Grafana v13.3.1-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/grafana:v13.3.1-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/grafana:v13.3.1-CE-ubuntu24.04-r1
  • Index digestsha256:f89ea6751c027a179372d71455e8e61683d93c48f60dcee8da9e33657a8d238d
  • linux/amd64 digestsha256:55218b18c26c5bf5fe9f17298e0ea2641e8ed47188bd7edd04dc022752f7c299
  • ArchiveReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 now17ca288704be29ad1547ada426158108d764725421c7b72e160c1e7b8439f3aa
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-11T05:16:39Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.trail.json
ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.trail.jsonReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.trail.mdGrafana product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductGrafana (grafana) [MANIFEST.json]
  • Release tagv13.3.1-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/grafana:v13.3.1-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:f89ea6751c027a179372d71455e8e61683d93c48f60dcee8da9e33657a8d238d [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:55218b18c26c5bf5fe9f17298e0ea2641e8ed47188bd7edd04dc022752f7c299 [ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.tar.gz (bytes 803412566) [MANIFEST.json]
  • Archive sha256 at publish1247cef53a13bba14f288f4bf08b79e116f4461e6d37b0babe9f85f2fd4d4220 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/grafana/grafana [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv13.3.1 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit5db6ba887630c7fa12e5bfd063f2fa854025468c [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashebc4917037d7fdc9a713db1a8912b58cad8403cc0c9eafc8a81ad3366640c602 (files 24130) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:f8d64cb418623e9fe76abaa55bbe3b691597b20b2c9f7ece753dc950423f6562 [ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794360144 (utc 2026-11-11T01:22:24Z) [ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.4-bookworm@sha256:4fa7c968ba93f1635670522dbb01a2c78150443e1385746924566079f36570ea · platform digest sha256:fb7cceb528b47141eccd9b60bf3cbd27d5ef5f8cf5b7d338bec866da495b50dc
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit e06c8c0d4f40771692abda70ebb80df73b0cbb40 · dirty yes · first drive 4237
    • commit 5401036e08c50784f0c84c9b03e433e6440f097d · dirty yes · first drive 4247
    • commit 620d8889fece1a9434ea5c2489f45fdd40dc2b3d · dirty yes · first drive 4254
    • commit c1f462e723936ba7c87d1207ab85ed8f71bbd4d9 · dirty yes · first drive 4260
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain960 (created 2026-11-11T01:23:40Z · trigger customer_request · upstream version v13.3.1) [chains, chains #960]
  • Requestbuild request #640 (rebuild) (requested at 2026-11-11T01:22:31Z · requested by kitforge-agent · version v13.3.1) [build_requests, build_requests #640]
  • Reasonretarget to v13.3.1: a newer upstream release (rule 1) [build_requests, build_requests #640 request_reason]
  • Supersedesreadystack/grafana:v13.3.0-CE-ubuntu24.04-r4 (chain 952) [chains, chains #952]

The path through the harness

Fully recorded

1 chain · 4 drives · 18 stages · 2 rewinds

Chain 960 release · ready_to_ship

Created 2026-11-11T01:23:40Z, upstream v13.3.1, build request 640 [chains, chains #960]

DriveStartedMinutesBuild hostHow it stopped
42372026-11-11T01:24:22Z90.5build host 1 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #4237]
42472026-11-11T03:22:04Z20.9build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4247]
42542026-11-11T04:27:58Z10.2build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4254]
42602026-11-11T05:05:18Z—build host 1 publish-held not recorded [drive_runs, drive_runs #4260]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-11T01:24:32Z2026-11-11T01:24:33Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 609e505fad96…
acquire 2026-11-11T01:24:45Z2026-11-11T01:24:47Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 87f01f9eadd7…
license_file 0d96a4ff68ad…
custody_inputs b999796cb4d6…
source_tree_hash abf886057014…
source_file_manifest 3149abc135df…
plan 2026-11-11T01:25:28Z2026-11-11T01:25:29Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 95a982ca85c9…
input_pin_plan b2acea7fa7f8…
toolchain_lock cd337fe25ddb…
assemble_kit 2026-11-11T01:41:45Z2026-11-11T01:41:46Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 6ba316be5861…
build_recipe 52f018a75587…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health fcdba07110c6…
verify_offline_sh 3e8184ea230c…
base_image_digests 3a366daa0a8d…
dockerfile_offline 6ba316be5861…
first_build_digest e43db8b6f449…
remediate 2026-11-11T01:42:20Z2026-11-11T01:42:21Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 8c2ee8344931…
security_report 83f23836929c…
build_kit 2026-11-11T02:01:30Z2026-11-11T02:01:31Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp c6db50769ea8…
locked_digest 2519ee0d60ff…
freeze_manifest 49eced108e3c…
offline_rebuild_transcript 2ba2a2d947f2…
verdict 2026-11-11T02:03:07Z2026-11-11T02:03:08Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 98885c848c28…
publish_image 2026-11-11T02:04:01Z2026-11-11T02:04:01Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 36b8c9814dec…
promotion_record 0883eea08718…
boot_instance 2026-11-11T02:04:19Z2026-11-11T02:04:22Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 018731a4e573…
sbom 2026-11-11T02:05:40Z2026-11-11T02:05:41Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 648372e70918…
sbom_json aedf6324bd02…
schema_discovery 2026-11-11T02:05:44Z2026-11-11T02:05:45Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 68355563d2ba…
dependency_tree 6183c9fa04c2…
table_classification 11dd9c3348e7…
admin_handbook 2026-11-11T02:16:51Z2026-11-11T02:16:51Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 760c9f552989…
admin_handbook c06e49e1e065…
db_handbook 2026-11-11T02:30:14Z2026-11-11T02:30:14Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook f484e048d4e6…
seed_isolation 93b95dd1eab9…
seed_data 2026-11-11T02:30:35Z2026-11-11T02:30:36Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 1ed9a8290a0b…
seed_cases_json d90829fcf8ed…
seed_validate 2026-11-11T02:30:39Z2026-11-11T02:30:40Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract f90753aa8e42…
usecase_validate 2026-11-11T02:31:28Z2026-11-11T02:31:29Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests 05517dad6f1f…
passed_tests 7ee4a3cc5bcf…
test_results 09def00ab506…
usecase_contract e637e3ae6fd4…
finalize_docs 2026-11-11T02:46:11Z2026-11-11T02:46:11Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json befd8968d996…
release_notes 0359874705cb…
api_integration_guide ea1428495776…
package_archive invalidated 2026-11-11T05:04:44Z 2026-11-11T02:54:49Z2026-11-11T04:38:07Z3
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 03b7645a98af…
checksums e6764562607e…
verify_md 97ef3e3187ee…
rebuild_md 76a42730f76d…
manifest_txt b8ae968ba4ad…
actions_jsonl 1cf351ca68ed…
provenance_md 14e5cc806eb1…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 1d2df3c0e0cb…

[stage_runs]

Rewinds

  • 2026-11-11T04:26:40Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #31150]
  • 2026-11-11T05:04:44Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #31218]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-11T04:38:07Z.

225 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 011558 L-A183, L-A15
remediate2001 011502 L-A183, L-A15
admin_handbook673203 9542826 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook713003 5530499 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate3001 07358 L-A59
finalize_docs803203 7639092 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $5.45 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-11T03:43:49Z 01429 findings to repackage [held_rounds, held_rounds #1731] $3.15 3 rounds, $40.00 80989ce5f331…
22026-11-11T04:38:36Z 0010 clean to publish [held_rounds, held_rounds #1733] $2.30 3 rounds, $40.00 03b7645a98af…

Defects

Fully recorded
  • Ledger entries54 [defects, defects where product_slug=grafana and this tag or chain]
  • Disclosed in the archive54 [docs/defects/defects.json, entries]

54 ledger entries: by severity low 40, high 14; by status open 3, fixed-before-release 51.

DefectSeverityStatusFound byFixed in
RSD-grafana-cdb06d1eb1
When the first start generated the admin password, the entrypoint puts it in Grafana's process environment on every start [defects, defects #242080]		lowopenruntime check—
RSD-grafana-e597e08f80
Admin handbook: Live: curl /api/health on the held digest -> {"database":"ok","version":"13.3.1"}; the Operating facts of the same handbook say 13.3.1 (:255). [defects, defects #244779]		highfixed-before-releaseheld review (review model)—
RSD-grafana-9131caf595
Admin handbook: The code block after this sentence is `docker exec grafana grafana cli --homepath /usr/share/grafana admin reset-admin-password 'NEW_PASSWORD'`. [defects, defects #244780]		highfixed-before-releaseheld review (review model)—
RSD-grafana-df949fe38e
Admin handbook: Live: GET /api/org, /api/search, /api/user, /api/frontend/settings, /api/orgs without credentials -> 401; /metrics -> 200. [defects, defects #244781]		highfixed-before-releaseheld review (review model)—
RSD-grafana-9dbfb8e9af
Admin handbook: VERIFY_OFFLINE.sh:65-66 loads rebuilt.docker.tar and keeps only the sha256 image ID; nothing is tagged and BUILD_OFFLINE.sh prints no run name. [defects, defects #244782]		highfixed-before-releaseheld review (review model)—
RSD-grafana-4b67723fbf
Admin handbook: Live: an Admin-role service-account Bearer token POSTed /api/serviceaccounts and the account was created; API_INTEGRATION_GUIDE.md says Admin-role tokens can call these endpoints (Complete API… [defects, defects #244783]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-320d7fa201
Admin handbook: Live: docker run -v <host-owned dir>:/var/lib/grafana with no password -> 'readystack-entrypoint.sh: 21: cannot create /var/lib/grafana/initial_admin_password: Permission denied', exit 2; with -e… [defects, defects #244784]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-80a00cb98f
Database handbook: Live: after 6 wrong logins the right password -> 401 'Invalid username or password'; after `grafana cli ... [defects, defects #244785]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-84b0a9764b
Database handbook: Live: GET /metrics -> Content-Type: text/plain; version=0.0.4; only with Accept: application/openmetrics-text -> application/openmetrics-text. [defects, defects #244786]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-19e707a567
Database handbook: `docker restart` does not re-read --env-file (a container's environment is fixed when it is created); the same handbook's First-start cleanup says remove and recreate. [defects, defects #244787]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-129211439b
Database handbook: Live: docker exec <c> cat /proc/1/environ | tr '\0' '\n' shows GF_SECURITY_ADMIN_PASSWORD for a generated password (readystack-entrypoint.sh exports it); the Operating facts say so and the carried… [defects, defects #244788]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-7040f805d3
Database handbook: VERIFY_OFFLINE.sh:65-66 keeps the sha256 image ID only and never runs `docker tag`; the block after this sentence runs `readystack/grafana:v13.3.1-CE-ubuntu24.04-r1`, which is the published image,… [defects, defects #244789]		highfixed-before-releaseheld review (review model)—
RSD-grafana-86f472dcc3
Database handbook: BUILD_OFFLINE.sh:122-123 prints REBUILT_DIGEST=<image-manifest digest> (sha256:55218b18..., = TARGET_DIGEST.txt). [defects, defects #244790]		highfixed-before-releaseheld review (review model)—
RSD-grafana-2973a1b278
Database handbook: Live: a Viewer-role service-account Bearer token -> GET /api/user, /api/org, /api/datasources, /api/search all 200. [defects, defects #244791]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-df53554c9a
Database handbook: The same handbook (Web Frontend, first part) says 'The login form posts JSON to the `/login` endpoint' and its endpoint table lists `POST /login` 'Authenticate with JSON body'. [defects, defects #244792]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-82c9288c68
Database handbook: Live: curl -u sa-1-adm:<token> /api/org -> 401; the same handbook says service-account tokens go in a Bearer header. [defects, defects #244793]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-2e57d397a1
Database handbook: BUILD_OFFLINE.sh:81,90,98 build with `--network=none`; the sentence says the opposite of the section's last paragraph. [defects, defects #244794]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-587e3f8d19
Database handbook: docs/REBUILD.md:7 records only the 23.5 GB reproduction host and that less memory may fail; no record gives an 8 GB memory requirement (the admin handbook uses 8 GB for disk space). [defects, defects #244795]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-162ec41e44
API guide: Live: a file made by the host user with mode 600, mounted :ro at /run/secrets/admin_password with GF_SECURITY_ADMIN_PASSWORD__FILE set -> the container exits at start: 'grafana:… [defects, defects #244796]		highfixed-before-releaseheld review (review model)—
RSD-grafana-a612ebc94b
API guide: Live: with GF_SECURITY_ADMIN_PASSWORD__FILE set, docker exec <c> cat /proc/1/environ contains GF_SECURITY_ADMIN_PASSWORD (readystack-entrypoint.sh:12-13 exports it before exec). [defects, defects #244797]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-040edf1fcb
API guide: Live: /proc/1/environ of a container started with GF_SECURITY_ADMIN_PASSWORD__FILE contains GF_SECURITY_ADMIN_PASSWORD. [defects, defects #244798]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-8acabd4985
API guide: Live: Admin-role service-account Bearer token -> GET /api/admin/stats 403, GET /api/orgs 403, GET /api/users/lookup 403, PUT /api/admin/users/2/password 403 ('Permissions needed:… [defects, defects #244799]		highfixed-before-releaseheld review (review model)—
RSD-grafana-7acfd3b101
API guide: Live: Admin-role token -> /api/admin/stats 403, /api/orgs 403, /api/users/lookup 403, PUT /api/admin/users/2/password 403, PUT /api/user/password 304. [defects, defects #244800]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-b7eacce897
API guide: Live: Admin-role token PUT /api/admin/users/2/password -> 403 'Permissions needed: users.password:write'. [defects, defects #244801]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-076b88cfbb
API guide: Live: Admin-role service-account token -> PUT /api/admin/users/2/password -> 403 {"message":"You'll need additional permissions to perform this action. [defects, defects #244802]		highfixed-before-releaseheld review (review model)—
RSD-grafana-29e4255bf9
API guide: Live: Admin-role service-account token -> 403 on PUT /api/admin/users/<id>/password. [defects, defects #244803]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-cf391141a3
API guide: Live: POST /api/user/password/send-reset-email with {"email":"(address withheld)"} and {"email":"admin@localhost"} -> 400 {"message":"bad request data"}; with {"userOrEmail":"admin"} -> 500 'Failed to… [defects, defects #244804]		highfixed-before-releaseheld review (review model)—
RSD-grafana-760eec4bbe
API guide: Live: unknown user -> 200 {"message":"Email sent"}; existing user without SMTP -> 500 {"message":"Failed to send email"}. [defects, defects #244805]		highfixed-before-releaseheld review (review model)—
RSD-grafana-2cf2fa58b3
API guide: Live: 200 vs 500 as above; the next sentence of the same paragraph states the two codes. [defects, defects #244806]		highfixed-before-releaseheld review (review model)—
RSD-grafana-130bb170ca
API guide: Live: PUT /api/user/password with {"password":"zzzzzz"} -> 400 {"messageId":"user.password-missmatch","message":"Invalid old password"} and no change; the working body is the one in the Operating… [defects, defects #244807]		highfixed-before-releaseheld review (review model)—
RSD-grafana-76d03b01cd
API guide: `docker restart` does not re-read --env-file, so the new GF_METRICS_BASIC_AUTH_* values never reach the container and /metrics stays open to anyone while the customer believes it is protected. [defects, defects #244808]		highfixed-before-releaseheld review (review model)—
RSD-grafana-2aec7dc262
API guide: Live: POST /api/user/password/send-reset-email without credentials -> 200/500, not 401. [defects, defects #244809]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-37d32adb9c
API guide: The list that follows includes /metrics (internal state, readable by anyone) and the send-reset-email endpoint, which reveals whether an account exists (200 vs 500); the same section tells the… [defects, defects #244810]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-9d83b8bec0
API guide: Live: curl /api/orgs without credentials -> 401; the same section says 'Unauthenticated requests receive a 401 response'. [defects, defects #244811]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-2dcce94c0e
API guide: It sits under 'Besides `/metrics`, the following endpoints and resources are accessible without credentials', yet the line itself says it needs administrator credentials; live: unauthenticated… [defects, defects #244812]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-da89235442
API guide: The same page lists POST /api/user/password/send-reset-email as answering without credentials; live: it answers 200/500 with no credentials. [defects, defects #244813]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-5144b534f6
API guide: Live: 6 wrong logins for admin, then a separate curl (new connection, no cookie) with the right password -> 401 'Invalid username or password'. [defects, defects #244814]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-e9c80d0c04
API guide: Contradicts the same guide's previous section ('plugins are downloaded into /var/lib/grafana/plugins regardless of which database backend is configured') and DB_HANDBOOK 'External Database… [defects, defects #244815]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-3dd4c04d1a
API guide: Live: GET /metrics -> Content-Type: text/plain; version=0.0.4; with Accept: application/openmetrics-text -> application/openmetrics-text. [defects, defects #244816]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-7e15f2383c
API guide: Live: Admin-role service-account Bearer token PUT /api/user/password -> 304; the same guide says 304 under Permissions and Limitations. [defects, defects #244817]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-6637ee6704
API guide: Live: host-owned bind mount without a password -> 'cannot create /var/lib/grafana/initial_admin_password: Permission denied' (exit 2); with GF_SECURITY_ADMIN_PASSWORD -> the SQLite message (exit 1). [defects, defects #244818]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-4701cc919d
Release notes: Live: GET /api/dashboards/home with admin credentials on a fresh volume -> 404 {"message":"No custom home dashboard configured"}; the API guide documents 404 as the default. [defects, defects #244819]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-2415462bfa
VERIFY.md: IMAGE_EVIDENCE.json attestations.predicate_types lists only https://slsa.dev/provenance/v1 and https://spdx.dev/Document; PROMOTION_RECORD.json records signing of the index and the manifest and… [defects, defects #244820]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-3ca0d7030f
Docker Hub README: bundle/MANIFEST.json: "free_release": false, "chain_price_cents": 1000, files.buildkit.price_cents 1000; the README says 'free' here and 'free with an account' in its links block. [defects, defects #244821]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-ff05676036
Admin handbook: VERIFY_OFFLINE.sh:21-33 reads the digest from rebuilt.oci.tar's index.json and compares it (line 37-49) before docker load (line 65); the loaded image's ID is sha256:b08ee2124bd7... [defects, defects #245659]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-61fc6644f0
Admin handbook: BUILD_OFFLINE.sh:68-70 says '--network=none only isolates RUN steps, so without these remaps BuildKit would still resolve each base from a registry'; the next paragraph (:1196) and the continued… [defects, defects #245660]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-ba232fde6a
Admin handbook: Live: docker exec on the held digest after first start: /var/lib/grafana/plugins holds 19 plugin directories (cloudwatch, elasticsearch, loki, prometheus, ...); the handbook itself says so at… [defects, defects #245661]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-d2f0e28a22
Admin handbook: Live: the block as written (no -i/-t) returns immediately with exit 0 and no output (docker run --rm --entrypoint /bin/sh -v <vol>:/var/lib/grafana <held digest> -> rc=0, nothing printed); /bin/sh… [defects, defects #245662]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-83afa2f693
Database handbook: Dockerfile.offline.pinned: 'COPY --from=build_grafana /src/conf /rootfs/usr/share/grafana/conf' (conf/ is Grafana's own configuration directory) and 'ADD vendored/chisel/rootfs.tar';… [defects, defects #245663]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-1faf4db430
API guide: Live on the held digest: curl http://127.0.0.1:<port>/api/admin/stats without credentials -> 401 (also /api/orgs, /api/users/lookup -> 401); Admin-role service-account Bearer token -> 403. [defects, defects #245664]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-1e829b3ea4
API guide: The list that follows includes GET /api/org, /api/datasources, /api/search, /api/user, /api/frontend/settings and POST/DELETE /api/serviceaccounts*. [defects, defects #245665]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-7c518dc3c8
API guide: Live: unauthenticated GET / -> 302 to /login (200 at /login); the same section lists 'GET /' as Unauthenticated at :2369 and under 'Endpoints that do not require credentials' elsewhere. [defects, defects #245666]		lowfixed-before-releaseheld review (review model)—
RSD-grafana-a4027ef89d
VERIFY.md: Still open from round 1 (RSD-grafana-2415462bfa; the Known issues line is disclosure, the sentence is unchanged). [defects, defects #245667]		lowopenheld review (review model)—
RSD-grafana-1fcac354f6
Docker Hub README: Still open from round 1 (RSD-grafana-3ca0d7030f). [defects, defects #245668]		lowopenheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:55218b18c26c5bf5fe9f17298e0ea2641e8ed47188bd7edd04dc022752f7c299 · published digest sha256:55218b18c26c5bf5fe9f17298e0ea2641e8ed47188bd7edd04dc022752f7c299 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 511) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-11T05:05:59Z · failing Docker Scout counts 12 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-11T05:05:31Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3802868845 · transparency-log entry · integrated 2026-11-11T05:14:57Z) [ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:f89ea6751c027a179372d71455e8e61683d93c48f60dcee8da9e33657a8d238d · state attached · log index 3802878295 · transparency-log entry
    • kind sbom · digest sha256:f89ea6751c027a179372d71455e8e61683d93c48f60dcee8da9e33657a8d238d · state attached · log index 3802880519 · transparency-log entry
    • kind vsa · digest sha256:f89ea6751c027a179372d71455e8e61683d93c48f60dcee8da9e33657a8d238d · state attached · log index 3802883244 · transparency-log entry
    • kind provenance · digest sha256:55218b18c26c5bf5fe9f17298e0ea2641e8ed47188bd7edd04dc022752f7c299 · state attached · log index 3802885618 · transparency-log entry
    • kind sbom · digest sha256:55218b18c26c5bf5fe9f17298e0ea2641e8ed47188bd7edd04dc022752f7c299 · state attached · log index 3802887815 · transparency-log entry
    • kind vsa · digest sha256:55218b18c26c5bf5fe9f17298e0ea2641e8ed47188bd7edd04dc022752f7c299 · state attached · log index 3802890287 · transparency-log entry
    (at 2026-11-11T05:14:58Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/grafana/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-11T03:43:56Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:55218b18c26c5bf5fe9f17298e0ea2641e8ed47188bd7edd04dc022752f7c299 [clean-room rebuild ledger, runs[741]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-11T02:04:01Z [stage_runs, stage_runs chain 960 stage publish_image]
  • Archive manifests written2026-11-11T05:10:30Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 69 · probed 2026-11-11T01:52:43Z · source build_kit) [release_images, isa_level_hard]

History

3 events
  • 2026-11-11T05:16:39Z generated: by KitForge release/build_trail.py · generator commit c1f462e723936ba7c87d1207ab85ed8f71bbd4d9
  • 2026-11-11T05:18:41Z publication: promoted at 2026-11-11T05:17:14Z · promoted digest sha256:f89ea6751c027a179372d71455e8e61683d93c48f60dcee8da9e33657a8d238d · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 464 · checklist status complete · checklist at 2026-11-11T05:18:41Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
  • 2026-11-12T00:48:42Z repack: previous sha256 1247cef53a13bba14f288f4bf08b79e116f4461e6d37b0babe9f85f2fd4d4220 · sha256 17ca288704be29ad1547ada426158108d764725421c7b72e160c1e7b8439f3aa · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); README.md and FILE_MODES.tsv at the archive root (release/kit_unpack.py), BUILD_OFFLINE.sh putting back the packed file modes, REBUILD.md unpacking with -p and keeping the key and signature outside the kit, and the verifier naming what differs; not image inputs; image and every build input unchanged · label kitfix · replaced BUILD_OFFLINE.sh, docs/REBUILD.md, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, docs/rebuild-bundle/rebuild_bundle.py · added FILE_MODES.tsv, README.md · record MANIFEST.json repack_history

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/grafana/v13.3.1-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/grafana/v13.3.1-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/grafana/v13.3.1-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-grafana-v13.3.1-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/grafana/v13.3.1-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/grafana/v13.3.1-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)640
chainssadb, ReadyStack's engine database (not published)960
defectssadb, ReadyStack's engine database (not published)grafana v13.3.1-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 960
held_roundssadb, ReadyStack's engine database (not published)chain 960
lesson_recallssadb, ReadyStack's engine database (not published)chain 960
micro_step_runssadb, ReadyStack's engine database (not published)chain 960
release_imagessadb, ReadyStack's engine database (not published)grafana v13.3.1-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 960
stage_runssadb, ReadyStack's engine database (not published)chain 960
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—