects, defects #190021]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-86f3968595
Database handbook: Wrong version boundary (v28.3.0 is the target release). [defects, defects #190022]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-f262397362
Database handbook: Wrong version boundary. [defects, defects #190023]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-28914b1873
Database handbook: Contradicts the handbook's own v1.25.4 procedure and uses the wrong boundary. [defects, defects #190024]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-cd33adc9f2
Database handbook: Duplicate heading with the wrong version. [defects, defects #190025]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-53c101a67f
Database handbook: Procedure order differs from the other descriptions and runs chown under the running old container. [defects, defects #190026]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-240597f78f
Database handbook: Describes output the command does not print. [defects, defects #190027]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-95ade9a069
Database handbook: Dump documented as working on any instance fails on a fresh one. [defects, defects #190028]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-f1ac0eec1d
API guide: The table says each request 'returned the status shown'; on a new instance this one returns 500. [defects, defects #190029]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-7edf281db2
Database handbook: The 'Upgrading (continued)' section rewritten 2026-11-09T04:11/04:12Z still names the wrong boundary. [defects, defects #199243]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-cbb0655bef
Database handbook: Owner-name test is unsupported for v1.25.4 and the version it names is wrong. [defects, defects #199244]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-c63db87df9
Database handbook: Wording leaves 'v28.3.0 or later' as a source release. [defects, defects #199245]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-6a2ac457c1
Database handbook: Sentence added by the doc gate does not fit the v1.25.4 path. [defects, defects #199246]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-711f17dbb3
Database handbook: 'verify it' is not a step in the procedure. [defects, defects #199247]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-1127c77f95
Database handbook: Round-2 finding on this paragraph persists. [defects, defects #199248]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-200e4dc91f
Database handbook: HTTP clone URL attributed to ROOT_URL. [defects, defects #199249]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-bdc49eab0e
Database handbook: Round-2 'ROOT_URL controls all clone URLs' finding persists. [defects, defects #199250]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-615c6fba06
Database handbook: Over-broad claim next to a DOMAIN example that changes no URL. [defects, defects #199251]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-16081de0eb
Database handbook: Round-2 'HTTP clone URLs use the request host, not ROOT_URL' finding persists. [defects, defects #199252]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-127451c80c
Admin handbook: Contradiction with the example and the previous sentence. [defects, defects #199253]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-22284fc784
Database handbook: Same wording as the round-2 finding. [defects, defects #199254]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-880d7307d2
Database handbook: Condition does not exist and contradicts other sections. [defects, defects #199255]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-f742543691
Database handbook: The web UI redirects; it does not return 403. [defects, defects #199256]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-483dd21de1
Database handbook: The follow-on example fails with the token the page just created. [defects, defects #199257]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-f5c105f8c6
Database handbook: 'encrypt sessions' contradicts the file-session statement and measurement. [defects, defects #199258]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-0069fe8938
Admin handbook: Dump documented as working on any instance (round-2 finding persists in passages without the caveat). [defects, defects #199259]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-9aef74e7e1
Admin handbook: Same. [defects, defects #199260]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-dd02b39985
Database handbook: Same. [defects, defects #199261]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-96734d7a9f
Database handbook: Same. [defects, defects #199262]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-e82efe6774
Database handbook: Round-2/3 finding 'ROOT_URL controls all clone URLs' persists in this passage: it attributes the HTTP clone URL to ROOT_URL. [defects, defects #226153]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-b5db88e4ce
Database handbook: Round-2/3 finding 'ROOT_URL controls all clone URLs' persists in this passage: it attributes the HTTP clone URL to ROOT_URL. [defects, defects #226154]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-cded4d2932
Database handbook: Round-2/3 finding 'ROOT_URL controls all clone URLs' persists in this passage: it attributes the HTTP clone URL to ROOT_URL. [defects, defects #226155]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-a7b5edd241
Database handbook: Round-2/3 finding 'ROOT_URL controls all clone URLs' persists in this passage: it attributes the HTTP clone URL to ROOT_URL. [defects, defects #226156]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-2d632c3bae
Database handbook: Round-2/3 finding 'ROOT_URL controls all clone URLs' persists in this passage: it attributes the HTTP clone URL to ROOT_URL. [defects, defects #226157]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-e039a8c688
Database handbook: Round-2/3 finding 'ROOT_URL controls all clone URLs' persists in this passage: it attributes the HTTP clone URL to ROOT_URL. [defects, defects #226158]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-64aaae3e4b
Database handbook: Round-2/3 finding 'ROOT_URL controls all clone URLs' persists in this passage: it attributes the HTTP clone URL to ROOT_URL. [defects, defects #226159]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-8725fa67fe
Database handbook: Round-2/3 finding 'ROOT_URL controls all clone URLs' persists in this passage: it attributes the HTTP clone URL to ROOT_URL. [defects, defects #226160]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-7132d38c90
Database handbook: Round-2/3 finding 'ROOT_URL controls all clone URLs' persists in this passage: it attributes the HTTP clone URL to ROOT_URL. [defects, defects #226161]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-5b5dabec3a
Database handbook: Round-2/3 finding 'ROOT_URL controls all clone URLs' persists in this passage: it attributes the HTTP clone URL to ROOT_URL. [defects, defects #226162]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-11bd832dc4
Database handbook: Round-2/3 finding 'ROOT_URL controls all clone URLs' persists in this passage: it attributes the HTTP clone URL to ROOT_URL. [defects, defects #226163]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-e8fa165abe
Admin handbook: Round-2/3 finding 'ROOT_URL controls all clone URLs' persists in this passage: it attributes the HTTP clone URL to ROOT_URL. [defects, defects #226164]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-3135786735
Admin handbook: Round-2/3 finding 'ROOT_URL controls all clone URLs' persists in this passage: it attributes the HTTP clone URL to ROOT_URL. [defects, defects #226165]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-4b9a9f2742
Admin handbook: Round-2/3 finding 'ROOT_URL controls all clone URLs' persists in this passage: it attributes the HTTP clone URL to ROOT_URL. [defects, defects #226166]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-e3eb0b3d50
Database handbook: The documented recovery for the fresh-instance dump failure ('create a repository first', then re-run) fails again with 'Dump file ... [defects, defects #226167]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-e3b7dba017
Database handbook: Round-2/3 finding 'dump documented as working on any instance' persists in a passage without the caveat. [defects, defects #226168]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-399dd41ebc
Database handbook: Round-2/3 finding 'dump documented as working on any instance' persists in a passage without the caveat. [defects, defects #226169]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-3a67d8dfec
Admin handbook: Round-2/3 finding 'dump documented as working on any instance' persists in a passage without the caveat. [defects, defects #226170]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-303570149d
Admin handbook: Calls the dump suitable for disaster recovery although no restore from a dump is documented or tested and two other passages say to restore only from the volume backup. [defects, defects #226171]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-0b2315e272
Database handbook: Heading says the web UI returns HTTP 403 (round-3 finding 'the web UI redirects; it does not return 403' persists in this heading). [defects, defects #226172]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-e32eb7fafe
Admin handbook: 'cannot read or write it' is false for a world-readable file (the default mode of a file created with umask 022): uid 999 can read it, not write it. [defects, defects #226173]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-0ef8e546f9
Database handbook: States that every HTTP clone needs authentication; an anonymous clone of a public repository succeeds. [defects, defects #231049]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-fe2d8910de
Database handbook: Placed right after the sentence about the forced change, it presents the PATCH call as a way to set the password, but the API refuses it until the web UI/CLI change is made. [defects, defects #231050]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-ec2a53dc7b
Database handbook: Attributes DEBIAN_FRONTEND and PATH to the entrypoint; they come from the image configuration, and the entrypoint sets GITEA_WORK_DIR instead. [defects, defects #231051]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-6c68d0da5d
Database handbook: Says a reverse proxy is required and the container cannot handle TLS; Gitea serves HTTPS itself (the real limitation is the HTTP-only image health check). [defects, defects #231052]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-3d0ab8d758
Database handbook: 'Temporary filesystem' suggests a tmpfs that is emptied on restart; /tmp is on the container's overlay root. [defects, defects #231053]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-09649667f1
Admin handbook: States that the old v1.26.2/v1.27.2 container rewrites every repository's hooks to /etc/gitea/app.ini before it exits; with this release's database it exits at the migration check and the hooks stay… [defects, defects #231054]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-9a4d8f34c1
Database handbook: Same hook-rewrite claim, not reproduced on v1.26.2. [defects, defects #231055]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-09e9e4db29
Database handbook: Names starting gitea-old as the cause of 'pre-receive hook declined'; on v1.26.2 that start does not change the hooks. [defects, defects #231056]		lowfixed-before-releaseheld review (review model)—
RSD-gitea-3054fd2d91
Admin handbook: Round-2/3/4 finding 'dump documented as working on any instance' persists in the Operating facts passage, which has no fresh-instance caveat. [defects, defects #231057]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:b80d6c7290be1e9121d9b818660d8f4083fbed6788caa92d1adb322bbc0c2993 · published digest sha256:b80d6c7290be1e9121d9b818660d8f4083fbed6788caa92d1adb322bbc0c2993 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 161) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-10T22:41:19Z · failing Docker Scout counts 122 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-10T22:41:04Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3795328630 · transparency-log entry · integrated 2026-11-10T22:45:29Z) [ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:f6bdd508ee992253c897f1f4768c206745c88f0357bdb9432553c99f81713e0e · state attached · log index 3795334754 · transparency-log entry
    • kind sbom · digest sha256:f6bdd508ee992253c897f1f4768c206745c88f0357bdb9432553c99f81713e0e · state present
    • kind vsa · digest sha256:f6bdd508ee992253c897f1f4768c206745c88f0357bdb9432553c99f81713e0e · state attached · log index 3795339026 · transparency-log entry
    • kind provenance · digest sha256:b80d6c7290be1e9121d9b818660d8f4083fbed6788caa92d1adb322bbc0c2993 · state attached · log index 3795343136 · transparency-log entry
    • kind sbom · digest sha256:b80d6c7290be1e9121d9b818660d8f4083fbed6788caa92d1adb322bbc0c2993 · state present
    • kind vsa · digest sha256:b80d6c7290be1e9121d9b818660d8f4083fbed6788caa92d1adb322bbc0c2993 · state attached · log index 3795347632 · transparency-log entry
    (at 2026-11-10T22:45:32Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/gitea/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T01:16:47Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:b80d6c7290be1e9121d9b818660d8f4083fbed6788caa92d1adb322bbc0c2993 [clean-room rebuild ledger, runs[678]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-09T00:13:24Z [stage_runs, stage_runs chain 869 stage publish_image]
  • Archive manifests written2026-11-10T22:43:23Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 859 · probed 2026-11-09T22:30:36Z · source g8) [release_images, isa_level_hard]

History

2 events
  • 2026-11-10T22:46:54Z generated: by KitForge release/build_trail.py · generator commit c6766955b9cc7015f3fb0e2dfbef7c56443ec83b
  • 2026-11-10T22:48:33Z publication: promoted at 2026-11-10T22:47:31Z · promoted digest sha256:f6bdd508ee992253c897f1f4768c206745c88f0357bdb9432553c99f81713e0e · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 451 · checklist status complete · checklist at 2026-11-10T22:48:33Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/gitea/v28.3.0-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/gitea/v28.3.0-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/gitea/v28.3.0-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-gitea-v28.3.0-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/gitea/v28.3.0-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/gitea/v28.3.0-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)560
chainssadb, ReadyStack's engine database (not published)869
defectssadb, ReadyStack's engine database (not published)gitea v28.3.0-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 869
held_roundssadb, ReadyStack's engine database (not published)chain 869
lesson_recallssadb, ReadyStack's engine database (not published)chain 869
micro_step_runssadb, ReadyStack's engine database (not published)chain 869
release_imagessadb, ReadyStack's engine database (not published)gitea v28.3.0-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 869
stage_runssadb, ReadyStack's engine database (not published)chain 869
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—