Grafana v13.3.0-CE-ubuntu24.04-r3 build trail

How ReadyStack built readystack/grafana:v13.3.0-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/grafana:v13.3.0-CE-ubuntu24.04-r3
  • Index digestsha256:86ef5d1eff879b9f265ed9ca3cde6503116e9cb06663994b95da45e6689e6c24
  • linux/amd64 digestsha256:2a85b54e6b17dea2571f42cbda55542f2de6b41c93fb004eb245e74611918304
  • ArchiveReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.tar.gz
  • Archive SHA-256 nowbe5eee2f00922660bd6d7df72a9768be30585cac614cdf15ef2b0df3fc2887e7
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-08T18:21:59Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.trail.json
ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.trail.jsonReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.trail.json.sigstoreReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.trail.mdGrafana product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductGrafana (grafana) [MANIFEST.json]
  • Release tagv13.3.0-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Imagereadystack/grafana:v13.3.0-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Image index digestsha256:86ef5d1eff879b9f265ed9ca3cde6503116e9cb06663994b95da45e6689e6c24 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:2a85b54e6b17dea2571f42cbda55542f2de6b41c93fb004eb245e74611918304 [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.tar.gz (bytes 800626577) [MANIFEST.json]
  • Archive sha256 at publishbe5eee2f00922660bd6d7df72a9768be30585cac614cdf15ef2b0df3fc2887e7 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/grafana/grafana [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv13.3.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit752e3462ff71a43a5c1fb62d00a482fa2dc0ee6a [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash5474f0c37abc06c03971d5af0de625459f01de36f2b3699c9f7223f39a19613e (files 24110) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:157b945ec838bd0dd157fb0b54363bc42c7c2c72518508c08a50e0f542a13c2b [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793099250 (utc 2026-10-27T11:07:30Z) [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.rebuild.json, engine]
  • Engine commit(s)
    • commit de82d9f15f2f16d4019ffa4fd6872481dac1dbe0 · dirty yes · first drive 3672
    • commit 2d1ae189f0cfc9706683f33be126c89e775e7d32 · dirty yes · first drive 3712
    • commit 652df6e0e6aa50b44c0f12948b3d5baab047fc1f · dirty yes · first drive 3741
    • commit 1b6b66826eaa0cb5f2f833b5a6a84e7c72e9e068 · dirty yes · first drive 3756
    • commit 80f38df958422550987d342edfe69f26108fb99e · dirty yes · first drive 3797
    • commit fb3d89dbdf1a4d4d5e6b01f0cfad0b5ef4a697f2 · dirty yes · first drive 3827
    • commit 70e6bdff7c0e7d3ec863993e8fb01b616e6715cb · dirty yes · first drive 3836
    • commit 30a7d774a664caace170ed58c16968ba81faf746 · dirty yes · first drive 3843
    • commit 7c6b61ce76feba4df822395cea465de0973154b4 · dirty yes · first drive 3848
    • commit f3794625f7ed05ee0221ea5e00e05d3163c6f4ba · dirty yes · first drive 3854
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain861 (created 2026-11-08T02:56:42Z · trigger customer_request · upstream version v13.3.0) [chains, chains #861]
  • Requestbuild request #542 (rebuild) (requested at 2026-11-08T02:54:52Z · requested by kitforge-agent · version v13.3.0) [build_requests, build_requests #542]
  • Reasonrevision v13.3.0-CE-ubuntu24.04-r3: same upstream version rebuilt on the chiselled slim base (Core slim batch, PR #195; retarget.py --rev-bump) [build_requests, build_requests #542 request_reason]
  • Supersedesreadystack/grafana:v13.3.0-CE-ubuntu24.04-r2 (chain 834) [chains, chains #834]

The path through the harness

Fully recorded

1 chain · 10 drives · 18 stages · 5 rewinds

Chain 861 release · ready_to_ship

Created 2026-11-08T02:56:42Z, upstream v13.3.0, build request 542 [chains, chains #861]

DriveStartedMinutesBuild hostHow it stopped
36722026-11-08T02:57:34Z101.5build host 1 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3672]
37122026-11-08T06:00:10Z15.9build host 1 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3712]
37412026-11-08T09:12:46Z11.7build host 1 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3741]
37562026-11-08T10:10:57Z10.9build host 1 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3756]
37972026-11-08T12:26:30Z19.3build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3797]
38272026-11-08T15:25:35Z9.4build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3827]
38362026-11-08T16:40:26Z9.3build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3836]
38432026-11-08T17:18:52Z10.6build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3843]
38482026-11-08T17:53:39Z0.4build host 1 publish-held stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3848]
38542026-11-08T18:10:49Z—build host 1 publish-held not recorded [drive_runs, drive_runs #3854]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-08T02:57:44Z2026-11-08T02:57:45Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 0fce3c5a8f72…
acquire 2026-11-08T02:57:57Z2026-11-08T02:57:59Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 49a0e14ba53e…
license_file 0d96a4ff68ad…
custody_inputs b8f56df1b6c8…
source_tree_hash 3c7a3cc22190…
source_file_manifest 1d211a0f54bd…
plan 2026-11-08T02:58:49Z2026-11-08T02:58:50Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 0ddf18803e19…
input_pin_plan 8a69b63c822d…
toolchain_lock d41121cab240…
assemble_kit 2026-11-08T03:15:10Z2026-11-08T03:15:11Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 0c206ae6469e…
build_recipe 7a3bf4ba73c1…
system_pinning fa091140511e…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health f424e85757e9…
verify_offline_sh 3e8184ea230c…
base_image_digests f0e255a1ca07…
dockerfile_offline 0c206ae6469e…
first_build_digest 3850c0892448…
remediate 2026-11-08T03:16:03Z2026-11-08T03:16:04Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 847db59a8cf4…
security_report 33402a41cb95…
build_kit 2026-11-08T03:34:42Z2026-11-08T03:34:43Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 0ce37b595f93…
locked_digest 008a86de9d64…
freeze_manifest b6405d738ad7…
offline_rebuild_transcript b78767d9d395…
verdict 2026-11-08T03:36:18Z2026-11-08T03:36:18Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict b588310e0766…
publish_image 2026-11-08T03:37:13Z2026-11-08T03:37:14Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 4a1bdab0580b…
promotion_record 742d6d010eba…
boot_instance 2026-11-08T03:37:33Z2026-11-08T03:37:38Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 599e01cbf85d…
sbom 2026-11-08T03:38:59Z2026-11-08T03:39:01Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md a8a950bff3f2…
sbom_json cf6034ef2d87…
schema_discovery 2026-11-08T03:39:05Z2026-11-08T03:39:07Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 68355563d2ba…
dependency_tree 6183c9fa04c2…
table_classification 11dd9c3348e7…
admin_handbook 2026-11-08T03:51:57Z2026-11-08T03:51:58Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 760c9f552989…
admin_handbook a04870b7b666…
db_handbook 2026-11-08T04:04:48Z2026-11-08T04:04:49Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 8083706abe6d…
seed_isolation 93b95dd1eab9…
seed_data 2026-11-08T04:05:09Z2026-11-08T04:05:10Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 1ed9a8290a0b…
seed_cases_json e4580e333a4e…
seed_validate 2026-11-08T04:05:12Z2026-11-08T04:05:13Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 6073ceb60fec…
usecase_validate 2026-11-08T04:05:55Z2026-11-08T04:05:56Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests ef8f82b6fdab…
passed_tests f584f744939d…
test_results 2494e1c757f1…
usecase_contract fe0411cd5cf5…
finalize_docs 2026-11-08T04:20:07Z2026-11-08T04:20:08Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 3ae6bbdc0620…
release_notes fdd4835c0de7…
api_integration_guide b36a33678d35…
package_archive 2026-11-08T04:39:01Zfailed9
22
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
 sale_tar 8275990c8627…
checksums 9ee552004939…
verify_md fb5d4c33dad8…
rebuild_md d57324356a5d…
manifest_txt 203a98d19285…
actions_jsonl f43b33afd15e…
provenance_md e32aa2ef8451…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 9b40ad93a55a…

[stage_runs]

Rewinds

  • 2026-11-08T13:36:19Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26381]
  • 2026-11-08T16:02:07Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26696]
  • 2026-11-08T17:17:43Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26875]
  • 2026-11-08T17:53:08Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26940]
  • 2026-11-08T18:10:25Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26994]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-08T18:21:53Z.

476 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 012472 —
remediate2001 015822 L-A08, L-038, L-036, L-034, L-032
admin_handbook1528803 391265325 —
db_handbook1307003 271029911 —
usecase_validate3001 07097 —
finalize_docs18710303 431626785 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

4 rounds, 4 counted, $8.35 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-08T12:46:33Z 01215 findings to repackage [held_rounds, held_rounds #1515] $2.80 3 rounds, $40.00 d972f5d0d76c…
22026-11-08T15:35:30Z 0214 findings to repackage [held_rounds, held_rounds #1521] $2.24 3 rounds, $40.00 120dc22c86d0…
32026-11-08T16:50:25Z 0010 clean to repackage [held_rounds, held_rounds #1525] $2.49 3 rounds, $40.00 5e29b6c48244…
42026-11-08T17:29:55Z 002 clean to publish [held_rounds, held_rounds #1529] $0.83 3 rounds, $40.00 8275990c8627…

Defects

Fully recorded
  • Ledger entries55 [defects, defects where product_slug=grafana and this tag or chain]
  • Disclosed in the archive55 [docs/defects/defects.json, entries]

55 ledger entries: by severity high 14, low 41; by status fixed-before-release 54, open 1.

DefectSeverityStatusFound byFixed in
RSD-grafana-a5d325fff6
API guide: POST /api/user/password/send-reset-email with {"email":"admin@localhost"} -> 400 {"message":"bad request data"}; the field is userOrEmail (line 815 of the same guide). [defects, defects #140968]		highfixed-before-releaseheld review (review model)—
RSD-grafana-1a74f0d58f
When the first start generated the admin password, the entrypoint puts it in Grafana's process environment on every start [defects, defects #176972]		lowopenruntime check—
RSD-grafana-11035169dd
Admin handbook: Ran it: after `docker stop`, the same `docker run --name grafana ...` fails with a name-conflict error (container name already in use), and `docker start` keeps the old environment (/proc/1/environ… [defects, defects #177578]		highfixed-before-releaseheld review (review model)—
RSD-grafana-c161359d5e
Admin handbook: `docker exec jt-ha861-grafana ps` -> `exec: "ps": executable file not found in $PATH`; provenance/IMAGE_BINARIES.txt has no ps. [defects, defects #177579]		highfixed-before-releaseheld review (review model)—
RSD-grafana-66353dd64f
Admin handbook: Measured: body {"userOrEmail":"admin"} -> 500 {"message":"Failed to send email"}; {"userOrEmail":"nobody"} -> 200 {"message":"Email sent"}. [defects, defects #177580]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-17f63ac437
Database handbook: Ran backup (stopped container, tar), revoked the token (DELETE ... [defects, defects #177581]		highfixed-before-releaseheld review (review model)—
RSD-grafana-6b28184f0f
Database handbook: Contradicts DB_HANDBOOK.md:1417, 1441 and REBUILD/Operating facts: `--network=none` isolates only RUN steps and a plain docker build resolves bases from a registry and does not reproduce the digest;… [defects, defects #177582]		highfixed-before-releaseheld review (review model)—
RSD-grafana-d4ad608b52
Database handbook: Removing the volume deletes grafana.db with the stored password; entrypoint (docker/readystack-entrypoint.sh) generates a fresh password when no password is set and grafana.db is absent, so no… [defects, defects #177583]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-c65c65ec81
Database handbook: Same paragraph says plugins run as child processes; measured /proc: grafana server plus gpx_* processes (loki, influxdb, elasticsearch, ...). [defects, defects #177584]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-59fb006d0d
Database handbook: After 5 failed POST /login the 6th-8th (even with the right password) returned {"message":"Invalid username or password"} 401; the 'too many consecutive incorrect login attempts' text appears only… [defects, defects #177585]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-b2ccc7c65a
Database handbook: Ran -v <host dir owned by uid 1000>:/var/lib/grafana with GF_SECURITY_ADMIN_PASSWORD set: 'failed to connect to database: failed to create SQLite database file "/var/lib/grafana/grafana.db": open… [defects, defects #177586]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-2c82b47a90
API guide: Measured with a uid-1000 bind-mounted empty directory: 'failed to create SQLite database file "/var/lib/grafana/grafana.db": open /var/lib/grafana/grafana.db: permission denied'; compare… [defects, defects #177587]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-3687c63baa
API guide: POST /api/user/password/send-reset-email with {"user":{"loginOrEmail":"admin"}} -> 400 {"message":"bad request data"}; {"userOrEmail":"admin"} -> 500 Failed to send email (no SMTP). [defects, defects #177588]		highfixed-before-releaseheld review (review model)—
RSD-grafana-618ce9ae78
API guide: Admin-role SA token: POST /api/serviceaccounts {"name":"x1","role":"Viewer"} -> 201; Viewer token -> 403. [defects, defects #177589]		highfixed-before-releaseheld review (review model)—
RSD-grafana-975228ae0b
API guide: Admin-role SA token: GET /api/admin/stats -> 403 but POST /api/serviceaccounts -> 201 (Viewer token -> 403). [defects, defects #177590]		highfixed-before-releaseheld review (review model)—
RSD-grafana-f896174aac
API guide: Admin-role SA token: /api/admin/stats 403, /api/orgs 403, /api/users/lookup 403, PUT /api/admin/users/2/password 403. [defects, defects #177591]		highfixed-before-releaseheld review (review model)—
RSD-grafana-d2499f8f7b
API guide: Admin-role SA token: PUT /api/admin/users/2/password -> 403 (admin Basic -> 200 'User password updated'). [defects, defects #177592]		highfixed-before-releaseheld review (review model)—
RSD-grafana-3e45ea88a1
API guide: Admin-role SA token -> 201; Viewer -> 403. [defects, defects #177593]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-48c18b2d22
API guide: Admin-role SA token -> 201 for POST /api/serviceaccounts. [defects, defects #177594]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-3ce2e6a33b
API guide: Unauthenticated curl: /api/org 401, /api/admin/stats 401, /api/datasources 401, /api/frontend/settings 401, /api/dashboards/home 401, / 302 -> /login. [defects, defects #177595]		highfixed-before-releaseheld review (review model)—
RSD-grafana-39b6c2fe5e
API guide: Admin Basic auth: GET /api/dashboards/home -> 404 {"message":"No custom home dashboard configured"}; validation/test-results.json gf_home_dashboard expected 200, actual 404; the guide says 404… [defects, defects #177596]		highfixed-before-releaseheld review (review model)—
RSD-grafana-95e18d7d3d
API guide: GET /api/dashboards/home answers 404 on a default install (test-results.json gf_home_dashboard actual_status 404), so it is not among the 200 responses. [defects, defects #177597]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-f3294b8af0
API guide: POST /api/serviceaccounts -> 201 [Created]; POST /api/serviceaccounts/2/tokens -> 200 {"id":..,"name":"t2","key":"glsa_..."}; line 1183 of the same guide says 200. [defects, defects #177598]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-f3e3f47cb9
API guide: Measured 200 for the token create call (see line 1183). [defects, defects #177599]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-9c2b1b96a2
API guide: curl localhost/api/orgs without credentials -> 401; Viewer/Admin SA token -> 403. [defects, defects #177600]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-24a2a968bc
API guide: Started with GF_METRICS_ENABLED=false: `curl -i /metrics` -> HTTP/1.1 302 Found, Location: /login?redirectTo=%2Fmetrics. [defects, defects #177601]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-ff4e71614d
API guide: Contradicts API_INTEGRATION_GUIDE.md:1437 and ADMIN_HANDBOOK.md:148/843, which say the GF_PATHS_* values can be overridden. [defects, defects #177602]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-e6589b25fb
Docker Hub README: Open defect RSD-grafana-e6589b25fb stands: bundle/MANIFEST.json says free_release false, price 1000 cents, while README lines 15 and 97 say free (engine-generated text). [defects, defects #177603]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-bcc2dacec6
API guide: States that an organization administrator (Admin-role service-account token) gets 403 on token creation; it gets 200 and a key. [defects, defects #179158]		highfixed-before-releaseheld review (review model)—
RSD-grafana-3e073cdfa9
API guide: Token creation does not need the Grafana server administrator role; an Admin-role service-account token succeeds. [defects, defects #179159]		highfixed-before-releaseheld review (review model)—
RSD-grafana-452527d520
API guide: Same root as line 1011: DELETE of a token succeeds with an Admin-role token. [defects, defects #179160]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-53d1b856f2
API guide: Contradicts line 1263 (an Admin-role account is an organization administrator, not a server administrator) and the measured 200. [defects, defects #179161]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-1e5783a456
API guide: Same root as 1229. [defects, defects #179162]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-7fb8a5e782
API guide: Calls an Admin-role token a server administrator; lines 700, 845 and 1263 say it is not (it gets 403 on /api/admin/stats, /api/orgs, /api/users/lookup). [defects, defects #179163]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-aee16e7add
API guide: Self-contradictory and contradicts line 1263. [defects, defects #179164]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-95546f84c8
API guide: The token endpoint's message is serviceaccounts:write. [defects, defects #179165]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-4bd19f7f92
API guide: A service-account token does not work for this endpoint. [defects, defects #179166]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-ab3c7363f1
API guide: Measured status for a service-account token on PUT /api/user/password is 304, not 403. [defects, defects #179167]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-2cd60039cf
API guide: GET /login with credentials answers 302 Location: /, not 200; contradicts line 2007. [defects, defects #179168]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-5e40da8a79
API guide: Not always 200. [defects, defects #179169]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-fa7fcd98e7
API guide: The Administrator Handbook has no recovery steps for missing frontend files. [defects, defects #179170]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-a7ef4cd7e1
Admin handbook: Contradicts DB_HANDBOOK.md:1163 and the API guide:1147; the failures are logged at level=error. [defects, defects #179171]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-8345c5eca3
Admin handbook: The processes belong to installed plugins, not to configured data sources. [defects, defects #179172]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-2349ba56d2
Admin handbook: Sibling lines ADMIN_HANDBOOK.md:339, 394 and the strategy tls fact say a restart policy does not restart an unhealthy container (a restart policy reacts to the process exiting, not to the health… [defects, defects #180389]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-03d032bd77
API guide: Contradicts API_INTEGRATION_GUIDE.md:567 and :1534 ('does not restart unhealthy containers automatically, even with a restart policy') and the strategy tls fact; a restart policy reacts to the… [defects, defects #180390]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-6e8ceaa494
API guide: Measured on the held digest: Bearer tokens of an Admin-role and a Viewer service account on GET /api/admin/stats -> 403 'Permissions needed: server.stats:read'; /api/orgs -> 403 orgs:read;… [defects, defects #180391]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-e1f01a8325
API guide: The example that follows (line 697, curl -H "Authorization: Bearer <token>" .../api/admin/stats) returns 403 'Permissions needed: server.stats:read' for the Admin-role and the Viewer token measured… [defects, defects #180392]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-fe50597cbc
API guide: Measured: a restore returns the database exactly as at backup time, so a token revoked afterwards works again; ADMIN_HANDBOOK.md:445 and API_INTEGRATION_GUIDE.md:1732 say 'revoke those again'. [defects, defects #180393]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-e55c290585
API guide: Measured on the held digest with a Viewer token: DELETE /api/serviceaccounts/<id> -> 403 'Permissions needed: serviceaccounts:delete'; POST /api/serviceaccounts -> 403 serviceaccounts:create. [defects, defects #180394]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-b67fc21fbf
API guide: Measured: an Admin-role token gets 201 on POST /api/serviceaccounts, 200 on POST .../tokens, 200 on DELETE .../tokens/<id>, 200 on POST /api/datasources, and 403 on the server-admin routes; the… [defects, defects #180395]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-fbe8f599d6
API guide: Measured on the held digest: with GF_SERVER_PROTOCOL=https, plain-HTTP GET /api/health -> 400 (same guide, lines 1916 and 1988); 'Always 200' contradicts them. [defects, defects #180396]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-46d241b8bc
API guide: Same root as line 694: every service-account token measured gets 403 server.stats:read on /api/admin/stats, so the documented command fails. [defects, defects #180397]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-6347016757
Docker Hub README: bundle/MANIFEST.json (deliverables): free_release false, chain_price_cents 1000, files.buildkit.price_cents 1000; README lines 15 and 97 say free. [defects, defects #180398]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-47278e06a0
API guide: Measured on the held digest (host run, Admin-role token glsa_...): GET /api/admin/stats -> 403, GET /api/users/lookup?loginOrEmail=admin -> 403 (same Admin token), POST… [defects, defects #181705]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-e157ee0973
API guide: Measured on the held digest: PUT /api/user/password with a Viewer service-account Bearer token -> HTTP 304, nothing changed; API_INTEGRATION_GUIDE.md:477 says the same (304). [defects, defects #181706]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:2a85b54e6b17dea2571f42cbda55542f2de6b41c93fb004eb245e74611918304 · published digest sha256:2a85b54e6b17dea2571f42cbda55542f2de6b41c93fb004eb245e74611918304 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 496) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T18:11:28Z · failing Docker Scout counts 12 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T18:11:03Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3758508505 · transparency-log entry · integrated 2026-11-08T18:20:12Z) [ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:86ef5d1eff879b9f265ed9ca3cde6503116e9cb06663994b95da45e6689e6c24 · state attached · log index 3758509359 · transparency-log entry
    • kind sbom · digest sha256:86ef5d1eff879b9f265ed9ca3cde6503116e9cb06663994b95da45e6689e6c24 · state attached · log index 3758509514 · transparency-log entry
    • kind vsa · digest sha256:86ef5d1eff879b9f265ed9ca3cde6503116e9cb06663994b95da45e6689e6c24 · state attached · log index 3758509751 · transparency-log entry
    • kind provenance · digest sha256:2a85b54e6b17dea2571f42cbda55542f2de6b41c93fb004eb245e74611918304 · state attached · log index 3758509986 · transparency-log entry
    • kind sbom · digest sha256:2a85b54e6b17dea2571f42cbda55542f2de6b41c93fb004eb245e74611918304 · state attached · log index 3758510139 · transparency-log entry
    • kind vsa · digest sha256:2a85b54e6b17dea2571f42cbda55542f2de6b41c93fb004eb245e74611918304 · state attached · log index 3758510367 · transparency-log entry
    (at 2026-11-08T18:20:12Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/grafana/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-08T12:46:38Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:2a85b54e6b17dea2571f42cbda55542f2de6b41c93fb004eb245e74611918304 [clean-room rebuild ledger, runs[649]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-08T03:37:14Z [stage_runs, stage_runs chain 861 stage publish_image]
  • Archive manifests written2026-11-08T18:15:49Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 69 · probed 2026-11-08T03:26:06Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-08T18:21:59Z generated: by KitForge release/build_trail.py · generator commit b90ed12453313e2b8d7014fc17d463e8fff7eda8
  • 2026-11-08T18:24:04Z publication: promoted at 2026-11-08T18:22:35Z · promoted digest sha256:86ef5d1eff879b9f265ed9ca3cde6503116e9cb06663994b95da45e6689e6c24 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 385 · checklist status complete · checklist at 2026-11-08T18:24:04Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r3/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.rebuild.jsonbeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-grafana-v13.3.0-CE-ubuntu24.04-r3.rebuild.json.sigstorebeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r3/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/grafana/v13.3.0-CE-ubuntu24.04-r3/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)542
chainssadb, ReadyStack's engine database (not published)861
defectssadb, ReadyStack's engine database (not published)grafana v13.3.0-CE-ubuntu24.04-r3
drive_runssadb, ReadyStack's engine database (not published)chain 861
held_roundssadb, ReadyStack's engine database (not published)chain 861
lesson_recallssadb, ReadyStack's engine database (not published)chain 861
micro_step_runssadb, ReadyStack's engine database (not published)chain 861
release_imagessadb, ReadyStack's engine database (not published)grafana v13.3.0-CE-ubuntu24.04-r3
stage_eventssadb, ReadyStack's engine database (not published)chain 861
stage_runssadb, ReadyStack's engine database (not published)chain 861
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—