Grafana v13.3.0-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/grafana:v13.3.0-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/grafana:v13.3.0-CE-ubuntu24.04-r2
  • Index digestsha256:3291391b9c1c410dbced5c782ad9da4cba2b9b58d51b02fad0e649b13a9d9302
  • linux/amd64 digestsha256:e93d042dc17c3a69e0abdc97584c158ad9770c9405d8a4658cefa8f66218997d
  • ArchiveReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now82ae91a0c91fbabbfde81e5d20b8361d9272664ebe1910bf8daa535b282a6ed5
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-07T06:32:07Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.trail.json
ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.trail.jsonReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.trail.mdGrafana product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductGrafana (grafana) [MANIFEST.json]
  • Release tagv13.3.0-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/grafana:v13.3.0-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:3291391b9c1c410dbced5c782ad9da4cba2b9b58d51b02fad0e649b13a9d9302 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:e93d042dc17c3a69e0abdc97584c158ad9770c9405d8a4658cefa8f66218997d [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.tar.gz (bytes 792004431) [MANIFEST.json]
  • Archive sha256 at publish82ae91a0c91fbabbfde81e5d20b8361d9272664ebe1910bf8daa535b282a6ed5 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/grafana/grafana [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv13.3.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit752e3462ff71a43a5c1fb62d00a482fa2dc0ee6a [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash5474f0c37abc06c03971d5af0de625459f01de36f2b3699c9f7223f39a19613e (files 24110) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:077d61bb07caf34aa40ec14fa3062979fa1cee1a703ae1f8e8e696ee3c15f742 [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793099250 (utc 2026-10-27T11:07:30Z) [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit 07abd1e1c1197982ae81cf5d46861dd8f90c3cf6 · dirty yes · first drive 3554
    • commit a40e4d9d4d44a5f8647c6bf01ffdee4ed8801afd · dirty yes · first drive 3585
    • commit 2488ac8956ee2098ba13f3ff11fe53d8cbec9ffb · dirty yes · first drive 3587
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain834 (created 2026-11-07T03:21:13Z · trigger customer_request · upstream version v13.3.0) [chains, chains #834]
  • Requestbuild request #511 (rebuild) (requested at 2026-11-07T02:01:21Z · requested by kitforge-agent · version v13.3.0) [build_requests, build_requests #511]
  • Reasonrerelease agenda REVISION -> v13.3.0-CE-ubuntu24.04-r2 (decay loop, IMP-08) [build_requests, build_requests #511 request_reason]
  • Supersedesreadystack/grafana:v13.3.0-CE-ubuntu24.04-r1 (chain 724) [chains, chains #724]

The path through the harness

Fully recorded

1 chain · 4 drives · 18 stages · 2 rewinds

Chain 834 release · ready_to_ship

Created 2026-11-07T03:21:13Z, upstream v13.3.0, build request 511 [chains, chains #834]

DriveStartedMinutesBuild hostHow it stopped
35542026-11-07T03:21:56Z61.4build host 3 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3554]
35852026-11-07T05:33:45Z11.4build host 3 withhold-publish infra_hub_rate_limit at package_archive; 1 tick [drive_runs, drive_runs #3585]
35872026-11-07T06:02:50Z10.1build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3587]
35942026-11-07T06:18:54Z—build host 3 publish-held not recorded [drive_runs, drive_runs #3594]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-07T03:22:06Z2026-11-07T03:22:07Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 7a7a7ee812a4…
acquire 2026-11-07T03:22:20Z2026-11-07T03:22:22Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 49a0e14ba53e…
license_file 0d96a4ff68ad…
custody_inputs b8f56df1b6c8…
source_tree_hash 3c7a3cc22190…
source_file_manifest 1d211a0f54bd…
plan 2026-11-07T03:23:24Z2026-11-07T03:23:25Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 4dd41a0869ae…
input_pin_plan f0d9c3c46341…
toolchain_lock b906873c5502…
assemble_kit 2026-11-07T03:39:28Z2026-11-07T03:39:28Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile c7053ab6a90b…
build_recipe c227ec573078…
system_pinning fa091140511e…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 5073e50fab04…
verify_offline_sh 3e8184ea230c…
base_image_digests f0e255a1ca07…
dockerfile_offline c7053ab6a90b…
first_build_digest 83e478791124…
remediate 2026-11-07T03:40:10Z2026-11-07T03:40:11Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log f485f69b6ccc…
security_report 3210250dd110…
build_kit 2026-11-07T03:57:32Z2026-11-07T03:57:33Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 30551355c3df…
locked_digest 4c597c375a37…
freeze_manifest 90afef21b35a…
offline_rebuild_transcript 5cc39c38ed83…
verdict 2026-11-07T03:59:52Z2026-11-07T03:59:53Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 4b09e9080696…
publish_image 2026-11-07T04:01:10Z2026-11-07T04:01:11Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 48b4c36eac89…
promotion_record b29751e7fc9b…
boot_instance 2026-11-07T04:01:29Z2026-11-07T04:01:33Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle eb412aa738c7…
sbom 2026-11-07T04:02:56Z2026-11-07T04:02:57Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 848349e4e26f…
sbom_json a3710ff71a97…
schema_discovery 2026-11-07T04:02:59Z2026-11-07T04:03:00Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 68355563d2ba…
dependency_tree 6183c9fa04c2…
table_classification 11dd9c3348e7…
admin_handbook 2026-11-07T04:03:08Z2026-11-07T04:03:09Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 760c9f552989…
admin_handbook 8db345b1c427…
db_handbook 2026-11-07T04:03:19Z2026-11-07T04:03:20Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook e592baf0151e…
seed_isolation 93b95dd1eab9…
seed_data 2026-11-07T04:03:34Z2026-11-07T04:03:34Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 1ed9a8290a0b…
seed_cases_json 5940fa57b6c9…
seed_validate 2026-11-07T04:03:37Z2026-11-07T04:03:38Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract a5d428ea383c…
usecase_validate 2026-11-07T04:04:08Z2026-11-07T04:04:09Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests 05517dad6f1f…
passed_tests 5ee41fcb2bb6…
test_results 4c933f00c081…
usecase_contract a902f1aa953b…
finalize_docs 2026-11-07T04:04:15Z2026-11-07T04:04:15Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 4ac020bcdc2b…
release_notes 7dfd831c17fb…
api_integration_guide cc39529d41d9…
package_archive invalidated 2026-11-07T06:18:29Z 2026-11-07T04:23:19Z2026-11-07T06:12:54Z2
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar da04178db077…
checksums 6ac98592f10c…
verify_md 889beac7ecd0…
rebuild_md 055a05281a1f…
manifest_txt 476c13d76254…
actions_jsonl 6f6712da2286…
provenance_md 64f71a121903…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 755f838eec5e…

[stage_runs]

Rewinds

  • 2026-11-07T04:52:45Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #23880]
  • 2026-11-07T06:18:29Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24095]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-07T06:12:54Z.

5 calls over 3 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 011488 L-A183, L-A15
remediate2001 012011 L-A183, L-A15
usecase_validate1001 02335 L-A59

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $0.90 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-07T04:25:04Z 010 findings to repackage [held_rounds, held_rounds #1428] $0.55 3 rounds, $40.00 576d8331a83f…
22026-11-07T06:13:24Z 000 clean to publish [held_rounds, held_rounds #1440] $0.35 3 rounds, $40.00 da04178db077…

Defects

Fully recorded
  • Ledger entries21 [defects, defects where product_slug=grafana and this tag or chain]
  • Disclosed in the archive2 [docs/defects/defects.json, entries]

21 ledger entries: by severity low 20, high 1; by status open 1, fixed-before-release 1, fixed-in-release 19.

DefectSeverityStatusFound byFixed in
RSD-grafana-382f92c266
When the first start generated the admin password, the entrypoint puts it in Grafana's process environment on every start [defects, defects #159727]		lowopenruntime check—
RSD-grafana-1b8f5303d6
Admin handbook: Stale release tag -r1 in the About paragraph; the release is -r2 and -r1 was never published. [defects, defects #160344]		highfixed-before-releaseheld review (review model)—
RSD-grafana-6f377e19d2
Database handbook: An external database does not provide any of the missing plugins; offered as an offline remedy it misleads an air-gapped customer. [defects, defects #163971]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-0db5bb3215
Admin handbook: Arguments are not ignored; they reach `grafana server` and an unknown flag stops the container. [defects, defects #163972]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-25760765ed
Database handbook: Same false claim as ADMIN 945: grafana server does not ignore extra arguments. [defects, defects #163973]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-d4eb7303a8
API guide: Same false claim: server arguments are not ignored. [defects, defects #163974]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-97976db917
Admin handbook: Contradicts the handbook's own Operating facts (line 245) and API guide 1903: the CLI reset does not lift the five-failure block. [defects, defects #163975]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-8138b5bfd1
Admin handbook: After the move-aside the entrypoint reuses an existing initial_admin_password instead of generating one, so the old generated password keeps working; the sentence says it generates one and the old… [defects, defects #163976]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-0269eedf1a
Admin handbook: The documented POST /api/user/password/send-reset-email answers without credentials (handbook lines 157, 533), so 'all except /api/health' understates the unauthenticated surface (the finding from… [defects, defects #163977]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-456e394b8a
API guide: The guide shows POST /api/user/password/send-reset-email (line 228) and says at 245 it answers without credentials; this sentence omits it. [defects, defects #163978]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-2f0f775f77
API guide: The list above omits the reset-email route and this sentence says every other route needs credentials; lines 245, 713 and 1710 say the route is unauthenticated. [defects, defects #163979]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-3474552303
Database handbook: The unauthenticated-routes list omits POST /api/user/password/send-reset-email, which the same handbook lists at 188 and the unauthenticated route at 1035. [defects, defects #163980]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-db47bd022f
API guide: Overstates the token: the guide itself says at 785 and 1179 that a token cannot read /api/orgs. [defects, defects #163981]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-bea17327c2
API guide: Two false capability claims: an Editor cannot write data sources, and an Admin-role token cannot call /api/admin/stats or the admin password route. [defects, defects #163982]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-7f7c467bc7
API guide: An Editor cannot modify data sources or organizations; 'organizations' is also not readable as a list (GET /api/orgs 403 for every token). [defects, defects #163983]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-1acd07280d
Admin handbook: Measured size is 605 MB; DB_HANDBOOK.md:1165 says about 600 MB while this sentence and about twenty others in all three guides, the MANIFEST and README say about 500 MB (doc_facts.data_persistence). [defects, defects #163984]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-1720f32957
Admin handbook: The script never docker-loads the base images; they are build contexts. [defects, defects #163985]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-e705b3019f
Database handbook: Same paraphrase of the script's behaviour. [defects, defects #163986]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-b946227117
API guide: The row attributes a CLI message to the server in an HTTP API table. [defects, defects #163987]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-ce42a3e4da
API guide: The sentence implies authentication is required for an existing user; the endpoint never requires it (guide lines 245, 927), and the example above it sends -u needlessly. [defects, defects #163988]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2
RSD-grafana-6facb0b4dc
Database handbook: Listed under 'into your local Docker daemon', it says the base images are loaded; they are not. [defects, defects #163989]		lowfixed-in-releaseheld review (review model)v13.3.0-CE-ubuntu24.04-r2

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:e93d042dc17c3a69e0abdc97584c158ad9770c9405d8a4658cefa8f66218997d · published digest sha256:e93d042dc17c3a69e0abdc97584c158ad9770c9405d8a4658cefa8f66218997d · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 444) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-07T06:19:43Z · failing Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-07T06:19:06Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3731249270 · transparency-log entry · integrated 2026-11-07T06:30:11Z) [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:3291391b9c1c410dbced5c782ad9da4cba2b9b58d51b02fad0e649b13a9d9302 · state attached · log index 3731254638 · transparency-log entry
    • kind sbom · digest sha256:3291391b9c1c410dbced5c782ad9da4cba2b9b58d51b02fad0e649b13a9d9302 · state attached · log index 3731255764 · transparency-log entry
    • kind vsa · digest sha256:3291391b9c1c410dbced5c782ad9da4cba2b9b58d51b02fad0e649b13a9d9302 · state attached · log index 3731257262 · transparency-log entry
    • kind provenance · digest sha256:e93d042dc17c3a69e0abdc97584c158ad9770c9405d8a4658cefa8f66218997d · state attached · log index 3731258828 · transparency-log entry
    • kind sbom · digest sha256:e93d042dc17c3a69e0abdc97584c158ad9770c9405d8a4658cefa8f66218997d · state attached · log index 3731260133 · transparency-log entry
    • kind vsa · digest sha256:e93d042dc17c3a69e0abdc97584c158ad9770c9405d8a4658cefa8f66218997d · state attached · log index 3731261433 · transparency-log entry
    (at 2026-11-07T06:30:11Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/grafana/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-07T04:25:10Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:e93d042dc17c3a69e0abdc97584c158ad9770c9405d8a4658cefa8f66218997d [clean-room rebuild ledger, runs[604]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-07T04:01:11Z [stage_runs, stage_runs chain 834 stage publish_image]
  • Archive manifests written2026-11-07T06:24:52Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 743 · probed 2026-11-07T03:49:51Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-07T06:32:07Z generated: by KitForge release/build_trail.py · generator commit dd96302b9a90f1c60df2b90f5c0b896669121550
  • 2026-11-07T06:34:27Z publication: promoted at 2026-11-07T06:32:44Z · promoted digest sha256:3291391b9c1c410dbced5c782ad9da4cba2b9b58d51b02fad0e649b13a9d9302 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 336 · checklist status complete · checklist at 2026-11-07T06:34:27Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)511
chainssadb, ReadyStack's engine database (not published)834
defectssadb, ReadyStack's engine database (not published)grafana v13.3.0-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 834
held_roundssadb, ReadyStack's engine database (not published)chain 834
lesson_recallssadb, ReadyStack's engine database (not published)chain 834
micro_step_runssadb, ReadyStack's engine database (not published)chain 834
release_imagessadb, ReadyStack's engine database (not published)grafana v13.3.0-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 834
stage_runssadb, ReadyStack's engine database (not published)chain 834
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—