HAProxy 3.4.6-CE-ubuntu24.04-r7 build trail

How ReadyStack built readystack/haproxy:3.4.6-CE-ubuntu24.04-r7 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/haproxy:3.4.6-CE-ubuntu24.04-r7
  • Index digestsha256:bb7c69b0b5d7ae35f2f9f35e86872c750c309d0ef5a1b6e73872bbca69be0d75
  • linux/amd64 digestsha256:d5bf35c5dfe7dc8b26d5f3d0d329eb2580fa5d3a10cac8b0e5a186bb74623f3a
  • ArchiveReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.tar.gz
  • Archive SHA-256 now6ca30c5302db1858fcee3c95b633c15d5d19096fd7f2495e11f2b8576b865093
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-12T12:24:35Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.trail.json.sigstore ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.trail.json
ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.trail.jsonReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.trail.json.sigstoreReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.trail.mdHAProxy product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductHAProxy (haproxy) [MANIFEST.json]
  • Release tag3.4.6-CE-ubuntu24.04-r7 [MANIFEST.json]
  • Imagereadystack/haproxy:3.4.6-CE-ubuntu24.04-r7 [MANIFEST.json]
  • Image index digestsha256:bb7c69b0b5d7ae35f2f9f35e86872c750c309d0ef5a1b6e73872bbca69be0d75 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:d5bf35c5dfe7dc8b26d5f3d0d329eb2580fa5d3a10cac8b0e5a186bb74623f3a [ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.tar.gz (bytes 553808301) [MANIFEST.json]
  • Archive sha256 at publish6ca30c5302db1858fcee3c95b633c15d5d19096fd7f2495e11f2b8576b865093 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://git.haproxy.org/git/haproxy-3.4.git [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv3.4.6 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit56332c50b5291cfbbfd440d958adc988fbf87e2f [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash98cbc2f2c71839bc24fb4454799e109179f1a5360386051ccc40b4b2b88c6216 (files 1497) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:a80eb8811ed36e7d472a4b2bbfc7886912ff48465690650437445156c6129492 [ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794448179 (utc 2026-11-12T01:49:39Z) [ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
    [ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.rebuild.json, engine]
  • Engine commit(s)
    • commit d6acf665ef6d5a2226ab69008894a83a57e0fc08 · dirty yes · first drive 4336
    • commit 610e38b4db1278bcf2eddc75bc160bb967a516ed · dirty yes · first drive 4375
    • commit 90a06a5887bb1d16e24cf824619264064842b72d · dirty yes · first drive 4380
    • commit 8179ce1fe45ed3d29eb2493df831304e9064c094 · dirty yes · first drive 4401
    • commit 28713a5f8609b228967998dd71acc203cdd43d34 · dirty yes · first drive 4408
    • commit 1d19e4172aaa5572a9c6ae1436e282185b7e6835 · dirty yes · first drive 4414
    • commit 27badbefbe8aac72eb90e98ea8f843a03c177b52 · dirty yes · first drive 4421
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain994 (created 2026-11-12T02:02:24Z · trigger customer_request · upstream version 3.4.6) [chains, chains #994]
  • Requestbuild request #692 (rebuild) (requested at 2026-11-12T01:49:41Z · requested by kitforge-agent · version 3.4.6) [build_requests, build_requests #692]
  • Reasonrevision 3.4.6-CE-ubuntu24.04-r7: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #692 request_reason]
  • Supersedesreadystack/haproxy:3.4.6-CE-ubuntu24.04-r6 (chain 920) [chains, chains #920]

The path through the harness

Fully recorded

1 chain · 7 drives · 18 stages · 6 rewinds

Chain 994 release · ready_to_ship

Created 2026-11-12T02:02:24Z, upstream 3.4.6, build request 692 [chains, chains #994]

DriveStartedMinutesBuild hostHow it stopped
43362026-11-12T02:02:44Z62build host 2 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #4336]
43752026-11-12T08:18:34Z5build host 2 withhold-publish ready_to_ship at package_archive; 3 ticks [drive_runs, drive_runs #4375]
43802026-11-12T09:02:18Z3.4build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4380]
44012026-11-12T10:47:19Z4.2build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4401]
44082026-11-12T11:16:08Z5build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4408]
44142026-11-12T11:50:36Z3.3build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4414]
44212026-11-12T12:20:18Z—build host 2 publish-held not recorded [drive_runs, drive_runs #4421]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-12T02:02:55Z2026-11-12T02:02:55Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json b9246ae0afb5…
acquire 2026-11-12T02:03:03Z2026-11-12T02:03:04Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree b4a286ecdaf7…
license_file 0717ca51fcea…
custody_inputs 87d0bde29ce1…
source_tree_hash f69a45fc517b…
source_file_manifest f479416e5866…
plan 2026-11-12T02:03:33Z2026-11-12T02:03:34Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 832049119734…
input_pin_plan 59a6d9c27c3b…
toolchain_lock 7f1a2ada3514…
assemble_kit 2026-11-12T02:05:52Z2026-11-12T02:05:53Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 25e268cbdd37…
build_recipe 1929bc078bb9…
system_pinning aa8db05a9a8a…
build_offline_sh 6ab4f08a6ec7…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health ee113586b71d…
verify_offline_sh 3e8184ea230c…
base_image_digests 6d9a4296ecce…
dockerfile_offline 25e268cbdd37…
first_build_digest e29fcb6ddff5…
remediate 2026-11-12T02:06:17Z2026-11-12T02:06:18Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log c0f075d08284…
security_report 645c5a409c3d…
build_kit 2026-11-12T02:09:30Z2026-11-12T02:09:31Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp c93711ec6069…
locked_digest b68c13cdc777…
freeze_manifest f3e8f4d2291b…
offline_rebuild_transcript db3b46439d2f…
verdict 2026-11-12T02:10:01Z2026-11-12T02:10:01Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 3bcf0398345a…
publish_image 2026-11-12T02:10:31Z2026-11-12T02:10:32Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 8b30e7b32e18…
promotion_record cfc82af222a8…
boot_instance 2026-11-12T02:10:37Z2026-11-12T08:18:49Z3 — instance_handle 1aa9b671b071…
sbom 2026-11-12T02:10:51Z2026-11-12T02:10:52Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md cd608fe651ad…
sbom_json 1609a0ea5106…
schema_discovery 2026-11-12T02:10:55Z2026-11-12T02:10:55Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 58468b6f0d93…
dependency_tree ef6cf887e729…
table_classification c7f5b426756d…
admin_handbook 2026-11-12T02:33:14Z2026-11-12T02:33:15Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map dd3f90b0f440…
admin_handbook bb4d536bb7cd…
db_handbook 2026-11-12T02:52:34Z2026-11-12T02:52:35Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook a411085d9374…
seed_isolation 8882e41ac75c…
seed_data 2026-11-12T02:52:41Z2026-11-12T02:52:42Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql a4ce08d6cb58…
seed_cases_json d5b64c219fd3…
seed_validate 2026-11-12T02:52:45Z2026-11-12T02:52:45Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract c249ee663ad1…
usecase_validate 2026-11-12T02:53:05Z2026-11-12T02:53:06Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests ce0192e69fda…
passed_tests e91e8b45661e…
test_results 23b8239c1653…
usecase_contract bf39e2cfcb6f…
finalize_docs 2026-11-12T02:53:12Z2026-11-12T08:18:56Z2
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 740572bd654b…
release_notes 09b31f3ed0a2…
api_integration_guide bde411a0374c…
package_archive invalidated 2026-11-12T12:19:55Z 2026-11-12T03:04:45Z2026-11-12T11:53:53Z6
37 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 unpack_files
  • G8 scout_grade_a
  • G8 script_copies
  • G8 upgrade_check
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 4795e0dd0ced…
checksums 9322697163b9…
verify_md 8c1f8c283d60…
rebuild_md 80cba7ca6fb6…
manifest_txt 25cb5bf3fc98…
actions_jsonl d40f5562905c…
provenance_md 563033d95e32…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 48d058d4a04f…

[stage_runs]

Rewinds

  • 2026-11-12T03:44:50Z: package_archive to finalize_docs on docs_redo (scripts/redo-docs.py --stage finalize_docs) [stage_events, stage_events #32672]
  • 2026-11-12T08:49:03Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33272]
  • 2026-11-12T09:37:05Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33364]
  • 2026-11-12T11:15:04Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33539]
  • 2026-11-12T11:42:38Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33629]
  • 2026-11-12T12:19:55Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33728]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-12T11:53:53Z.

213 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 06708 L-A183, L-A15
remediate2001 06582 L-A183, L-A15
admin_handbook954903 15804487 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook1135603 17940023 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate1001 01729 L-A59

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

5 rounds, 5 counted, $9.89 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-12T08:24:05Z 0127 findings to repackage [held_rounds, held_rounds #1794] $2.00 3 rounds, $40.00 5d698b51b3e5…
22026-11-12T09:06:28Z 0019 clean to repackage [held_rounds, held_rounds #1799] $2.48 3 rounds, $40.00 56fe5c7bb7cd…
32026-11-12T10:52:03Z 027 findings to repackage [held_rounds, held_rounds #1807] $2.26 3 rounds, $40.00 770fdbb492ab…
42026-11-12T11:21:37Z 005 clean to repackage [held_rounds, held_rounds #1809] $1.47 3 rounds, $40.00 fc14bb404cac…
52026-11-12T11:54:23Z 004 clean to publish [held_rounds, held_rounds #1814] $1.69 3 rounds, $40.00 4795e0dd0ced…

Defects

Fully recorded
  • Ledger entries67 [defects, defects where product_slug=haproxy and this tag or chain]
  • Disclosed in the archive67 [docs/defects/defects.json, entries]

67 ledger entries: by severity low 64, high 3; by status wont-fix-by-design 1, open 1, fixed-before-release 65.

DefectSeverityStatusFound byFixed in
RSD-haproxy-7483bbc00e
Unused third-party device-detection add-ons are removed from the source before the build: addons/51degrees, addons/deviceatlas, addons/wurfl [defects, defects #256534]		lowwont-fix-by-designbuild strategy record—
RSD-haproxy-358b4bf40c
Release notes: The image's placeholder answer (a build input, unchanged from the previous release) recommends the single-file mount that the handbooks and the kit's own cfg header say never sees edits; the… [defects, defects #260961]		lowopenheld review (review model)—
RSD-haproxy-afaa38a86a
Database handbook: The documented reload command fails: -x needs a stats socket the image does not have, there is no pid file, and the old-process handover is refused, so the configuration is not reloaded. [defects, defects #261238]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-0a87cc7e8a
Database handbook: Invented mechanism (SIGHUP on a file descriptor passed by the worker) used to introduce a second reload command; contradicts the Operating facts. [defects, defects #261239]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-f1f50ec70a
Database handbook: Contradicts the Operating facts and Health checks sections: the check does not require HTTP 200 (a paraphrase of the round-3 finding, not fixed here). [defects, defects #261240]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-eab56408cb
Database handbook: Contradicts the Operating facts and Health checks sections: a 4xx or 5xx answer does not fail the check. [defects, defects #261241]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-7758990caf
Database handbook: Contradicts the Operating facts: no override or capability is needed for ports below 1024 on the bridge network. [defects, defects #261242]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-e8938a3b06
Database handbook: Contradicts the Operating facts: binding ports below 1024 needs no special setup on the bridge network. [defects, defects #261243]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-2051d3b203
Admin handbook: Contradicts the Operating facts and the Ports sections of the same handbook. [defects, defects #261244]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-6341c76031
Database handbook: Contradicts the Processes sections: the master does not restart the worker. [defects, defects #261245]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-e284c45c8f
Database handbook: Lists /stats and /metrics as endpoints the container exposes on port 8080, contradicting the later sections: on 8080 both return the placeholder. [defects, defects #261246]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-a0e20b6c5e
Database handbook: Same as the /stats line: on 8080 /metrics returns the placeholder. [defects, defects #261247]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-7adb42027a
Database handbook: Contradicts line 825 and the Operating facts: the command shown includes -V, so it prints the confirmation. [defects, defects #261248]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-0db2d5eb5a
Database handbook: The example answers every path with the Prometheus exporter, so the statistics page at /stats is unreachable; the rule needs `if { path /metrics }` as in the other examples. [defects, defects #261249]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-0ad710b669
Database handbook: The advice cannot work for the case it describes (file group 999, mode already 640). [defects, defects #261250]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-df6820c2ba
Database handbook: SIGUSR1 is named as a reload signal; it is the graceful stop signal. [defects, defects #261251]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-307bb8671a
Database handbook: The image has no `id` command (not in IMAGE_BINARIES.txt), so the command named cannot be run. [defects, defects #261252]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-fc5c2c5fd7
Database handbook: Self-contradiction: a restart does not start with an empty configuration. [defects, defects #261253]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-1e07ceac44
Database handbook: The example given for a single-file mount is a directory mount, contradicting the paragraph. [defects, defects #261254]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-331bdcbf41
Admin handbook: The published mapping does not match the bind it follows (bind :80 needs -p 80:80), so the copy-paste setup does not answer. [defects, defects #261255]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-9b8234eaa0
Admin handbook: Implies that publishing port 8404 makes the page reachable; it does not. [defects, defects #261256]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-82b0a37bf8
Admin handbook: The command fails for the running container started earlier in the Quick Start, so the next docker run hits a name conflict. [defects, defects #261257]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-be75b7e6b2
Admin handbook: The cross-reference points to sections that do not hold the authentication procedure the sentence is about. [defects, defects #261258]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-d63f036fb0
Admin handbook: False: docker exec -u root succeeds on this image; a root password is not involved. [defects, defects #261259]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-bde545612b
Admin handbook: Wrong explanation: the container does not run in the host's filesystem. [defects, defects #261260]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-743952a907
Admin handbook: Contradicts the Operating facts and REBUILD.md: BUILD_OFFLINE.sh does not use curl. [defects, defects #261261]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-09574053d4
Admin handbook: Contradicts the Operating facts: curl is a VERIFY_OFFLINE.sh requirement only. [defects, defects #261262]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-792f1380bd
Admin handbook: False: the loaded image carries no tag, so the command that follows ('start containers from that tag') fails. [defects, defects #261263]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-73688e5de5
Admin handbook: Overstates what BUILD_OFFLINE.sh checks (no version checks), and line 2168's Docker 20.10 requirement is unsupported by the records. [defects, defects #261264]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-1cdae61af1
Admin handbook: The command given as the remedy checks the same single file the sentence says is insufficient. [defects, defects #261265]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-e486e5048a
Admin handbook: Not fixed from round 1. docs/REBUILD.md Requirements and BUILD_OFFLINE.sh (lines 71-76: docker, jq, Docker daemon arch, `docker buildx version` only) name no Docker Engine version; 20.10 appears in… [defects, defects #263791]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-cb026a1c0b
Database handbook: Same unsupported 20.10 version claim as ADMIN 2168 (paraphrase); the Operating facts ports text names no Docker Engine version and no record in the archive does. [defects, defects #263792]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-1a7802b3b0
Database handbook: src/acme.c (v3.4.6 line 2444) builds `"contact": [ "mailto:%s" ]` from the configured value, and configuration.txt section 12.8 says `contact <string>`: "The contact email". [defects, defects #263793]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-7780300cb4
Database handbook: The example that follows (`frontend https` with `bind :8443 ssl crt /etc/haproxy/certs/server.pem`) contains no reference to the `letsencrypt` section, so following it obtains no certificate. [defects, defects #263794]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-e41e99654b
Database handbook: MANIFEST.txt lines 317-322 list docs/source-acquisition/source/doc/51Degrees-device-detection.txt, DeviceAtlas-device-detection.txt and WURFL-device-detection.txt;… [defects, defects #263795]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-88f6d84ce1
Database handbook: Same record: docs/source-acquisition/source/doc/{51Degrees,DeviceAtlas,WURFL}-device-detection.txt are in MANIFEST.txt (lines 317, 318, 322). [defects, defects #263796]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-a2d500e756
Database handbook: The archive root listing (README.md, BUILD_OFFLINE.sh, docs/, ...) has no LICENSE; MANIFEST.txt line 91 puts it at docs/source-acquisition/LICENSE. [defects, defects #263797]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-e9d12d577a
Database handbook: Step 2 of the same section mounts the directory. [defects, defects #263798]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-0387c92ad3
Database handbook: Measured with `sed -i` on a directory mount: the reload applied the edit. [defects, defects #263799]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-cabf2cda7f
Database handbook: The container runs `-f /usr/local/etc/haproxy/haproxy.cfg` (IMAGE_CONFIG.json Cmd). [defects, defects #263800]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-1c2171e7ba
Database handbook: HAProxy loads "all non-hidden *.cfg files" only when `-f` names a directory; the image's default argument is `-f /usr/local/etc/haproxy/haproxy.cfg` (IMAGE_CONFIG.json), so the container does not… [defects, defects #263801]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-b10478ba14
Database handbook: Measured: global `chroot /var/empty` -> `[ALERT] Cannot chroot(/var/empty)`, container exited 1; global `user haproxy` + `group haproxy` -> container started (`Failed to drop supplementary groups`… [defects, defects #263802]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-2ee037f4e6
Database handbook: Operating facts Ports: "Under Docker's default bridge networking the container's own net.ipv4.ip_unprivileged_port_start is 0, so it can bind 80 and 443 directly ... [defects, defects #263803]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-0a1ab3b0af
Database handbook: Operating facts Health check: "rs-probe -code exits 0 on any HTTP status". [defects, defects #263804]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-c7f172c3c7
Database handbook: Read-only is optional: the Operating facts and the run_note say "read-only is fine", and ADMIN "Mounting Your Configuration"/"Data and Persistence" say "Mount it read-only if you prefer". [defects, defects #263805]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-c2345192cf
Database handbook: The parenthetical example `-p 80:80 -p 443:443` is identical to the primary one, so it does not map to other host ports. [defects, defects #263806]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-3806be7d84
Admin handbook: Measured: `rs-probe -code` -> 200 rc=0; `rs-probe -body http://127.0.0.1:8404/nothing` -> 503 body, "rs-probe: HTTP 503", rc=1; refused connection rc=1. [defects, defects #263807]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-35a2b5adbd
Admin handbook: The next sentences and the Operating facts require a directory mount (a single-file mount never sees edits that replace the file; ADMIN "Important: Mounting Strategy"), so "configuration file"… [defects, defects #263808]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-f5ff8cd986
Admin handbook: doc/management.txt of v3.4.6 (docs/source-acquisition/source/doc/management.txt) contains no section on log rotation or syslog socket mounting (grep -i rotat: no match). [defects, defects #263809]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-4a295be2de
Database handbook: The next command (-f /usr/local/etc/haproxy/conf.d) is given as the default check, but the container's Cmd is `-f /usr/local/etc/haproxy/haproxy.cfg` (IMAGE_CONFIG.json). [defects, defects #267161]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-6e43cb2984
Database handbook: With the documented directory mount the container still runs `-f /usr/local/etc/haproxy/haproxy.cfg` (IMAGE_CONFIG.json Cmd), so it does not load the other *.cfg files; the next sentence of the same… [defects, defects #267162]		highfixed-before-releaseheld review (review model)—
RSD-haproxy-2f293df564
Admin handbook: IMAGE_CONFIG.json Cmd is `-f /usr/local/etc/haproxy/haproxy.cfg`: a conf.d directory next to the file is not loaded by the container, and a directory mount replaces the shipped file rather than… [defects, defects #267163]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-5e43fc6e9c
Admin handbook: Follows 'ensure your configuration is mounted as a directory' (line 809). [defects, defects #267164]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-6c8d941432
Database handbook: The paragraph under the step says any way of saving, including sed -i and rename, is seen with the directory mount (measured: sed -i on a directory mount applied after HUP). [defects, defects #267165]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-383d1aec9c
Admin handbook: Measured: global `chroot /var/empty` -> container exited 1 (`Failed to load worker (8) exited with code 1`); global `user haproxy` + `group haproxy` -> container running/healthy, WARNING 'Failed to… [defects, defects #267166]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-f5663bc65a
Database handbook: Measured on the held digest: `user haproxy`/`group haproxy` -> container running and healthy; `chroot /var/empty` -> exit 1. [defects, defects #267167]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-bca0ad2d3b
Database handbook: Measured: global `limited-quic` + a frontend whose only bind is `bind quic4@:8443 ssl crt ... [defects, defects #267168]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-89d2bce7bb
Database handbook: Measured with the example as written (acme section + this frontend): `haproxy -c -V` -> `[ALERT] unable to stat SSL certificate from file 'server.pem' : No such file or directory` (also `acme:… [defects, defects #267169]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-cdf57e3c54
Admin handbook: False requirement: a QUIC-only frontend needs only UDP. [defects, defects #267691]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-1febc7213e
Admin handbook: With the files mounted at /usr/local/etc/haproxy the placeholder is hidden, so the default check errors out instead of checking the placeholder. [defects, defects #267692]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-e2d7cd50db
Database handbook: 'silently apply the old configuration' is wrong for the -f conf.d case: the reload is not silent (ALERT + 'Failed to load worker' logged) and the old workers keep serving; and the check does not… [defects, defects #267693]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-b732debacc
Database handbook: The paragraph never says how the container comes to load conf.d; with the documented directory mount and default Cmd (IMAGE_CONFIG.json Cmd -f .../haproxy.cfg) the conf.d files are not loaded, so… [defects, defects #267694]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-284d4f53df
Database handbook: Overstated: with a directory mount over /usr/local/etc/haproxy the placeholder is not there to be checked. [defects, defects #267695]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-551b9d5599
Admin handbook: Unconditional 'publish the port for both protocols' after a QUIC-only example bind implies a TCP bind is required; DB_HANDBOOK.md:2198 says HAProxy does not require the TCP bind (the round-4 finding… [defects, defects #268451]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-dfdf52ea60
Admin handbook: Without --network, docker run attaches the container to the default bridge (outbound access, not isolated). [defects, defects #268452]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-dbb45da470
Admin handbook: The 'Configuration Syntax Check' block puts the placeholder `--network <your network>` in a copy-paste command; run as written the shell fails on `<` (syntax error), while the following prose calls… [defects, defects #268453]		lowfixed-before-releaseheld review (review model)—
RSD-haproxy-9bbe401e80
Database handbook: IMAGE_CONFIG.json Healthcheck Interval is 10 s; 'every few seconds' is vague and the same handbook says 10 seconds elsewhere (DB:336). [defects, defects #268454]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:d5bf35c5dfe7dc8b26d5f3d0d329eb2580fa5d3a10cac8b0e5a186bb74623f3a · published digest sha256:d5bf35c5dfe7dc8b26d5f3d0d329eb2580fa5d3a10cac8b0e5a186bb74623f3a · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 86) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T12:20:39Z · failing Docker Scout counts 10 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T12:20:28Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3832261844 · transparency-log entry · integrated 2026-11-12T12:23:15Z) [ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:bb7c69b0b5d7ae35f2f9f35e86872c750c309d0ef5a1b6e73872bbca69be0d75 · state attached · log index 3832264960 · transparency-log entry
    • kind sbom · digest sha256:bb7c69b0b5d7ae35f2f9f35e86872c750c309d0ef5a1b6e73872bbca69be0d75 · state attached · log index 3832267642 · transparency-log entry
    • kind vsa · digest sha256:bb7c69b0b5d7ae35f2f9f35e86872c750c309d0ef5a1b6e73872bbca69be0d75 · state attached · log index 3832269893 · transparency-log entry
    • kind provenance · digest sha256:d5bf35c5dfe7dc8b26d5f3d0d329eb2580fa5d3a10cac8b0e5a186bb74623f3a · state attached · log index 3832272153 · transparency-log entry
    • kind sbom · digest sha256:d5bf35c5dfe7dc8b26d5f3d0d329eb2580fa5d3a10cac8b0e5a186bb74623f3a · state attached · log index 3832274347 · transparency-log entry
    • kind vsa · digest sha256:d5bf35c5dfe7dc8b26d5f3d0d329eb2580fa5d3a10cac8b0e5a186bb74623f3a · state attached · log index 3832277056 · transparency-log entry
    (at 2026-11-12T12:23:17Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/haproxy/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-12T08:24:10Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:d5bf35c5dfe7dc8b26d5f3d0d329eb2580fa5d3a10cac8b0e5a186bb74623f3a [clean-room rebuild ledger, runs[781]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-12T02:10:32Z [stage_runs, stage_runs chain 994 stage publish_image]
  • Archive manifests written2026-11-12T12:22:10Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 68 · probed 2026-11-12T02:07:49Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-12T12:24:35Z generated: by KitForge release/build_trail.py · generator commit 27badbefbe8aac72eb90e98ea8f843a03c177b52
  • 2026-11-12T12:25:49Z publication: promoted at 2026-11-12T12:25:10Z · promoted digest sha256:bb7c69b0b5d7ae35f2f9f35e86872c750c309d0ef5a1b6e73872bbca69be0d75 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 504 · checklist status complete · checklist at 2026-11-12T12:25:49Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/haproxy/3.4.6-CE-ubuntu24.04-r7/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/haproxy/3.4.6-CE-ubuntu24.04-r7/), as staged for publishing—
ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.rebuild.jsonbeside the archive (prodasset /data/production/haproxy/3.4.6-CE-ubuntu24.04-r7/), as staged for publishing—
ReadyStack-haproxy-3.4.6-CE-ubuntu24.04-r7.rebuild.json.sigstorebeside the archive (prodasset /data/production/haproxy/3.4.6-CE-ubuntu24.04-r7/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/haproxy/3.4.6-CE-ubuntu24.04-r7/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)692
chainssadb, ReadyStack's engine database (not published)994
defectssadb, ReadyStack's engine database (not published)haproxy 3.4.6-CE-ubuntu24.04-r7
drive_runssadb, ReadyStack's engine database (not published)chain 994
held_roundssadb, ReadyStack's engine database (not published)chain 994
lesson_recallssadb, ReadyStack's engine database (not published)chain 994
micro_step_runssadb, ReadyStack's engine database (not published)chain 994
release_imagessadb, ReadyStack's engine database (not published)haproxy 3.4.6-CE-ubuntu24.04-r7
stage_eventssadb, ReadyStack's engine database (not published)chain 994
stage_runssadb, ReadyStack's engine database (not published)chain 994
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—