Apache httpd 2.4.70-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/httpd:2.4.70-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/httpd:2.4.70-CE-ubuntu24.04-r2
  • Index digestsha256:b0745ef11c39c0da4f1db2ca7f6c40b2c5d63321e36aa5b69f4b0d52f37de265
  • linux/amd64 digestsha256:8d95c6929ea1e4cad95feef3b7fc0d7564dee59f5da6eb3d4b58ce3880949a1f
  • ArchiveReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now0e8520838ef0b551df602acd79ac502a25e41a938aac5a6305651a98b4ebb00a
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T18:45:13Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.trail.json
ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.trail.jsonReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.trail.mdApache httpd product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductApache httpd (httpd) [MANIFEST.json]
  • Release tag2.4.70-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/httpd:2.4.70-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:b0745ef11c39c0da4f1db2ca7f6c40b2c5d63321e36aa5b69f4b0d52f37de265 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:8d95c6929ea1e4cad95feef3b7fc0d7564dee59f5da6eb3d4b58ce3880949a1f [ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.tar.gz (bytes 582313037) [MANIFEST.json]
  • Archive sha256 at publish0e8520838ef0b551df602acd79ac502a25e41a938aac5a6305651a98b4ebb00a [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/apache/httpd [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref2.4.70 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commite8ada83f004f63bca1e0cc75e374bc25b06cdc7b [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hasha6ab0ba80706b6c3f55f162c80dca73d4fba29bcdae9b39d25212ce40ae2dcc2 (files 5547) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:6df6370df87f38b299ae09b27421d1d1eec8d0376829124125377cbeaa6a50ff [ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793721009 (utc 2026-11-03T15:50:09Z) [ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit 8a45c451adfbe69e8aea57cade68ffc8092d055e · dirty yes · first drive 4026
    • commit 5d0ff967b304c4cd787659a1843c76de2a7e8063 · dirty yes · first drive 4086
    • commit 4e069b7fdf7791b93f45d55244181834e57cd2b8 · dirty yes · first drive 4093
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain927 (created 2026-11-09T13:41:29Z · trigger customer_request · upstream version 2.4.70) [chains, chains #927]
  • Requestbuild request #615 (rebuild) (requested at 2026-11-09T13:41:08Z · requested by kitforge-agent · version 2.4.70) [build_requests, build_requests #615]
  • Reasonqueued 2.4.70-CE-ubuntu24.04-r2, which has not shipped, with no open build request: opened by the line (scripts/line-request.py) [build_requests, build_requests #615 request_reason]
  • Supersedesreadystack/httpd:2.4.70-CE-ubuntu24.04-r1 (chain 866) [chains, chains #866]

The path through the harness

Fully recorded

1 chain · 3 drives · 18 stages · 2 rewinds

Chain 927 release · ready_to_ship

Created 2026-11-09T13:41:29Z, upstream 2.4.70, build request 615 [chains, chains #927]

DriveStartedMinutesBuild hostHow it stopped
40262026-11-09T13:41:51Z18build host 1 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4026]
40862026-11-09T18:09:29Z4.8build host 1 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4086]
40932026-11-09T18:40:52Z—build host 1 publish-held not recorded [drive_runs, drive_runs #4093]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-09T13:42:01Z2026-11-09T13:42:02Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json a6630195f6da…
acquire 2026-11-09T13:42:11Z2026-11-09T13:42:12Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 552909aa45f8…
license_file 47b8c2b6c330…
custody_inputs 4aa491b19dd9…
source_tree_hash 8743ea97c7b8…
source_file_manifest 144db9706fec…
plan 2026-11-09T13:42:45Z2026-11-09T13:42:46Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 8af3cdcf9c5a…
input_pin_plan a1ed430862f7…
toolchain_lock f9b3d35071a9…
assemble_kit 2026-11-09T13:45:58Z2026-11-09T13:45:59Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 68ae9fdebf4e…
build_recipe 7b5c3f391d6a…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health c6bb887d92a0…
verify_offline_sh 3e8184ea230c…
base_image_digests 3ed6b23ba6bc…
dockerfile_offline 68ae9fdebf4e…
first_build_digest e9791eaa17e6…
remediate 2026-11-09T13:46:41Z2026-11-09T13:46:42Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log b9d0eedfc02f…
security_report e39a5225d993…
build_kit 2026-11-09T13:51:30Z2026-11-09T13:51:31Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp cf8a4332cf72…
locked_digest 332c13c11b04…
freeze_manifest 63b0c630a741…
offline_rebuild_transcript caafc2e27fce…
verdict 2026-11-09T13:51:56Z2026-11-09T13:51:57Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict d2c667173d2a…
publish_image 2026-11-09T13:52:27Z2026-11-09T13:52:27Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme a3b09024beb5…
promotion_record fcb8e366e661…
boot_instance 2026-11-09T13:52:33Z2026-11-09T13:52:37Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle a2ad679feeb4…
sbom 2026-11-09T13:52:45Z2026-11-09T13:52:45Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 5fd724bedc10…
sbom_json 7c4ab8249a42…
schema_discovery 2026-11-09T13:52:48Z2026-11-09T13:52:49Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 2be4721a1fa8…
dependency_tree f11ed60147fe…
table_classification 070172734239…
admin_handbook 2026-11-09T13:52:58Z2026-11-09T13:52:59Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map d92ed57fb297…
admin_handbook 6de6eb1514b9…
db_handbook 2026-11-09T13:53:09Z2026-11-09T13:53:10Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 1523b6f391b4…
seed_isolation bf0a255089c6…
seed_data 2026-11-09T13:53:19Z2026-11-09T13:53:20Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 423484b42af1…
seed_cases_json 75eef1f87f98…
seed_validate 2026-11-09T13:53:22Z2026-11-09T13:53:23Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract a71608d930ac…
usecase_validate 2026-11-09T13:53:40Z2026-11-09T13:53:41Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 183ced8aaba2…
test_results d3692942af0a…
usecase_contract 25545a54e934…
finalize_docs 2026-11-09T13:53:47Z2026-11-09T13:53:48Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json dcb26d973b04…
release_notes 51283b8ee3aa…
api_integration_guide 7cdb493dddd0…
package_archive invalidated 2026-11-09T18:40:27Z 2026-11-09T13:59:48Z2026-11-09T18:14:15Z2
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 47f8b3788f23…
checksums f16440cabdc4…
verify_md ce0cf3125561…
rebuild_md 2c060532b8b5…
manifest_txt 7da5ccd33db7…
actions_jsonl a27222c9d7d8…
provenance_md facf54043103…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 5c2066b7c2a8…

[stage_runs]

Rewinds

  • 2026-11-09T14:28:58Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29124]
  • 2026-11-09T18:40:27Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29585]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T18:14:15Z.

10 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 06803 —
remediate2001 010588 L-A08, L-038, L-036, L-034, L-032
admin_handbook4001 027793 —
db_handbook1001 06358 —
usecase_validate1001 01584 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $1.42 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T14:00:21Z 01014 findings to repackage [held_rounds, held_rounds #1628] $0.86 3 rounds, $40.00 cc2b318964dd…
22026-11-09T18:14:43Z 007 clean to publish [held_rounds, held_rounds #1656] $0.57 3 rounds, $40.00 47f8b3788f23…

Defects

Fully recorded
  • Ledger entries25 [defects, defects where product_slug=httpd and this tag or chain]
  • Disclosed in the archive25 [docs/defects/defects.json, entries]

25 ledger entries: by severity high 8, low 17; by status fixed-before-release 25.

DefectSeverityStatusFound byFixed in
RSD-httpd-55420e6436
Admin handbook: Ran on the r2 image (readystack/httpd@sha256:8d95c692...): `docker exec jt-ha927-a grep x` -> 'exec: "grep": executable file not found in $PATH'; grep is not in provenance/IMAGE_BINARIES.txt. [defects, defects #211220]		highfixed-before-releaseheld review (review model)—
RSD-httpd-8df066d4ec
Database handbook: Ran on the r2 image (readystack/httpd@sha256:8d95c692...): `docker exec jt-ha927-a grep x` -> 'exec: "grep": executable file not found in $PATH'; grep is not in provenance/IMAGE_BINARIES.txt. [defects, defects #211221]		highfixed-before-releaseheld review (review model)—
RSD-httpd-5e4614882e
Database handbook: Ran on the r2 image (readystack/httpd@sha256:8d95c692...): `docker exec jt-ha927-a grep x` -> 'exec: "grep": executable file not found in $PATH'; grep is not in provenance/IMAGE_BINARIES.txt. [defects, defects #211222]		highfixed-before-releaseheld review (review model)—
RSD-httpd-52e956521d
API guide: Ran on the r2 image (readystack/httpd@sha256:8d95c692...): `docker exec jt-ha927-a grep x` -> 'exec: "grep": executable file not found in $PATH'; grep is not in provenance/IMAGE_BINARIES.txt. [defects, defects #211223]		highfixed-before-releaseheld review (review model)—
RSD-httpd-14de7efdfd
Database handbook: Ran on the r2 image (readystack/httpd@sha256:8d95c692...): `docker exec jt-ha927-a grep x` -> 'exec: "grep": executable file not found in $PATH'; grep is not in provenance/IMAGE_BINARIES.txt. [defects, defects #211224]		highfixed-before-releaseheld review (review model)—
RSD-httpd-afb1a6d0e5
Database handbook: Ran on the r2 image (readystack/httpd@sha256:8d95c692...): `docker exec jt-ha927-a grep x` -> 'exec: "grep": executable file not found in $PATH'; grep is not in provenance/IMAGE_BINARIES.txt. [defects, defects #211225]		highfixed-before-releaseheld review (review model)—
RSD-httpd-4f5026b8ed
API guide: Ran on the r2 image (readystack/httpd@sha256:8d95c692...): `docker exec jt-ha927-a grep x` -> 'exec: "grep": executable file not found in $PATH'; grep is not in provenance/IMAGE_BINARIES.txt. [defects, defects #211226]		highfixed-before-releaseheld review (review model)—
RSD-httpd-7e60f037ce
API guide: Ran on the r2 image (readystack/httpd@sha256:8d95c692...): `docker exec jt-ha927-a grep x` -> 'exec: "grep": executable file not found in $PATH'; grep is not in provenance/IMAGE_BINARIES.txt. [defects, defects #211227]		highfixed-before-releaseheld review (review model)—
RSD-httpd-1d14c2d956
Admin handbook: provenance/IMAGE_CONFIG.json Healthcheck.Test is now `/usr/local/bin/rs-probe -code http://127.0.0.1:8080/ || exit 1` (r1 used bash /dev/tcp; baseline diff). [defects, defects #211228]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-33bcf6d75a
Admin handbook: provenance/IMAGE_CONFIG.json Healthcheck.Test is now `/usr/local/bin/rs-probe -code http://127.0.0.1:8080/ || exit 1` (r1 used bash /dev/tcp; baseline diff). [defects, defects #211229]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-0d58127e62
Database handbook: provenance/IMAGE_CONFIG.json Healthcheck.Test is now `/usr/local/bin/rs-probe -code http://127.0.0.1:8080/ || exit 1` (r1 used bash /dev/tcp; baseline diff). [defects, defects #211230]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-66226fd27b
Database handbook: provenance/IMAGE_CONFIG.json Healthcheck.Test is now `/usr/local/bin/rs-probe -code http://127.0.0.1:8080/ || exit 1` (r1 used bash /dev/tcp; baseline diff). [defects, defects #211231]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-263b3a3924
API guide: provenance/IMAGE_CONFIG.json Healthcheck.Test is now `/usr/local/bin/rs-probe -code http://127.0.0.1:8080/ || exit 1` (r1 used bash /dev/tcp; baseline diff). [defects, defects #211232]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-08cb0e6a43
API guide: provenance/IMAGE_CONFIG.json Healthcheck.Test is now `/usr/local/bin/rs-probe -code http://127.0.0.1:8080/ || exit 1` (r1 used bash /dev/tcp; baseline diff). [defects, defects #211233]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-e06d60a44d
Admin handbook: provenance/IMAGE_CONFIG.json Env no longer contains DEBIAN_FRONTEND (baseline diff removes it); `docker exec jt-ha927-a env` on the r2 image shows only PATH, HOSTNAME, HOME. [defects, defects #211234]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-92c3b8b6b1
API guide: provenance/IMAGE_CONFIG.json Env no longer contains DEBIAN_FRONTEND (baseline diff removes it); `docker exec jt-ha927-a env` on the r2 image shows only PATH, HOSTNAME, HOME. [defects, defects #211235]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-2660ef868f
API guide: provenance/IMAGE_CONFIG.json Env no longer contains DEBIAN_FRONTEND (baseline diff removes it); `docker exec jt-ha927-a env` on the r2 image shows only PATH, HOSTNAME, HOME. [defects, defects #211236]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-f73d3d494c
API guide: provenance/IMAGE_CONFIG.json Env no longer contains DEBIAN_FRONTEND (baseline diff removes it); `docker exec jt-ha927-a env` on the r2 image shows only PATH, HOSTNAME, HOME. [defects, defects #211237]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-2f53adc93a
API guide: `docker exec jt-ha927-a apxs -q PREFIX` -> 'exec /opt/httpd/bin/apxs: no such file or directory' (apxs is a Perl script; the image has no Perl, as RELEASE_NOTES.md line 17 says: r1's Perl helpers… [defects, defects #211238]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-d787fecbf0
Release notes: Release notes say the image has no bash; it has bash 5.2.21. [defects, defects #211239]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-0a799ecd4d
Admin handbook: health check described as GET / HTTP/1.0 (r1 bash probe); r2 uses rs-probe (HTTP/1.1) [defects, defects #221438]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-c06f28b2c6
API guide: health check described as GET / HTTP/1.0 (r1 bash probe); r2 uses rs-probe (HTTP/1.1) [defects, defects #221439]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-9e85a8c4ac
Database handbook: health check described as GET / HTTP/1.0 (r1 bash probe); r2 uses rs-probe (HTTP/1.1) [defects, defects #221440]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-ca9bafe1bc
Database handbook: health check described as GET / HTTP/1.0 (r1 bash probe); r2 uses rs-probe (HTTP/1.1) [defects, defects #221441]		lowfixed-before-releaseheld review (review model)—
RSD-httpd-195b763156
Admin handbook: not-built module lists incomplete vs the changed Modules section [defects, defects #221442]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:8d95c6929ea1e4cad95feef3b7fc0d7564dee59f5da6eb3d4b58ce3880949a1f · published digest sha256:8d95c6929ea1e4cad95feef3b7fc0d7564dee59f5da6eb3d4b58ce3880949a1f · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 130) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T18:41:12Z · failing Docker Scout counts 15 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T18:41:03Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3768039833 · transparency-log entry · integrated 2026-11-09T18:43:53Z) [ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:b0745ef11c39c0da4f1db2ca7f6c40b2c5d63321e36aa5b69f4b0d52f37de265 · state attached · log index 3768041215 · transparency-log entry
    • kind sbom · digest sha256:b0745ef11c39c0da4f1db2ca7f6c40b2c5d63321e36aa5b69f4b0d52f37de265 · state attached · log index 3768042224 · transparency-log entry
    • kind vsa · digest sha256:b0745ef11c39c0da4f1db2ca7f6c40b2c5d63321e36aa5b69f4b0d52f37de265 · state attached · log index 3768043359 · transparency-log entry
    • kind provenance · digest sha256:8d95c6929ea1e4cad95feef3b7fc0d7564dee59f5da6eb3d4b58ce3880949a1f · state attached · log index 3768044156 · transparency-log entry
    • kind sbom · digest sha256:8d95c6929ea1e4cad95feef3b7fc0d7564dee59f5da6eb3d4b58ce3880949a1f · state attached · log index 3768045057 · transparency-log entry
    • kind vsa · digest sha256:8d95c6929ea1e4cad95feef3b7fc0d7564dee59f5da6eb3d4b58ce3880949a1f · state attached · log index 3768046148 · transparency-log entry
    (at 2026-11-09T18:43:55Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/httpd/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T14:00:25Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:8d95c6929ea1e4cad95feef3b7fc0d7564dee59f5da6eb3d4b58ce3880949a1f [clean-room rebuild ledger, runs[702]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-09T13:52:27Z [stage_runs, stage_runs chain 927 stage publish_image]
  • Archive manifests written2026-11-09T18:42:35Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 186 · probed 2026-11-09T13:49:04Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T18:45:13Z generated: by KitForge release/build_trail.py · generator commit 4e069b7fdf7791b93f45d55244181834e57cd2b8
  • 2026-11-09T18:46:33Z publication: promoted at 2026-11-09T18:45:46Z · promoted digest sha256:b0745ef11c39c0da4f1db2ca7f6c40b2c5d63321e36aa5b69f4b0d52f37de265 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 430 · checklist status complete · checklist at 2026-11-09T18:46:33Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/httpd/2.4.70-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/httpd/2.4.70-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/httpd/2.4.70-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-httpd-2.4.70-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/httpd/2.4.70-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/httpd/2.4.70-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)615
chainssadb, ReadyStack's engine database (not published)927
defectssadb, ReadyStack's engine database (not published)httpd 2.4.70-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 927
held_roundssadb, ReadyStack's engine database (not published)chain 927
lesson_recallssadb, ReadyStack's engine database (not published)chain 927
micro_step_runssadb, ReadyStack's engine database (not published)chain 927
release_imagessadb, ReadyStack's engine database (not published)httpd 2.4.70-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 927
stage_runssadb, ReadyStack's engine database (not published)chain 927
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—