Jenkins 2.580.2-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/jenkins:2.580.2-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/jenkins:2.580.2-CE-ubuntu24.04-r2
  • Index digestsha256:171960d549bfa107091775f9b3af93d48b1885a95162957d6b41ef89d41f63de
  • linux/amd64 digestsha256:b024f8a5e3e331139a06a905ba29e31c592933f976dda589e15e6f3540a59d30
  • ArchiveReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now1e0207d9c48945c66c5b79e2e1fee2097eb574ed71b3e6788c8f1244cd8484b2
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T14:30:33Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.trail.json
ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.trail.jsonReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.trail.mdJenkins product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductJenkins (jenkins) [MANIFEST.json]
  • Release tag2.580.2-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/jenkins:2.580.2-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:171960d549bfa107091775f9b3af93d48b1885a95162957d6b41ef89d41f63de [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:b024f8a5e3e331139a06a905ba29e31c592933f976dda589e15e6f3540a59d30 [ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.tar.gz (bytes 1508566008) [MANIFEST.json]
  • Archive sha256 at publish1e0207d9c48945c66c5b79e2e1fee2097eb574ed71b3e6788c8f1244cd8484b2 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/jenkinsci/jenkins [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refjenkins-2.580.2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitea3f958268fe87ed86a5d1c2d90c5a99426b97ce [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash2da58d3f9f824d6abe5561b5d8ffba34ef4f65ba11d9e55e3a5a6c77f8280a37 (files 12436) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:ad92bf3a34bdefbe82f8565f7c987da2c511b727e93e316c9d15178b266be0bc [ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793014397 (utc 2026-10-26T11:33:17Z) [ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref eclipse-temurin:21-jre-noble@sha256:161310cd5bd41fd549d19cf9f90b614897cb4a1532555c613b43b7e0628fe5d6 · platform digest sha256:db724162e4ff5f71fa0a2815026314d9e5e0e9a139f49be1d4717e6930e93341
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref maven:3.9.8-eclipse-temurin-21@sha256:de18e4e51396ad9266f76669779ed6d6b49fbb0f45ed6f39169d87378d548d7d · platform digest sha256:6847cbbf21e159f97819f18336cf6bbc24a89f9eb6439317520d93f904e9a916
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit 53eeaa1375fde24597366a5342db51d1d1fd7b52 · dirty yes · first drive 3977
    • commit d5e78446f06025d790702ad43076afd5663bfdf4 · dirty yes · first drive 4002
    • commit 07a570ed33498a9ef37c19dafd05812f040ee87f · dirty yes · first drive 4011
    • commit 95e605d65f6d0e2172c3dc2ffb33a3d5d3413830 · dirty yes · first drive 4015
    • commit 00247c6d89bbb33cc6dd3ccc31fe500469ee1e8b · dirty yes · first drive 4021
    • commit ad5c12c5506f316c76f0e1747a166906e1a38407 · dirty yes · first drive 4037
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain911 (created 2026-11-09T07:05:30Z · trigger customer_request · upstream version 2.580.2) [chains, chains #911]
  • Requestbuild request #557 (rebuild) (requested at 2026-11-08T05:00:42Z · requested by kitforge-agent · version 2.580.2) [build_requests, build_requests #557]
  • Reasonrevision 2.580.2-CE-ubuntu24.04-r2: same upstream version rebuilt on the chiselled runtime (slim base, #206) [build_requests, build_requests #557 request_reason]
  • Supersedesreadystack/jenkins:2.580.2-CE-ubuntu24.04-r1 (chain 829) [chains, chains #829]

The path through the harness

Fully recorded

1 chain · 6 drives · 18 stages · 4 rewinds

Chain 911 release · ready_to_ship

Created 2026-11-09T07:05:30Z, upstream 2.580.2, build request 557 [chains, chains #911]

DriveStartedMinutesBuild hostHow it stopped
39772026-11-09T07:08:30Z64.9build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3977]
40022026-11-09T11:09:35Z11.8build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4002]
40112026-11-09T12:00:13Z7.5build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4011]
40152026-11-09T12:42:06Z7.9build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4015]
40212026-11-09T13:17:14Z6.9build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4021]
40372026-11-09T14:20:47Z—build host 3 publish-held not recorded [drive_runs, drive_runs #4037]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-09T07:08:44Z2026-11-09T07:08:46Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 0440738c213d…
acquire 2026-11-09T07:08:55Z2026-11-09T07:08:58Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 91df6a128d79…
license_file 0599d996b7b6…
custody_inputs 5e5a1d55cf8f…
source_tree_hash f819286f343a…
source_file_manifest 6f9513e643d4…
plan 2026-11-09T07:10:14Z2026-11-09T07:10:15Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 8e431c2566c6…
input_pin_plan eddab0b64b13…
toolchain_lock 437569ca0798…
assemble_kit 2026-11-09T07:20:44Z2026-11-09T07:20:45Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile ad2042778b68…
build_recipe ba38945f2904…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health d2d0879282e6…
verify_offline_sh 3e8184ea230c…
base_image_digests 9e0134251717…
dockerfile_offline ad2042778b68…
first_build_digest 6609042b914f…
remediate 2026-11-09T07:22:17Z2026-11-09T07:22:18Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log c16758085ccf…
security_report 8c6d4885a4ca…
build_kit 2026-11-09T07:29:06Z2026-11-09T07:29:07Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 6526a7f2de64…
locked_digest 0557a057a66b…
freeze_manifest d149f68d6c71…
offline_rebuild_transcript 92b5ad78ef04…
verdict 2026-11-09T07:30:10Z2026-11-09T07:30:11Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 2bc7a07cfab5…
publish_image 2026-11-09T07:30:52Z2026-11-09T07:30:52Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme f6db62b0b10c…
promotion_record 03ccbe19917a…
boot_instance 2026-11-09T07:31:10Z2026-11-09T07:31:13Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 2e5a51c33cda…
sbom 2026-11-09T07:31:33Z2026-11-09T07:31:34Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 699dcbed42f2…
sbom_json 87413f0ed14c…
schema_discovery 2026-11-09T07:31:36Z2026-11-09T07:31:37Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 64a946de5f27…
dependency_tree db9b7a92fcf4…
table_classification d083c5110fe2…
admin_handbook 2026-11-09T07:49:23Z2026-11-09T07:49:24Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map e1d179146ccc…
admin_handbook 9315bca076ca…
db_handbook 2026-11-09T08:04:07Z2026-11-09T08:04:08Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook efe357dd9f96…
seed_isolation 0809a422adda…
seed_data 2026-11-09T08:04:17Z2026-11-09T08:04:18Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql f0c2ed4a7f36…
seed_cases_json c6231c72fc9a…
seed_validate 2026-11-09T08:04:21Z2026-11-09T08:04:22Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 128273b6241b…
usecase_validate 2026-11-09T08:04:43Z2026-11-09T08:04:44Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 69295448b3e7…
test_results 9e4e9cfa97a5…
usecase_contract b99a2d32ab8d…
finalize_docs 2026-11-09T08:04:50Z2026-11-09T08:04:51Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json c005da8d773d…
release_notes f57a8d2cd9e4…
api_integration_guide a66365d6d134…
package_archive invalidated 2026-11-09T14:20:20Z 2026-11-09T08:13:22Z2026-11-09T13:24:09Z5
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 15ebd70170d6…
checksums f5192dd37491…
verify_md eb01fad0da13…
rebuild_md a34942ad8f68…
manifest_txt a5d8827b4be3…
actions_jsonl 1e19d0177af2…
provenance_md 4f07dcacbb9e…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 98a95b2fc0c4…

[stage_runs]

Rewinds

  • 2026-11-09T11:55:03Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28824]
  • 2026-11-09T12:34:33Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28906]
  • 2026-11-09T13:13:37Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28928]
  • 2026-11-09T14:20:20Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29104]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T13:24:09Z.

176 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 042553 —
remediate2001 047230 L-A08, L-038, L-036, L-034, L-032
admin_handbook984503 11962674 —
db_handbook733103 7681578 —
usecase_validate1001 01658 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

4 rounds, 4 counted, $8.57 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T11:21:50Z 42311 findings to repackage [held_rounds, held_rounds #1609] $3.18 3 rounds, $40.00 f0c79e71a38c…
22026-11-09T12:07:56Z 028 findings to repackage [held_rounds, held_rounds #1612] $2.35 3 rounds, $40.00 c622bb00051a…
32026-11-09T12:50:22Z 033 findings to repackage [held_rounds, held_rounds #1618] $0.87 3 rounds, $40.00 464d0e125dc3…
42026-11-09T13:24:32Z 0014 clean to publish [held_rounds, held_rounds #1620] $2.18 3 rounds, $40.00 15ebd70170d6…

Defects

Fully recorded
  • Ledger entries68 [defects, defects where product_slug=jenkins and this tag or chain]
  • Disclosed in the archive68 [docs/defects/defects.json, entries]

68 ledger entries: by severity high 28, critical 4, low 36; by status fixed-before-release 66, open 2.

DefectSeverityStatusFound byFixed in
RSD-jenkins-331529c08c
Admin handbook: False claim that a runtime JAVA_OPTS is added to the image's -Djava.awt.headless=true; it replaces it (measured). [defects, defects #205205]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-a5060ed15d
Admin handbook: False claim that a runtime JAVA_OPTS is added to the image's -Djava.awt.headless=true; it replaces it (measured). [defects, defects #205206]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-c79dad5a0a
Admin handbook: False claim that a runtime JAVA_OPTS is added to the image's -Djava.awt.headless=true; it replaces it (measured). [defects, defects #205207]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-5ab0e88fd4
Admin handbook: Same false 'keeps the image's flags' claim as line 804. [defects, defects #205208]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-944678754c
Admin handbook: The sentence contradicts itself: 'The headless flag remains in effect', then 'it replaces the image's default'. [defects, defects #205209]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-8eb83d1fe7
Admin handbook: False: the image's JAVA_OPTS is replaced; contradicts ADMIN :647. [defects, defects #205210]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-3b59aad38c
Admin handbook: The documented `docker exec` example runs a program that is not in the image; it fails. [defects, defects #205211]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-3f88169682
Admin handbook: False: the variable never overwrites the account; contradicts the rest of the handbook. [defects, defects #205212]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-64e031cfff
Admin handbook: Restarting does not remove the password from the container's environment; the stated outcome follows only from re-creating. [defects, defects #205213]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-f955b0395b
Database handbook: Restart instead of re-create leaves the first-start password in the container environment. [defects, defects #205214]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-d92709909a
Admin handbook: The backup archive is written to /tmp of a throw-away --rm container and deleted when the command ends; the customer believes a backup exists and has none. [defects, defects #205215]		criticalfixed-before-releaseheld review (review model)—
RSD-jenkins-c3260f6ccf
Database handbook: The named-volume backup command has no image and archives into the container's own /tmp; it cannot produce a backup, and the next paragraph says the volume can then be removed 'without losing the… [defects, defects #205216]		criticalfixed-before-releaseheld review (review model)—
RSD-jenkins-e22235b355
Database handbook: Copies a host file that the command above never created. [defects, defects #205217]		criticalfixed-before-releaseheld review (review model)—
RSD-jenkins-7ff5c1854b
Database handbook: The uid-999 backup example runs the release image, whose entrypoint ignores the arguments, and the image has no tar, so no backup is made. [defects, defects #205218]		criticalfixed-before-releaseheld review (review model)—
RSD-jenkins-d875899afa
Database handbook: Restore removes the container and then tells the customer to start it; the restore ends in an error and the customer must re-create the container. [defects, defects #205219]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-9a93ee57bc
Admin handbook: /api/json does not list plugins; the next line (`GET /api/json`) and a dangling #section-manage-jenkins link send customers to the wrong route. [defects, defects #205220]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-a221be1b2e
Admin handbook: False route claim. [defects, defects #205221]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-d4a310819c
Database handbook: Lists POST /login as a working login/submission endpoint, contradicting the handbook's own statement that it is not. [defects, defects #205222]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-4bb799b8c1
Database handbook: Lists POST /login as a working login/submission endpoint, contradicting the handbook's own statement that it is not. [defects, defects #205223]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-f388672112
Database handbook: Lists POST /login as a working login/submission endpoint, contradicting the handbook's own statement that it is not. [defects, defects #205224]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-46028b181f
Database handbook: Lists POST /login as a working login/submission endpoint, contradicting the handbook's own statement that it is not. [defects, defects #205225]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-3da9bce103
Admin handbook: Lists POST /login as a working login/submission endpoint, contradicting the handbook's own statement that it is not. [defects, defects #205226]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-37ba37a4f6
Admin handbook: Lists POST /login as a working login/submission endpoint, contradicting the handbook's own statement that it is not. [defects, defects #205227]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-ed17230f77
Admin handbook: Lists POST /login as a working login/submission endpoint, contradicting the handbook's own statement that it is not. [defects, defects #205228]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-7bb215ae3d
Database handbook: The 'API Status Endpoint' section offers /api/json as an unauthenticated readiness check; on this image it answers 403. [defects, defects #205229]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-417bc6889f
Admin handbook: 'Securing an Earlier JENKINS_HOME' sends the customer to an old image (named only '2.580.2') and contradicts the other migration and troubleshooting sections, which start this release with the… [defects, defects #205230]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-2f69507b8b
Admin handbook: Troubleshooting says an unpublished Fixed agent port makes /health/ fail; the rest of the handbook says publishing is invisible to the check. [defects, defects #205231]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-461970dedd
Database handbook: Contradicts the handbook's own description of the starting response. [defects, defects #205232]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-898d7314ba
Database handbook: Neither the header nor the field shows the random port. [defects, defects #205233]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-662aa6399d
Admin handbook: False description of the HEALTHCHECK. [defects, defects #205234]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-533b84bb2c
Admin handbook: The default is in the script, not an image variable. [defects, defects #205235]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-7a60574818
Admin handbook: Wrong field names; the two sections disagree. [defects, defects #205236]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-51cb955ce6
Admin handbook: Contradiction: uid 999 can read these files. [defects, defects #205237]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-1bf6f819ca
Admin handbook: The hash is the file content, not the filename. [defects, defects #205238]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-d91ebbbe65
Admin handbook: Disabling is not uninstalling; only an uninstalled plugin needs its record deleted. [defects, defects #205239]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-e7d4946854
Admin handbook: Two sections give different start times; the measured one is the shorter. [defects, defects #205240]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-5d0b49019d
Database handbook: Contradiction on whether the backup is taken while running. [defects, defects #205241]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-dcb6ba0883
Admin handbook: Contradiction on whether the backup is taken while running. [defects, defects #205242]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-059472b7e7
Admin handbook: Round-1 major not fixed in the rewritten Plugin Management section: /api/json does not list plugins, so the next lines (`GET /api/json`, "This returns a JSON object") send the customer to the wrong… [defects, defects #206297]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-d1dcbf2471
Admin handbook: Dangling link #section-manage-jenkins, and the sentence that follows the wrong /api/json route. [defects, defects #206298]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-20d60a3dc0
Admin handbook: Names the backup file `.jpi.bak`; the file the plugin manager leaves (and the entrypoint tests) is `<name>.bak`. [defects, defects #206299]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-f5903b69a7
Admin handbook: Says to use `docker run --entrypoint` "on a stopped container". [defects, defects #206300]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-901dd98a8a
Admin handbook: Describes `ls -ld` output in `id` format. [defects, defects #206301]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-bb0f7b2e3e
Database handbook: The documented "as uid 999" backup command fails as written for any backup directory not writable by uid 999 (a normal host directory); no backup is produced. [defects, defects #206302]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-e963ce0189
Database handbook: Says uninstalling writes a `.jpi.disabled` marker; that is the disable marker. [defects, defects #206303]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-11631c6499
Database handbook: After "you may override JAVA_OPTS", "your options are appended, not replaced" reads as if the image's headless flag stays (round-1 class); only the three entrypoint flags are kept. [defects, defects #206304]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-bd9b03f7d8
Docker Hub README: Claims "(tested)" for a check the build records do not contain. [defects, defects #206305]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-295b8f68a5
Docker Hub README: Contradicts MANIFEST.json (kit priced 1000 cents, free_release false). [defects, defects #206306]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-6d4b76d37c
Admin handbook: Round-2 major still stands: the rewritten 'Viewing Installed Plugins' still sends the customer to GET /api/json (lines 1618-1622) to list plugins. [defects, defects #207742]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-8ef777e795
Admin handbook: Same defect as line 1616: GET /api/json returns the root object and does not list plugins; the follow-on sentence names no route and mixes session cookie with Basic credentials. [defects, defects #207743]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-6d693e0a4c
Admin handbook: Round-2 major only half corrected: the 'or as uid 999:' block (lines 1219-1223) still gives `tar -czf jenkins-backup.tar.gz -C <directory> .` with no output path. [defects, defects #207744]		highfixed-before-releaseheld review (review model)—
RSD-jenkins-cc30b6969c
Docker Hub README: Round-2 minor not fixed: README calls the kit free with an account (also line 89, 'is a free download for any registered account'); bundle/MANIFEST.json says chain_price_cents 1000, free_release… [defects, defects #207745]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-3f6ed787c1
Docker Hub README: Same price contradiction as line 15 (MANIFEST: 1000 cents, not free). [defects, defects #207746]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-6c9fce2490
Database handbook: The menu is called Plugins in this release; the same handbook (line 1967) and the admin handbook say Manage Jenkins → Plugins. [defects, defects #207747]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-ccd96233d1
Docker Hub README: README calls the kit free; MANIFEST prices it at 1000 cents and free_release=false. [defects, defects #208957]		lowopenheld review (review model)—
RSD-jenkins-f68de4e77b
Docker Hub README: Same price contradiction as line 15. [defects, defects #208958]		lowopenheld review (review model)—
RSD-jenkins-ebea4d3f8c
Admin handbook: Jenkins' own log lines are on stderr, not stdout. [defects, defects #208959]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-d9f55b5a5e
Admin handbook: Only the entrypoint and bootstrap lines are on stdout; Jenkins' own log is on stderr, so `docker logs jenkins > file` loses it. [defects, defects #208960]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-5ef31b8566
Database handbook: Jenkins' log is on stderr; stdout alone has just the entrypoint and bootstrap lines. [defects, defects #208961]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-3a4cb29b8c
Admin handbook: An administrator can be deleted by another administrator; only self-deletion is refused. [defects, defects #208962]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-fb223fa89a
Admin handbook: Jenkins does generate a new master.key when it is missing; the old credentials just cannot be decrypted. [defects, defects #208963]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-c2b550b661
Database handbook: Contradicts the same section (secrets/ is owned by uid 999) and the Backup sections (root or uid 999 works). [defects, defects #208964]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-6e5ed5e8fc
Database handbook: Backslash-escaped quotes inside a code span; the file contains plain quotes, so a search for the literal text finds nothing. [defects, defects #208965]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-4722467fbe
Database handbook: VERIFY_OFFLINE.sh never reads REBUILT_DIGEST.txt; it reads the digest from the image archive. [defects, defects #208966]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-ba5f1fed54
Database handbook: --online compares the live tag with the rebuilt image's digest, after the digest and boot checks. [defects, defects #208967]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-9959610e5a
Admin handbook: --online is an extra check; the TARGET_DIGEST.txt comparison and the boot check still run. [defects, defects #208968]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-75bc3fe4dd
Database handbook: Same: --online adds a check, it does not replace the TARGET_DIGEST.txt comparison. [defects, defects #208969]		lowfixed-before-releaseheld review (review model)—
RSD-jenkins-5d023f33cd
Admin handbook: The example writes the archive, which holds secrets/master.key and all credentials, into world-readable /tmp (mode 644, may be cleaned at reboot); every other backup example in the handbook uses a… [defects, defects #208970]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:b024f8a5e3e331139a06a905ba29e31c592933f976dda589e15e6f3540a59d30 · published digest sha256:b024f8a5e3e331139a06a905ba29e31c592933f976dda589e15e6f3540a59d30 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 189) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T14:21:13Z · failing Docker Scout counts 49 packages with copyleft licences (CDDL, EPL, GPL, LGPL, MPL), 47 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T14:20:58Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3766059625 · transparency-log entry · integrated 2026-11-09T14:28:23Z) [ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:171960d549bfa107091775f9b3af93d48b1885a95162957d6b41ef89d41f63de · state attached · log index 3766066269 · transparency-log entry
    • kind sbom · digest sha256:171960d549bfa107091775f9b3af93d48b1885a95162957d6b41ef89d41f63de · state attached · log index 3766068379 · transparency-log entry
    • kind vsa · digest sha256:171960d549bfa107091775f9b3af93d48b1885a95162957d6b41ef89d41f63de · state attached · log index 3766070150 · transparency-log entry
    • kind provenance · digest sha256:b024f8a5e3e331139a06a905ba29e31c592933f976dda589e15e6f3540a59d30 · state attached · log index 3766071310 · transparency-log entry
    • kind sbom · digest sha256:b024f8a5e3e331139a06a905ba29e31c592933f976dda589e15e6f3540a59d30 · state attached · log index 3766072599 · transparency-log entry
    • kind vsa · digest sha256:b024f8a5e3e331139a06a905ba29e31c592933f976dda589e15e6f3540a59d30 · state attached · log index 3766073940 · transparency-log entry
    (at 2026-11-09T14:28:23Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/jenkins/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T11:22:04Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:b024f8a5e3e331139a06a905ba29e31c592933f976dda589e15e6f3540a59d30 [clean-room rebuild ledger, runs[694]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-09T07:30:52Z [stage_runs, stage_runs chain 911 stage publish_image]
  • Archive manifests written2026-11-09T14:25:00Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 242 · probed 2026-11-09T11:16:38Z · source g8) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T14:30:33Z generated: by KitForge release/build_trail.py · generator commit 16501077e41ede63bd7f496f3616822a9889eef5
  • 2026-11-09T14:32:48Z publication: promoted at 2026-11-09T14:31:25Z · promoted digest sha256:171960d549bfa107091775f9b3af93d48b1885a95162957d6b41ef89d41f63de · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 417 · checklist status complete · checklist at 2026-11-09T14:32:48Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/jenkins/2.580.2-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/jenkins/2.580.2-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/jenkins/2.580.2-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-jenkins-2.580.2-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/jenkins/2.580.2-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/jenkins/2.580.2-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)557
chainssadb, ReadyStack's engine database (not published)911
defectssadb, ReadyStack's engine database (not published)jenkins 2.580.2-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 911
held_roundssadb, ReadyStack's engine database (not published)chain 911
lesson_recallssadb, ReadyStack's engine database (not published)chain 911
micro_step_runssadb, ReadyStack's engine database (not published)chain 911
release_imagessadb, ReadyStack's engine database (not published)jenkins 2.580.2-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 911
stage_runssadb, ReadyStack's engine database (not published)chain 911
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—