HAProxy 3.4.6-CE-ubuntu24.04-r6 build trail

How ReadyStack built readystack/haproxy:3.4.6-CE-ubuntu24.04-r6 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/haproxy:3.4.6-CE-ubuntu24.04-r6
  • Index digestsha256:9ad87660f930651f88076769052b98cb8e0cfa5daff4755a5c5af83f3421896d
  • linux/amd64 digestsha256:f9d24c2b3613130e6a9a342adcf5a8d1e9b7b9a151a525f7061418bbee6746a8
  • ArchiveReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.tar.gz
  • Archive SHA-256 now9518d7a4827d8a650a439b276b9bcfd7206ca62e4d314c84251bd1ad6b122e5f
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T16:49:44Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.trail.json.sigstore ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.trail.json
ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.trail.jsonReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.trail.json.sigstoreReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.trail.mdHAProxy product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductHAProxy (haproxy) [MANIFEST.json]
  • Release tag3.4.6-CE-ubuntu24.04-r6 [MANIFEST.json]
  • Imagereadystack/haproxy:3.4.6-CE-ubuntu24.04-r6 [MANIFEST.json]
  • Image index digestsha256:9ad87660f930651f88076769052b98cb8e0cfa5daff4755a5c5af83f3421896d [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:f9d24c2b3613130e6a9a342adcf5a8d1e9b7b9a151a525f7061418bbee6746a8 [ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.tar.gz (bytes 552142511) [MANIFEST.json]
  • Archive sha256 at publish9518d7a4827d8a650a439b276b9bcfd7206ca62e4d314c84251bd1ad6b122e5f [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://git.haproxy.org/git/haproxy-3.4.git [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv3.4.6 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit56332c50b5291cfbbfd440d958adc988fbf87e2f [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash98cbc2f2c71839bc24fb4454799e109179f1a5360386051ccc40b4b2b88c6216 (files 1497) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:5e46e12cb3cc88e704574d524d9ee42befc641d51b511d163d1be887a1b3f50a [ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1790604274 (utc 2026-09-28T14:04:34Z) [ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.rebuild.json, engine]
  • Engine commit(s)
    • commit 9e1e08daa6fd77ad7901229048721017ec2e4d84 · dirty yes · first drive 3988
    • commit 8a45c451adfbe69e8aea57cade68ffc8092d055e · dirty yes · first drive 4027
    • commit 33f90e4df8880eb3af828fc61ea626b22c124785 · dirty yes · first drive 4049
    • commit d28155d8ca5cbee1adc82a2bd6715600f48c577b · dirty yes · first drive 4062
    • commit 5163af4d4c1993a6202ab252a3207b9300f6e3e6 · dirty yes · first drive 4073
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain920 (created 2026-11-09T09:05:51Z · trigger customer_request · upstream version 3.4.6) [chains, chains #920]
  • Requestbuild request #544 (rebuild) (requested at 2026-11-08T03:42:06Z · requested by kitforge-agent · version 3.4.6) [build_requests, build_requests #544]
  • Reasonrevision 3.4.6-CE-ubuntu24.04-r6: same upstream version rebuilt on the chiselled runtime (slim base, C/Rust engine #198) [build_requests, build_requests #544 request_reason]
  • Supersedesreadystack/haproxy:3.4.6-CE-ubuntu24.04-r5 (chain 837) [chains, chains #837]

The path through the harness

Fully recorded

1 chain · 5 drives · 18 stages · 3 rewinds

Chain 920 release · ready_to_ship

Created 2026-11-09T09:05:51Z, upstream 3.4.6, build request 544 [chains, chains #920]

DriveStartedMinutesBuild hostHow it stopped
39882026-11-09T09:06:08Z58.1build host 4 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3988]
40272026-11-09T13:43:49Z4.8build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4027]
40492026-11-09T15:06:05Z2.8build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4049]
40622026-11-09T16:02:36Z3.1build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4062]
40732026-11-09T16:45:41Z—build host 4 publish-held not recorded [drive_runs, drive_runs #4073]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-09T09:06:19Z2026-11-09T09:06:20Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json ddf33631cf74…
acquire 2026-11-09T09:06:26Z2026-11-09T09:06:27Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree b4a286ecdaf7…
license_file 0717ca51fcea…
custody_inputs 87d0bde29ce1…
source_tree_hash f69a45fc517b…
source_file_manifest f479416e5866…
plan 2026-11-09T09:06:54Z2026-11-09T09:06:55Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report d0bc9fb1e1a5…
input_pin_plan 830b5225dcd0…
toolchain_lock 96a350cab608…
assemble_kit 2026-11-09T09:09:52Z2026-11-09T09:09:52Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 155797ddb83e…
build_recipe 9cc8651b5af3…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 3ab420308c6a…
verify_offline_sh 3e8184ea230c…
base_image_digests 6d9a4296ecce…
dockerfile_offline 155797ddb83e…
first_build_digest c4c9950580db…
remediate 2026-11-09T09:10:14Z2026-11-09T09:10:15Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 8c1398d982b1…
security_report c7dbcb7b8287…
build_kit 2026-11-09T09:15:26Z2026-11-09T09:15:27Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 8cad965cc13a…
locked_digest fad8d4790137…
freeze_manifest a9b15050ffaa…
offline_rebuild_transcript dfd4599b623f…
verdict 2026-11-09T09:15:57Z2026-11-09T09:15:58Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 1643de8b7763…
publish_image 2026-11-09T09:16:31Z2026-11-09T09:16:31Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme e380873cc0d7…
promotion_record 89a17dd75e9b…
boot_instance 2026-11-09T09:16:38Z2026-11-09T09:16:43Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 2c00bb1254df…
sbom 2026-11-09T09:16:55Z2026-11-09T09:16:55Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 42ea65687bc2…
sbom_json 0726ae9cf9be…
schema_discovery 2026-11-09T09:16:58Z2026-11-09T09:16:59Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 58468b6f0d93…
dependency_tree ef6cf887e729…
table_classification c7f5b426756d…
admin_handbook 2026-11-09T09:34:12Z2026-11-09T09:34:13Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map dd3f90b0f440…
admin_handbook 7b4716bc54f2…
db_handbook 2026-11-09T09:48:01Z2026-11-09T09:48:02Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 1d3ce46445b8…
seed_isolation 8882e41ac75c…
seed_data 2026-11-09T09:48:08Z2026-11-09T09:48:09Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql a4ce08d6cb58…
seed_cases_json 6c831cb89f42…
seed_validate 2026-11-09T09:48:11Z2026-11-09T09:48:12Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract f6ce5d223d95…
usecase_validate 2026-11-09T09:48:33Z2026-11-09T09:48:34Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests 8746dfb4a17a…
passed_tests 1426068d468d…
test_results c77f27cbba67…
usecase_contract 274c7e6c4ff4…
finalize_docs 2026-11-09T09:48:40Z2026-11-09T09:48:41Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 2adcf82a554a…
release_notes cefeaa382893…
api_integration_guide b7a90d62e68f…
package_archive invalidated 2026-11-09T16:45:18Z 2026-11-09T10:04:15Z2026-11-09T16:05:41Z4
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 36a916879255…
checksums 1a2b7be96c11…
verify_md b4e8b62ade4a…
rebuild_md 22b6658e86af…
manifest_txt b9f247f651fd…
actions_jsonl 8128815e38f9…
provenance_md 00a7fbd969dd…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 185a90958d76…

[stage_runs]

Rewinds

  • 2026-11-09T14:17:19Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29095]
  • 2026-11-09T15:44:17Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29319]
  • 2026-11-09T16:45:18Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29413]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T16:05:41Z.

208 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 06775 L-A183, L-A15
remediate2001 06625 L-A183, L-A15
admin_handbook1115303 21974514 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook924203 16739198 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate1001 01778 L-A59

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $5.30 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T13:49:12Z 0928 findings to repackage [held_rounds, held_rounds #1625] $2.09 3 rounds, $40.00 a5a1eb6ddbe6…
22026-11-09T15:09:32Z 047 findings to repackage [held_rounds, held_rounds #1642] $1.67 3 rounds, $40.00 2142048a4968…
32026-11-09T16:06:18Z 009 clean to publish [held_rounds, held_rounds #1648] $1.54 3 rounds, $40.00 36a916879255…

Defects

Fully recorded
  • Ledger entries59 [defects, defects where product_slug=haproxy and this tag or chain]
  • Disclosed in the archive59 [docs/defects/defects.json, entries]

59 ledger entries: by severity low 46, high 13; by status wont-fix-by-design 1, open 1, fixed-before-release 57.

DefectSeverityStatusFound byFixed in
RSD-haproxy-64a23158e4
Unused third-party device-detection add-ons are removed from the source before the build: addons/51degrees, addons/deviceatlas, addons/wurfl [defects, defects #203569]		lowwont-fix-by-designbuild strategy record—
RSD-haproxy-4e07e2e3b6
Release notes: The image's placeholder answer (a build input, unchanged from the previous release) recommends the single-file mount that the handbooks and the kit's own cfg header say never sees edits; the… [defects, defects #209429]		lowopenheld review (review model)—
RSD-haproxy-31f9f431da
Database handbook: Procedure fails: the section tells the customer to run `docker run ... [defects, defects #210645]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-d0af7627af
Database handbook: Same procedure: the command needs a prior `docker rm -f haproxy` (the name is in use by the container started earlier) and publishing 8404 never exposes the loopback-bound stats frontend. [defects, defects #210646]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-9ddef9cb4d
Database handbook: Lists GET/HEAD /stats and /metrics as endpoints of 'the listener that binds port 8080' and says they serve statistics and metrics; on 8080 they return the placeholder text (contradicts… [defects, defects #210647]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-c9591c3dd2
Database handbook: The example 'to validate a configuration file' is malformed: `-v` before the image name is docker's volume flag and swallows the image reference as a volume spec, so docker run fails; and after the… [defects, defects #210648]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-0b6ea6e6a3
Database handbook: The ACME configuration example (lines ~1233-1241) does not parse: the section header needs an ID and `server`, `account-key-file` and `email` are not acme keywords in 3.4.6. [defects, defects #210649]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-9bd726a05f
API guide: The guide gives Base URL http://<host>:8080 and then lists /stats and /metrics as routes with no port; a customer calling http://<host>:8080/stats or /metrics gets the placeholder message, not… [defects, defects #210650]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-3ee2a6969e
API guide: Same as the /stats row: /metrics is not served on the documented base URL. [defects, defects #210651]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-8b7de34bed
Admin handbook: First description of the shipped configuration is false and contradicts the next paragraph's 'reachable only from inside the container'. [defects, defects #210652]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-c759891bc7
Admin handbook: Advises mode 600 for private keys without saying the file must be owned by uid 99; a 600 key owned by the customer's host user (bind mounts keep host ownership) is unreadable by uid 99 and HAProxy… [defects, defects #210653]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-b3a2a03064
Admin handbook: Port 8080 serves no statistics. [defects, defects #210654]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-5a77ddba68
Admin handbook: Port 8080 serves no statistics page. [defects, defects #210655]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-ab47e255d9
Admin handbook: /healthz is a monitor-uri: it returns the HTML 200 page, not the plain-text placeholder; contradicts ADMIN_HANDBOOK.md:1065 and the Operating facts. [defects, defects #210656]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-b850420c10
Admin handbook: Self-contradicting list (next bullets say /healthz answers 'Service ready.'); /healthz is HTML. [defects, defects #210657]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-192c290f34
Admin handbook: Exit status on an invalid configuration is 1, not 2 (scripts testing for 2 would miss failures; DB_HANDBOOK.md:245 says 1). [defects, defects #210658]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-7898b1bcc9
Admin handbook: The example server line does not parse: a URL is not a server address. [defects, defects #210659]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-a023e705f5
Admin handbook: Misstates the image config and contradicts the Operating facts and the same section ('replacing only the -f part'). [defects, defects #210660]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-35ed848bcd
Admin handbook: The haproxy account has a shell. [defects, defects #210661]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-195b20735c
Database handbook: The account has a shell (/bin/sh) and a home entry (/var/lib/haproxy). [defects, defects #210662]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-d96e339ce0
Admin handbook: Contradiction in the same paragraph: `-p` is ignored with --network host, so '-p 80:8080' publishes nothing there. [defects, defects #210663]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-ad6afcf1c0
Database handbook: Self-contradicting: privileged ports cannot be bound with the host value 1024 and -p does nothing in host mode. [defects, defects #210664]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-cd39eb4a26
Admin handbook: 'a different group (such as gid 99)' contradicts the previous clause (gid 99 is the haproxy group). [defects, defects #210665]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-237de41090
Admin handbook: No record supports 'Docker Engine 20.10'; the kit states buildx >= 0.30 only. [defects, defects #210666]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-6645c4dfb4
Admin handbook: VERIFY_OFFLINE.sh does not read REBUILT_DIGEST.txt. [defects, defects #210667]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-07a6b811c0
Admin handbook: `docker inspect` cannot set a health check. [defects, defects #210668]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-a9e16bfe4a
Admin handbook: httplog logs per request, not per connection (contradicts ADMIN_HANDBOOK.md:249). [defects, defects #210669]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-54e0055747
Database handbook: The command shown has -V, which prints 'Configuration file is valid'; contradicts the other check sections. [defects, defects #210670]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-e2b5f095f1
Database handbook: The trailing `-p 8443:8443` is passed to haproxy (where -p is the pid-file option) as a pid file name; it is not a port publication and has no place in a check command. [defects, defects #210671]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-e3fc78d67f
Database handbook: Contradicts the previous sentence of the same paragraph and the Operating facts: -code passes on any HTTP status. [defects, defects #210672]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-45b0112c68
Database handbook: Upstream: by default a failing worker makes the master leave; it does not restart the worker. [defects, defects #210673]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-f44b5afebb
Database handbook: These messages go to stderr only; DB_HANDBOOK.md:1285 and the Operating facts say stderr, and a stdout-only collector misses them. [defects, defects #210674]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-51eca40aed
Database handbook: Same: stdout is empty for those messages. [defects, defects #210675]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-280e5273c4
Database handbook: The strategy and recipe remove the three directories from the acquired and the vendored tree; the archive's source has only addons/ot and addons/promex. [defects, defects #210676]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-ff288252e5
Database handbook: Wrong for the directory mount shown in this section; it tells the customer to re-create the container needlessly and contradicts the Config reload section. [defects, defects #210677]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-6d61f1a2a0
Database handbook: Same wrong claim for directory mounts. [defects, defects #210678]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-f48033fdc7
Database handbook: -body exits 1 on 4xx/5xx (the section's own commands), contradicting 'status 0 on any HTTP response'. [defects, defects #210679]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-5960e0aedf
Database handbook: Says the statistics page and /metrics are reachable on 8080; the next sentences say 127.0.0.1:8404 only. [defects, defects #210680]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-62f63b843c
VERIFY.md: No record of this run shows the VSA: IMAGE_EVIDENCE.json attestations.predicate_types lists only slsa.dev/provenance/v1 and spdx.dev/Document and PROMOTION_RECORD has promotion_deferred=true… [defects, defects #210681]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-671bdd5850
Admin handbook: Port-mapping direction reversed: says the first -p number is the port inside the container, contradicting the example it explains. [defects, defects #216094]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-b73d54d552
Database handbook: Tells the customer that being able to read the file as their own host user is enough; HAProxy runs as uid 99, so a file readable only by the host user (the usual mode-600 file they created) makes… [defects, defects #216095]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-3532f3d0b4
Database handbook: Key-file permission advice still leaves out that a mode-600 key must be owned by uid 99; the parenthetical is impossible as written. [defects, defects #216096]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-3a1b9337f5
Database handbook: The ACME start command fails as written for any directory the customer creates; the text never says the directory must be owned by uid 99. [defects, defects #216097]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-46d2580f33
Database handbook: Contradiction in the same section: /healthz is an HTML page, not the plain-text placeholder (round-1 finding persists in this paraphrase). [defects, defects #216098]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-58a9146adc
Database handbook: False statement that the check rejects root-only directives; a customer who relies on it ships a configuration that passes the check and crashes at start. [defects, defects #216099]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-c99c1260f7
Admin handbook: Overstates: a pid file in a writable directory works as uid 99. [defects, defects #216100]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-52caf4f3b8
Admin handbook: Self-contradiction: says mode 640 fails and then lists group-readable as a working option. [defects, defects #216101]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-a593644598
Admin handbook: Wrong rule for group access: it depends on the file's group, not on its owner being in the haproxy group. [defects, defects #216102]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-8106e28fcd
Database handbook: Dangling cross-reference to a section that does not exist. [defects, defects #216103]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-4ed492f986
VERIFY.md: Names a SLSA Verification Summary Attestation that no record of this run shows (L-A39); the third cosign command is unverified. [defects, defects #216104]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-0ebfec1354
Database handbook: Contradicts the preceding paragraph of the same section: the validation does not report directives that cannot run as non-root. [defects, defects #218428]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-f1155c66ce
Database handbook: The copy-paste command fails for a customer who is not root; the text gives no way to run it. [defects, defects #218429]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-d243e2d57c
Admin handbook: Dangling cross-reference to a document that does not exist. [defects, defects #218430]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-159e6f5330
Database handbook: Contradicts the Operating facts and Health checks sections: the check does not require HTTP 200. [defects, defects #218431]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-2afe66340d
Admin handbook: As written the command opens no usable shell; the other sections use `docker exec -i <container> sh` for scripts. [defects, defects #218432]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-85c5b968c2
Admin handbook: The command shown mounts nothing, so a customer who runs it as written learns nothing about their mounted configuration. [defects, defects #218433]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-f66fb368a1
Database handbook: Self-contradiction within the paragraph about editing the mounted file. [defects, defects #218434]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-f9f91d6947
Database handbook: Overstates: only a mount keeps the file; a directory mount is needed for edits that replace the file, not for survival. [defects, defects #218435]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-b3d91572a8
Database handbook: Garbled sentence implying stick tables can be configured to live on disk; contradicts the rest of the section. [defects, defects #218436]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:f9d24c2b3613130e6a9a342adcf5a8d1e9b7b9a151a525f7061418bbee6746a8 · published digest sha256:f9d24c2b3613130e6a9a342adcf5a8d1e9b7b9a151a525f7061418bbee6746a8 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 154) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T16:46:01Z · failing Docker Scout counts 10 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T16:45:51Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3767148966 · transparency-log entry · integrated 2026-11-09T16:48:38Z) [ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:9ad87660f930651f88076769052b98cb8e0cfa5daff4755a5c5af83f3421896d · state attached · log index 3767149125 · transparency-log entry
    • kind sbom · digest sha256:9ad87660f930651f88076769052b98cb8e0cfa5daff4755a5c5af83f3421896d · state attached · log index 3767149273 · transparency-log entry
    • kind vsa · digest sha256:9ad87660f930651f88076769052b98cb8e0cfa5daff4755a5c5af83f3421896d · state attached · log index 3767149418 · transparency-log entry
    • kind provenance · digest sha256:f9d24c2b3613130e6a9a342adcf5a8d1e9b7b9a151a525f7061418bbee6746a8 · state attached · log index 3767149599 · transparency-log entry
    • kind sbom · digest sha256:f9d24c2b3613130e6a9a342adcf5a8d1e9b7b9a151a525f7061418bbee6746a8 · state attached · log index 3767149906 · transparency-log entry
    • kind vsa · digest sha256:f9d24c2b3613130e6a9a342adcf5a8d1e9b7b9a151a525f7061418bbee6746a8 · state attached · log index 3767150259 · transparency-log entry
    (at 2026-11-09T16:48:39Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/haproxy/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T13:49:16Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:f9d24c2b3613130e6a9a342adcf5a8d1e9b7b9a151a525f7061418bbee6746a8 [clean-room rebuild ledger, runs[701]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-09T09:16:31Z [stage_runs, stage_runs chain 920 stage publish_image]
  • Archive manifests written2026-11-09T16:47:28Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 68 · probed 2026-11-09T09:12:37Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T16:49:44Z generated: by KitForge release/build_trail.py · generator commit 5163af4d4c1993a6202ab252a3207b9300f6e3e6
  • 2026-11-09T16:50:56Z publication: promoted at 2026-11-09T16:50:16Z · promoted digest sha256:9ad87660f930651f88076769052b98cb8e0cfa5daff4755a5c5af83f3421896d · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 424 · checklist status complete · checklist at 2026-11-09T16:50:56Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/haproxy/3.4.6-CE-ubuntu24.04-r6/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/haproxy/3.4.6-CE-ubuntu24.04-r6/), as staged for publishing—
ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.rebuild.jsonbeside the archive (prodasset /data/production/haproxy/3.4.6-CE-ubuntu24.04-r6/), as staged for publishing—
ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r6.rebuild.json.sigstorebeside the archive (prodasset /data/production/haproxy/3.4.6-CE-ubuntu24.04-r6/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/haproxy/3.4.6-CE-ubuntu24.04-r6/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)544
chainssadb, ReadyStack's engine database (not published)920
defectssadb, ReadyStack's engine database (not published)haproxy 3.4.6-CE-ubuntu24.04-r6
drive_runssadb, ReadyStack's engine database (not published)chain 920
held_roundssadb, ReadyStack's engine database (not published)chain 920
lesson_recallssadb, ReadyStack's engine database (not published)chain 920
micro_step_runssadb, ReadyStack's engine database (not published)chain 920
release_imagessadb, ReadyStack's engine database (not published)haproxy 3.4.6-CE-ubuntu24.04-r6
stage_eventssadb, ReadyStack's engine database (not published)chain 920
stage_runssadb, ReadyStack's engine database (not published)chain 920
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—