Grafana v13.3.0-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/grafana:v13.3.0-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/grafana:v13.3.0-CE-ubuntu24.04-r1
  • Index digestsha256:743df6d5955bcf09c4d5fb479299640a8324b9ccbd8ff01c83adc37c623abf2d
  • linux/amd64 digestsha256:fb27f09a89c9f78502cb62ddf439cb2ce41baa3f4d26f15f105d088cc9f24e38
  • ArchiveReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 nowb8ce66f95b49ae080d7660ef2163582404a05fecd1a5798d866d3590caf02afc
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since 2026-11-03T01:59:59Z)
  • Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
  • Sections9 sections, 4 fully recorded; 10 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.trail.json
ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.trail.jsonReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.trail.mdGrafana product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

1 item not recorded
  • ProductGrafana (grafana) [MANIFEST.json]
  • Release tagv13.3.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/grafana:v13.3.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:743df6d5955bcf09c4d5fb479299640a8324b9ccbd8ff01c83adc37c623abf2d [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:fb27f09a89c9f78502cb62ddf439cb2ce41baa3f4d26f15f105d088cc9f24e38 [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.tar.gz (bytes 789393844) [MANIFEST.json]
  • Archive sha256 at publishb0896285c46c8d7b4b12faee8ec690b4a27fab9168d5dfdcf67df165b62e009b [MANIFEST.json, repack_history[0].previous_tarball_sha256]
  • Archive sha256 now4e20bb4756dc85c09a1fdbeb7ce873bf30d7131e30262605d22d25f629e72448 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack history
    • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 b0896285c46c8d7b4b12faee8ec690b4a27fab9168d5dfdcf67df165b62e009b · sha256 4e20bb4756dc85c09a1fdbeb7ce873bf30d7131e30262605d22d25f629e72448 · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
    [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/grafana/grafana [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv13.3.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit752e3462ff71a43a5c1fb62d00a482fa2dc0ee6a [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash5474f0c37abc06c03971d5af0de625459f01de36f2b3699c9f7223f39a19613e (files 24110) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:b9d98261d7869a1e6958ea8c49e2df42d5cf828b4234f1d2baf34349b66385c8 [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793099250 (utc 2026-10-27T11:07:30Z) [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded
  • Chain724 (created 2026-10-27T20:43:27Z · trigger customer_request · upstream version v13.3.0) [chains, chains #724]
  • Requestbuild request #429 (rebuild) (requested at 2026-10-27T20:28:29Z · requested by kitforge-agent · version v13.3.0) [build_requests, build_requests #429]
  • Reasonretarget to v13.3.0: a newer upstream release (rule 1) [build_requests, build_requests #429 request_reason]
  • Supersedesreadystack/grafana:v13.2.4-CE-ubuntu24.04-r2 (chain 654) [chains, chains #654]

The path through the harness

2 items not recorded

1 chain · 6 drives · 18 stages · 3 rewinds

Chain 724 release · shipped

Created 2026-10-27T20:43:27Z, upstream v13.3.0, build request 429 [chains, chains #724]

DriveStartedMinutesBuild hostHow it stopped
9852026-10-27T20:44:09Z105.2build host 5 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #985] rebuilt from a build line's log
10202026-10-29T21:51:01Z28.5build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #1020] rebuilt from a build line's log
10222026-10-29T23:01:24Z11.9build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #1022] rebuilt from a build line's log
10242026-10-29T23:45:36Z2.8build host 5 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #1024] rebuilt from a build line's log
10252026-10-29T23:49:54Z11.4build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #1025] rebuilt from a build line's log
10272026-10-30T00:31:10Z16.8build host 5 publish-held shipped [drive_runs, drive_runs #1027] rebuilt from a build line's log

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-27T20:44:16Z2026-10-27T20:44:17Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-27T20:44:28Z2026-10-27T20:44:28Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-27T20:45:10Z2026-10-27T20:45:11Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-27T21:06:40Z2026-10-27T21:06:41Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 —
remediate 2026-10-27T21:07:40Z2026-10-27T21:07:41Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 —
build_kit 2026-10-27T21:30:16Z2026-10-27T21:30:17Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 —
verdict 2026-10-27T21:33:43Z2026-10-27T21:33:44Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 —
publish_image 2026-10-27T21:35:17Z2026-10-27T21:35:18Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 —
boot_instance 2026-10-27T21:35:41Z2026-10-27T21:35:42Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 —
sbom 2026-10-27T21:37:23Z2026-10-27T21:37:24Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 —
schema_discovery 2026-10-27T21:37:26Z2026-10-27T21:37:26Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 —
admin_handbook 2026-10-27T21:48:45Z2026-10-27T21:48:46Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 —
db_handbook 2026-10-27T22:00:33Z2026-10-27T22:00:34Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 —
seed_data 2026-10-27T22:00:48Z2026-10-27T22:00:48Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 —
seed_validate 2026-10-27T22:00:50Z2026-10-27T22:00:51Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 —
usecase_validate 2026-10-27T22:01:38Z2026-10-27T22:01:39Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 —
finalize_docs 2026-10-27T22:16:44Z2026-10-27T22:16:45Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 —
package_archive 2026-10-27T22:29:15Z2026-10-30T00:47:55Z6
33 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 scout_grade_a
  • G8 script_copies
  • G8 three_way_sha
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 assetchain_coverage
 —

[stage_runs]

Rewinds

  • 2026-10-29T22:55:22Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2067]
  • 2026-10-29T23:40:10Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2068]
  • 2026-10-30T00:30:41Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #1216]
  • Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
  • Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-10-30T00:47:55Z.

270 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook965303 not recordednot recorded —
db_handbook753603 not recordednot recorded —
usecase_validate3001 not recordednot recorded —
finalize_docs924003 not recordednot recorded —

[micro_step_runs]

  • Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
  • Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

2 items not recorded

Role: review model.

3 rounds, 3 counted, $10.70 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-10-29T22:20:20Z 01619 findings to repackage [held_rounds, held_rounds #49] rebuilt from a held-review state file $4.05 not recorded not recorded
22026-10-29T23:14:02Z 0522 findings to repackage [held_rounds, held_rounds #50] rebuilt from a held-review state file $3.63 not recorded not recorded
32026-10-30T00:01:51Z 0019 clean to publish [held_rounds, held_rounds #51] rebuilt from a held-review state file $3.02 not recorded not recorded
  • Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
  • Not recorded: the round cap in force at each round (the state files did not keep it)

Defects

Fully recorded
  • Ledger entries80 [defects, defects where product_slug=grafana and this tag or chain]
  • Disclosed in the archive80 [docs/defects/defects.json, entries]

80 ledger entries: by severity low 60, high 20; by status open 1, fixed-before-release 79.

DefectSeverityStatusFound byFixed in
RSD-grafana-854a92ed79
When the first start generated the admin password, the entrypoint puts it in Grafana's process environment on every start [defects, defects #140560]		lowopenruntime check—
RSD-grafana-dd7dd7df80
Admin handbook: The 'Unauthenticated Routes' list names eight /api routes (org, orgs, user, users/lookup, datasources, dashboards/home, frontend/settings, search) as answering without credentials. [defects, defects #140946]		highfixed-before-releaseheld review (review model)—
RSD-grafana-648612e57a
Admin handbook: The Metrics Endpoint section says /metrics is not served, contradicts the same handbook (lines 159, 547-552, 815) and the Operating facts, and says the two variables protect 'admin API calls'; they… [defects, defects #140947]		highfixed-before-releaseheld review (review model)—
RSD-grafana-eb0d69c49f
Admin handbook: Provisioning is not first-start-only: a provisioning file added after the first start was loaded on the next restart and survived the restart (it is lost only when the container is re-created). [defects, defects #140948]		highfixed-before-releaseheld review (review model)—
RSD-grafana-98aec5c7e1
Admin handbook: The build's --network=none says nothing about the running container's network. [defects, defects #140949]		highfixed-before-releaseheld review (review model)—
RSD-grafana-3cd79f9663
Admin handbook: The procedure never removes or replaces grafana.db, so the recreated container opens the same damaged file and 'Grafana will recreate the database on boot' (line 1400) is false. [defects, defects #140950]		highfixed-before-releaseheld review (review model)—
RSD-grafana-e0beca04e2
Admin handbook: The log message quoted does not exist in this release's log. [defects, defects #140951]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-0cab090150
Admin handbook: The port example leaves out that the image HEALTHCHECK is fixed to 3000, so the container shows unhealthy. [defects, defects #140952]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-0ea017bbfb
Admin handbook: The 8 GB requirement (also line 1181 and DB handbook lines 1333, 1423) is not in any record; the record says 23.5 GB host. [defects, defects #140953]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-31966fd472
Database handbook: Says service-account tokens use HTTP Basic; they get 401 that way and the same handbook (lines 261, 1027, 1110) says so. [defects, defects #140954]		highfixed-before-releaseheld review (review model)—
RSD-grafana-a26b16b831
Database handbook: The one example for using a token returns 404 on a default install. [defects, defects #140955]		highfixed-before-releaseheld review (review model)—
RSD-grafana-fb30222571
Database handbook: Lists /api/dashboards/home among routes that work (200) for any signed-in user. [defects, defects #140956]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-25fb15cdf9
Database handbook: False and security-relevant: /api/datasources never answers without credentials, with or without service accounts. [defects, defects #140957]		highfixed-before-releaseheld review (review model)—
RSD-grafana-98805408a5
Database handbook: GF_DATABASE_PORT (and the matching `-e GF_DATABASE_PORT=5432` in the example at line 1211) is not a Grafana setting; a database on a non-default port would silently fail to connect. [defects, defects #140958]		highfixed-before-releaseheld review (review model)—
RSD-grafana-5832a1befe
Database handbook: Lists four built-in data sources; all other sections list five. [defects, defects #140959]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-6e40a46ca2
API guide: Same omission of TestData (also API guide line 2249). [defects, defects #140960]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-0a59280bb1
Database handbook: Wrong status for this endpoint; line 1061 of the same handbook says 500. [defects, defects #140961]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-0ede7528ac
Database handbook: The sentence repeats the same mount twice and tells the reader to chown after mounting. [defects, defects #140962]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-8f5839d45b
Database handbook: The entrypoint reads the file on every start, not only when creating the admin, and the password is then in the Grafana process environment. [defects, defects #140963]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-96d6e3bc67
Database handbook: Contradicts the statement that plugins run as separate child processes. [defects, defects #140964]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-5808ec5a13
API guide: Says the route needs no authentication; it answers 401. [defects, defects #140965]		highfixed-before-releaseheld review (review model)—
RSD-grafana-b484912301
API guide: The endpoint table marks the route as needing no authentication. [defects, defects #140966]		highfixed-before-releaseheld review (review model)—
RSD-grafana-2a57efefb0
API guide: Attributes the /api/orgs 403 to /api/org and says every token gets 403 on /api/org; it gets 200. [defects, defects #140967]		highfixed-before-releaseheld review (review model)—
RSD-grafana-a5d325fff6
API guide: The request field is userOrEmail. [defects, defects #140968]		highfixed-before-releaseheld review (review model)—
RSD-grafana-521e764cfb
API guide: Wrong request field; the 200/500 responses described are only reached with userOrEmail. [defects, defects #140969]		highfixed-before-releaseheld review (review model)—
RSD-grafana-940a663e26
API guide: The guide documents this route as returning the dashboard object (and the same in the examples at 1320 and 2571, the status table at 1950 and the Viewer-token list at 1175); on a default install it… [defects, defects #140970]		highfixed-before-releaseheld review (review model)—
RSD-grafana-4f7b255ce7
API guide: Status table omits 404 and shows 200 as the result. [defects, defects #140971]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-d900025586
API guide: The password is in the Grafana process environment from start to stop, not removed after startup. [defects, defects #140972]		highfixed-before-releaseheld review (review model)—
RSD-grafana-5864a72601
API guide: Token creation answers 200, not 201; a script that checks for 201 treats success as failure. [defects, defects #140973]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-0aaba04e6f
API guide: Token creation answers 200, not 201; a script that checks for 201 treats success as failure. [defects, defects #140974]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-b342c0ad68
API guide: Token creation answers 200, not 201; a script that checks for 201 treats success as failure. [defects, defects #140975]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-660a2b0e86
API guide: Token creation answers 200, not 201; a script that checks for 201 treats success as failure. [defects, defects #140976]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-261aab8e1a
API guide: The row calls the page the login page and shows 200; unauthenticated it is a 302. [defects, defects #140977]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-706066d480
API guide: Contradicts lines 458 and 2140 (and line 2023 'Do not override these variables'). [defects, defects #140978]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-810413942a
API guide: Conflates building offline with running without network. [defects, defects #140979]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-82b6796979
Admin handbook: CloudWatch is not built in: it is one of the plugins Grafana downloads on first start. [defects, defects #141481]		highfixed-before-releaseheld review (review model)—
RSD-grafana-c19e0b4e25
Database handbook: CloudWatch is not built in: it is one of the plugins Grafana downloads on first start. [defects, defects #141482]		highfixed-before-releaseheld review (review model)—
RSD-grafana-632ae65751
API guide: CloudWatch is not built in: it is one of the plugins Grafana downloads on first start. [defects, defects #141483]		highfixed-before-releaseheld review (review model)—
RSD-grafana-5cb7cecf59
Docker Hub README: CloudWatch is not built in: it is one of the plugins Grafana downloads on first start. [defects, defects #141484]		highfixed-before-releaseheld review (review model)—
RSD-grafana-d2b52cbc1a
Database handbook: The response body is 'Invalid username or password', as the Operating facts (line 295) and API guide (1903) say; the quoted message never reaches the client, so a script matching on it fails. [defects, defects #141485]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-0c55c8e89f
API guide: POST /api/user/password/send-reset-email is a documented route and answers without credentials (the same guide says so at 245, 713, 927, 1425, 1523). [defects, defects #141486]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-d93fcd144e
API guide: POST /api/user/password/send-reset-email is a documented route and answers without credentials (the same guide says so at 245, 713, 927, 1425, 1523). [defects, defects #141487]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-a682044888
API guide: POST /api/user/password/send-reset-email is a documented route and answers without credentials (the same guide says so at 245, 713, 927, 1425, 1523). [defects, defects #141488]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-f7f1bbe9c7
API guide: POST /api/user/password/send-reset-email is a documented route and answers without credentials (the same guide says so at 245, 713, 927, 1425, 1523). [defects, defects #141489]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-51cb7002c9
API guide: POST /api/user/password/send-reset-email is a documented route and answers without credentials (the same guide says so at 245, 713, 927, 1425, 1523). [defects, defects #141490]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-2d05d1831c
Database handbook: A service account has no password; the token cannot change one (304, nothing changed). [defects, defects #141491]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-2b3112fff5
API guide: A service account has no password; the token cannot change one (304, nothing changed). [defects, defects #141492]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-8e70a451e1
API guide: A service account has no password; the token cannot change one (304, nothing changed). [defects, defects #141493]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-0f417a62c4
API guide: The response has no `role` field (line 1248 of the same guide says the role is on GET /api/user/orgs entries). [defects, defects #141494]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-7b281e9896
API guide: The 404 bullet gives as its example a request that answers 500, contradicting the guide's own text at 907, 1021 and 1925. [defects, defects #141495]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-7c59d80092
API guide: The status table shows 200 for a route that answers 302 without credentials. [defects, defects #141496]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-a159b44acb
API guide: Web pages other than /login need a sign-in; the sentence says all web pages are served without authentication. [defects, defects #141497]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-61a0e9e344
API guide: Two adjacent paragraphs give opposite instructions for the same variables. [defects, defects #141498]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-0641c69f56
Admin handbook: BUILD_OFFLINE.sh checks only: docker on PATH, jq on PATH, a reachable Docker daemon that reports amd64, and `docker buildx version`. [defects, defects #141499]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-d9f6fd22d9
Admin handbook: BUILD_OFFLINE.sh checks only: docker on PATH, jq on PATH, a reachable Docker daemon that reports amd64, and `docker buildx version`. [defects, defects #141500]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-1f248d311d
Database handbook: BUILD_OFFLINE.sh checks only: docker on PATH, jq on PATH, a reachable Docker daemon that reports amd64, and `docker buildx version`. [defects, defects #141501]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-5fc170d369
Database handbook: BUILD_OFFLINE.sh checks only: docker on PATH, jq on PATH, a reachable Docker daemon that reports amd64, and `docker buildx version`. [defects, defects #141502]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-df909426fa
Admin handbook: The procedure works (I ran it) but a reader who followed the handbook and removed the password line after setup is left with no known login; the sentence does not say so. [defects, defects #141503]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-c154f4e50b
Admin handbook: The bullet is about a container that fails to start; docker exec cannot run in an exited container. [defects, defects #141504]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-a8f1cf3f24
Database handbook: 'Takes several minutes' is not supported by the measurement (about 15 seconds for 19 plugins). [defects, defects #141505]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-628a681693
Database handbook: 'The optional plugins cannot be installed offline' contradicts the handbook's own statements that they download on a later start with internet access or can be placed by hand. [defects, defects #141506]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-3bcc9f2790
Admin handbook: Arguments are not ignored; they reach `grafana server` and an unknown flag stops the container. [defects, defects #142186]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-b64462b288
Database handbook: Same false claim as ADMIN 945: grafana server does not ignore extra arguments. [defects, defects #142187]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-2af3111320
API guide: Same false claim: server arguments are not ignored. [defects, defects #142188]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-438aae9bf9
Admin handbook: Contradicts the handbook's own Operating facts (line 245) and API guide 1903: the CLI reset does not lift the five-failure block. [defects, defects #142189]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-16105eef7d
Admin handbook: After the move-aside the entrypoint reuses an existing initial_admin_password instead of generating one, so the old generated password keeps working; the sentence says it generates one and the old… [defects, defects #142190]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-32668ce616
Admin handbook: The documented POST /api/user/password/send-reset-email answers without credentials (handbook lines 157, 533), so 'all except /api/health' understates the unauthenticated surface (the finding from… [defects, defects #142191]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-9c5c57f1d1
API guide: The guide shows POST /api/user/password/send-reset-email (line 228) and says at 245 it answers without credentials; this sentence omits it. [defects, defects #142192]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-ede29be152
API guide: The list above omits the reset-email route and this sentence says every other route needs credentials; lines 245, 713 and 1710 say the route is unauthenticated. [defects, defects #142193]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-dfb24352e6
Database handbook: The unauthenticated-routes list omits POST /api/user/password/send-reset-email, which the same handbook lists at 188 and the unauthenticated route at 1035. [defects, defects #142194]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-cae69ec7bb
API guide: Overstates the token: the guide itself says at 785 and 1179 that a token cannot read /api/orgs. [defects, defects #142195]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-dc179f0357
API guide: Two false capability claims: an Editor cannot write data sources, and an Admin-role token cannot call /api/admin/stats or the admin password route. [defects, defects #142196]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-1455801374
API guide: An Editor cannot modify data sources or organizations; 'organizations' is also not readable as a list (GET /api/orgs 403 for every token). [defects, defects #142197]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-fef589b7d9
API guide: The sentence implies authentication is required for an existing user; the endpoint never requires it (guide lines 245, 927), and the example above it sends -u needlessly. [defects, defects #142198]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-ab8c51408a
API guide: The row attributes a CLI message to the server in an HTTP API table. [defects, defects #142199]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-515468eb28
Admin handbook: Measured size is 605 MB; DB_HANDBOOK.md:1165 says about 600 MB while this sentence and about twenty others in all three guides, the MANIFEST and README say about 500 MB (doc_facts.data_persistence). [defects, defects #142200]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-ba7ab915d7
Admin handbook: The script never docker-loads the base images; they are build contexts. [defects, defects #142201]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-1b548d2b22
Database handbook: Listed under 'into your local Docker daemon', it says the base images are loaded; they are not. [defects, defects #142202]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-8884c37a91
Database handbook: Same paraphrase of the script's behaviour. [defects, defects #142203]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-ea4df1be80
Database handbook: An external database does not provide any of the missing plugins; offered as an offline remedy it misleads an air-gapped customer. [defects, defects #142204]		lowfixed-before-releaseheld review (review model)—

Verification

2 items not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:fb27f09a89c9f78502cb62ddf439cb2ce41baa3f4d26f15f105d088cc9f24e38 · published digest sha256:fb27f09a89c9f78502cb62ddf439cb2ce41baa3f4d26f15f105d088cc9f24e38 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 604) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 724 package_archive gate_result.g8.result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-30T00:31:58Z · failing Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • First own scan of the releaseA (at 2026-10-30T00:48:11Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-29T06:23:34Z) [image_scans, image_scans #1573]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-30T00:31:22Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3622731122 · transparency-log entry · integrated 2026-11-01T06:43:14Z) [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:743df6d5955bcf09c4d5fb479299640a8324b9ccbd8ff01c83adc37c623abf2d · state attached · log index 3580470269 · transparency-log entry
    • kind sbom · digest sha256:743df6d5955bcf09c4d5fb479299640a8324b9ccbd8ff01c83adc37c623abf2d · state attached · log index 3580473399 · transparency-log entry
    • kind vsa · digest sha256:743df6d5955bcf09c4d5fb479299640a8324b9ccbd8ff01c83adc37c623abf2d · state attached · log index 3580475933 · transparency-log entry
    • kind provenance · digest sha256:fb27f09a89c9f78502cb62ddf439cb2ce41baa3f4d26f15f105d088cc9f24e38 · state attached · log index 3580478905 · transparency-log entry
    • kind sbom · digest sha256:fb27f09a89c9f78502cb62ddf439cb2ce41baa3f4d26f15f105d088cc9f24e38 · state attached · log index 3580481400 · transparency-log entry
    • kind vsa · digest sha256:fb27f09a89c9f78502cb62ddf439cb2ce41baa3f4d26f15f105d088cc9f24e38 · state attached · log index 3580484045 · transparency-log entry
    (at 2026-10-30T00:43:34Z) [attestations.json, results]

Offline clean-room rebuilds

  • 2026-10-29T22:20:23Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:fb27f09a89c9f78502cb62ddf439cb2ce41baa3f4d26f15f105d088cc9f24e38 [clean-room rebuild ledger, runs[557]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
  • Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

Fully recorded
  • Image pushed (internal tag), publish_image passed2026-10-27T21:35:18Z [stage_runs, stage_runs chain 724 stage publish_image]
  • Release tag promoted2026-10-30T00:45:49Z (method imagetools_create_retag_by_digest_no_rebuild · digest sha256:743df6d5955bcf09c4d5fb479299640a8324b9ccbd8ff01c83adc37c623abf2d · tag readystack/grafana:v13.3.0-CE-ubuntu24.04-r1) [deliverables/provenance/PROMOTION_RECORD.json, promoted_at]
  • Archive manifests written2026-10-30T00:37:01Z [PUBLISH_MANIFEST.json, published_at]
  • Archive cut over on prodasset, package_archive passed2026-10-30T00:47:55Z [stage_runs, stage_runs chain 724 stage package_archive]
  • Cut-over markerpresent (chain 724) [.cutover.json]
  • Release checklist and site event2026-10-30T00:47:54Z (status complete · site event 297 · steps grade a verified done · release tag promoted done · cosign signed done · release evidence recorded done · contract gate passed done · archive published done · hub readme live done · reproducibility recorded done · defects ledger published done · catalog available done · build request fulfilled done · seo regenerated skipped · site catalogue refreshed done · site grade recorded done · site queue synced done · customer requests charged done · owners notified done) [deliverables/provenance/RELEASE_CHECKLIST.json, run_at]

Packages and CPU level

Fully recorded
  • Packages in the image636 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 743 · probed 2026-11-02T17:06:33Z · source backfill) [release_images, isa_level_hard]

History

2 events
  • 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records
  • 2026-11-03T01:59:59Z repack: previous sha256 4e20bb4756dc85c09a1fdbeb7ce873bf30d7131e30262605d22d25f629e72448 · sha256 b8ce66f95b49ae080d7660ef2163582404a05fecd1a5798d866d3590caf02afc · reason customer kit files brought up to the current engine: every pinned input's reason (docs/PINS.md, docs/provenance/PINS.json) and docs/PROVENANCE.md's section pointing at it, rendered by release/pin_reasons.py; docs/PROVENANCE.md's 'Build trail' section pointing at the signed build trail beside the archive (release/build_trail.py); not image inputs; image and every build input unchanged · label kitfix · replaced docs/PROVENANCE.md · added docs/PINS.md, docs/provenance/PINS.json · record MANIFEST.json repack_history

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.tar.gz)—
.cutover.jsonbeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r1/)—
MANIFEST.jsonbeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r1/)—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r1/)—
ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r1/)—
ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r1/)—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r1/)—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)429
chainssadb, ReadyStack's engine database (not published)724
defectssadb, ReadyStack's engine database (not published)grafana v13.3.0-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 724
held_roundssadb, ReadyStack's engine database (not published)chain 724
image_scanssadb, ReadyStack's engine database (not published)1573
micro_step_runssadb, ReadyStack's engine database (not published)chain 724
release_imagessadb, ReadyStack's engine database (not published)grafana v13.3.0-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 724
stage_runssadb, ReadyStack's engine database (not published)chain 724
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/RELEASE_CHECKLIST.jsonthe chain's workspace on the controller (not published)—