Apache httpd 2.4.71-CE-ubuntu24.04-r3 build trail
How ReadyStack built readystack/httpd:2.4.71-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/httpd:2.4.71-CE-ubuntu24.04-r3 - Index digestsha256:c33dda7665e7f5664049729d26f6d5adeca908ce7c2b4ca806707e2902e46afe
- linux/amd64 digestsha256:461b5b271036f4248bb6345deefc249a3f518b79ba0f59d4dab405c26aa77630
- Archive
ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.tar.gz - Archive SHA-256 nowb47920f87a86aecbe072d1c400a381fa83f2580450f39038ff7816027dfa39e2
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-13T13:41:14Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductApache httpd (httpd) [MANIFEST.json]
- Release tag2.4.71-CE-ubuntu24.04-r3 [MANIFEST.json]
- Imagereadystack/httpd:2.4.71-CE-ubuntu24.04-r3 [MANIFEST.json]
- Image index digestsha256:c33dda7665e7f5664049729d26f6d5adeca908ce7c2b4ca806707e2902e46afe [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:461b5b271036f4248bb6345deefc249a3f518b79ba0f59d4dab405c26aa77630 [ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.tar.gz (bytes 587928067) [MANIFEST.json]
- Archive sha256 at publishb47920f87a86aecbe072d1c400a381fa83f2580450f39038ff7816027dfa39e2 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/apache/httpd [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream ref2.4.71 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit4554c7436049b6a68bfee7fbae32fc5ced666355 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashd036c14b10e548c79c0adfc66eb5b5601b7a1b94b3e70de58cb7620e784cb2eb (files 5548) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:1ddc4024f46f20be0492b291b1ca8992f1ae02e0ffc49928c9b0fc8df9fb5273 [ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794569022 (utc 2026-11-13T11:23:42Z) [ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.rebuild.json, engine]
- Engine commit(s)
- commit a45425e339234f118fc0fbe99b7714973f9ef347 · dirty yes · first drive 4577
- commit 1762e17ee8e9761d80444e254bf92fa18d39ea4a · dirty yes · first drive 4583
Why this release exists
Fully recorded- Chain1078 (created 2026-11-13T13:10:33Z · trigger customer_request · upstream version 2.4.71) [chains, chains #1078]
- Requestbuild request #755 (rebuild) (requested at 2026-11-13T11:23:44Z · requested by kitforge-agent · version 2.4.71) [build_requests, build_requests #755]
- Reasonrerelease agenda REVISION -> 2.4.71-CE-ubuntu24.04-r3 (decay loop, IMP-08) [build_requests, build_requests #755 request_reason]
- Supersedesreadystack/httpd:2.4.71-CE-ubuntu24.04-r2 (chain 1010) [chains, chains #1010]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1078 release · ready_to_ship
Created 2026-11-13T13:10:33Z, upstream 2.4.71, build request 755 [chains, chains #1078]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4577 | 2026-11-13T13:10:58Z | 17.5 | build host 3 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4577] |
| 4583 | 2026-11-13T13:36:08Z | — | build host 3 publish-held | not recorded [drive_runs, drive_runs #4583] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-13T13:11:08Z | 2026-11-13T13:11:09Z | 1 | 4
|
order_json d1f211e6a661… |
acquire |
2026-11-13T13:11:16Z | 2026-11-13T13:11:17Z | 1 | 12
|
source_tree e3f1cb41d3ef…license_file 47b8c2b6c330…custody_inputs 50027e412a17…source_tree_hash b2f76d1e3a38…source_file_manifest 882d5409c35d… |
plan |
2026-11-13T13:11:48Z | 2026-11-13T13:11:49Z | 1 | 10
|
recon_report 1a8e23edf2a0…input_pin_plan 6d3e1117fcb7…toolchain_lock 52854bbb8b1e… |
assemble_kit |
2026-11-13T13:15:18Z | 2026-11-13T13:15:19Z | 1 | 27
|
dockerfile b442d674d424…build_recipe 0ba2d4ae5a99…system_pinning aa8db05a9a8a…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health a3b7fd161881…verify_offline_sh 3e8184ea230c…base_image_digests 3ed6b23ba6bc…dockerfile_offline b442d674d424…first_build_digest 8679ceb6e092… |
remediate |
2026-11-13T13:15:48Z | 2026-11-13T13:15:49Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log cef1bec364a1…security_report 9a1c3e318458… |
build_kit |
2026-11-13T13:20:54Z | 2026-11-13T13:20:54Z | 1 | 9
|
cosign_stamp 17aa3a73bc4b…locked_digest 212201c341d5…freeze_manifest ae0cbdaf857f…offline_rebuild_transcript 69837cf29695… |
verdict |
2026-11-13T13:21:20Z | 2026-11-13T13:21:21Z | 1 | 8
|
scout_verdict 1846ce1a9d06… |
publish_image |
2026-11-13T13:22:00Z | 2026-11-13T13:22:01Z | 1 | 7
|
hub_readme c8a0e8f5bf29…promotion_record bd4bb72d0ea2… |
boot_instance |
2026-11-13T13:22:06Z | 2026-11-13T13:22:11Z | 2 | 3
|
instance_handle 5213498111ae… |
sbom |
2026-11-13T13:22:18Z | 2026-11-13T13:22:19Z | 1 | 5
|
sbom_md d67afd9ef3cd…sbom_json 96067e683c81… |
schema_discovery |
2026-11-13T13:22:21Z | 2026-11-13T13:22:22Z | 1 | 7
|
schema_hash 2be4721a1fa8…dependency_tree f11ed60147fe…table_classification 070172734239… |
admin_handbook |
2026-11-13T13:22:29Z | 2026-11-13T13:22:29Z | 1 | 7
|
api_map d92ed57fb297…admin_handbook db0bb2ec724d… |
db_handbook |
2026-11-13T13:22:38Z | 2026-11-13T13:22:39Z | 1 | 8
|
db_handbook f5dd337ae918…seed_isolation bf0a255089c6… |
seed_data |
2026-11-13T13:22:47Z | 2026-11-13T13:22:48Z | 1 | 6
|
seed_data_sql 423484b42af1…seed_cases_json 7242e8903eac… |
seed_validate |
2026-11-13T13:22:50Z | 2026-11-13T13:22:51Z | 1 | 3
|
seed_data_contract 42bfaf1bd7ef… |
usecase_validate |
2026-11-13T13:23:07Z | 2026-11-13T13:23:08Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 07f3899e81a6…test_results 0007b629aad4…usecase_contract 35e68f938699… |
finalize_docs |
2026-11-13T13:23:13Z | 2026-11-13T13:23:14Z | 1 | 9
|
defects_json 8e226feb9816…release_notes e23c611b7648…api_integration_guide f038135b041c… |
package_archive invalidated 2026-11-13T13:35:44Z |
2026-11-13T13:28:24Z | 2026-11-13T13:28:27Z | 1 | 37 (final gate PASS)
|
sale_tar 4227713a4036…checksums e8f195073d8a…verify_md 823c6b9e885d…rebuild_md 9ed1c4f72572…manifest_txt 8195399cf33d…actions_jsonl e6b21c904b2d…provenance_md 20cc32f55557…assetchain_log_md e9eccaec0c0f…assetchain_log_json a9721b8ad6b3… |
[stage_runs]
Rewinds
- 2026-11-13T13:35:44Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36160]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-13T13:28:27Z.
5 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 6533 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 6534 | L-A183, L-A15 |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 1669 | L-A59 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.26 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-13T13:29:09Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1876] | $0.26 | 3 rounds, $40.00 | 4227713a4036… |
Defects
Fully recorded- Ledger entries0 [defects, defects where product_slug=httpd and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
0 ledger entries.
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:461b5b271036f4248bb6345deefc249a3f518b79ba0f59d4dab405c26aa77630 · published digest sha256:461b5b271036f4248bb6345deefc249a3f518b79ba0f59d4dab405c26aa77630 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 142) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T13:36:28Z · failing Docker Scout counts 15 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T13:36:19Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3854700638 · transparency-log entry
- log index 3854704927 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3855049996 · transparency-log entry · integrated 2026-11-13T13:39:04Z) [ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:c33dda7665e7f5664049729d26f6d5adeca908ce7c2b4ca806707e2902e46afe · state attached · log index 3855056628 · transparency-log entry
- kind sbom · digest sha256:c33dda7665e7f5664049729d26f6d5adeca908ce7c2b4ca806707e2902e46afe · state attached · log index 3855059181 · transparency-log entry
- kind vsa · digest sha256:c33dda7665e7f5664049729d26f6d5adeca908ce7c2b4ca806707e2902e46afe · state attached · log index 3855061964 · transparency-log entry
- kind provenance · digest sha256:461b5b271036f4248bb6345deefc249a3f518b79ba0f59d4dab405c26aa77630 · state attached · log index 3855064738 · transparency-log entry
- kind sbom · digest sha256:461b5b271036f4248bb6345deefc249a3f518b79ba0f59d4dab405c26aa77630 · state attached · log index 3855068596 · transparency-log entry
- kind vsa · digest sha256:461b5b271036f4248bb6345deefc249a3f518b79ba0f59d4dab405c26aa77630 · state attached · log index 3855073926 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/httpd/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-13T13:29:13Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:461b5b271036f4248bb6345deefc249a3f518b79ba0f59d4dab405c26aa77630 [clean-room rebuild ledger, runs[834]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-13T13:22:01Z [stage_runs, stage_runs chain 1078 stage publish_image]
- Archive manifests written2026-11-13T13:37:55Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 186 · probed 2026-11-13T13:18:17Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-13T13:41:14Z generated: by KitForge release/build_trail.py · generator commit 1762e17ee8e9761d80444e254bf92fa18d39ea4a
- 2026-11-13T13:42:40Z publication: promoted at 2026-11-13T13:41:57Z · promoted digest sha256:c33dda7665e7f5664049729d26f6d5adeca908ce7c2b4ca806707e2902e46afe · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 543 · checklist status complete · checklist at 2026-11-13T13:42:40Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/httpd/2.4.71-CE-ubuntu24.04-r3/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/httpd/2.4.71-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.rebuild.json | beside the archive (prodasset /data/production/httpd/2.4.71-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-httpd-2.4.71-CE-ubuntu24.04-r3.rebuild.json.sigstore | beside the archive (prodasset /data/production/httpd/2.4.71-CE-ubuntu24.04-r3/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/httpd/2.4.71-CE-ubuntu24.04-r3/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 755 |
chains | sadb, ReadyStack's engine database (not published) | 1078 |
defects | sadb, ReadyStack's engine database (not published) | httpd 2.4.71-CE-ubuntu24.04-r3 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1078 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1078 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1078 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1078 |
release_images | sadb, ReadyStack's engine database (not published) | httpd 2.4.71-CE-ubuntu24.04-r3 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1078 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1078 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |