Jitsi Meet stable-11248-CE-ubuntu24.04-r4 build trail

How ReadyStack built readystack/jitsi:stable-11248-CE-ubuntu24.04-r4 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/jitsi:stable-11248-CE-ubuntu24.04-r4
  • Index digestsha256:a6c5fd563d14a1abbfc5c6b559bd32e5332781431e5a31271c58c17078b9fc51
  • linux/amd64 digestsha256:759b8528be92efe5d13aa4ba70d3b9f2a5df5ddfc8c562196ebd24325cdd8737
  • ArchiveReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.tar.gz
  • Archive SHA-256 nowd58ebf940f4a1e4cf0bc35bade43859429fad14f9041ce1eb5d9042ff8868817
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-10T09:53:04Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.trail.json.sigstore ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.trail.json
ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.trail.jsonReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.trail.json.sigstoreReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.trail.mdJitsi Meet product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductJitsi Meet (jitsi) [MANIFEST.json]
  • Release tagstable-11248-CE-ubuntu24.04-r4 [MANIFEST.json]
  • Imagereadystack/jitsi:stable-11248-CE-ubuntu24.04-r4 [MANIFEST.json]
  • Image index digestsha256:a6c5fd563d14a1abbfc5c6b559bd32e5332781431e5a31271c58c17078b9fc51 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:759b8528be92efe5d13aa4ba70d3b9f2a5df5ddfc8c562196ebd24325cdd8737 [ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.tar.gz (bytes 538906215) [MANIFEST.json]
  • Archive sha256 at publishd58ebf940f4a1e4cf0bc35bade43859429fad14f9041ce1eb5d9042ff8868817 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/jitsi/jitsi-meet [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refstable/jitsi-meet_11248 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitf765042bf280cbd7dcd4a9bbdb63b09e9e4d3259 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash348e977d549628dbcb5c66aa95a57722a9fe8a1415c90680674fb63e9d1ba626 (files 3159) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:e4da0c5a0f1bd5666a5e77f6c67eced430c9606777f7f32db1015f4d723ca759 [ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794290164 (utc 2026-11-10T05:56:04Z) [ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.rebuild.json, engine]
  • Engine commit(s)
    • commit e3eaace0a74e1a10fea82b44f3849ea9a0e2216a · dirty yes · first drive 4156
    • commit 8f330f31aa066ed1381d543d473df5415ecba80a · dirty yes · first drive 4175
    • commit 2886aade6b1847d1535d733bf5f5a96a150c2c2a · dirty yes · first drive 4176
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain949 (created 2026-11-10T06:37:04Z · trigger customer_request · upstream version stable-11248) [chains, chains #949]
  • Requestbuild request #629 (rebuild) (requested at 2026-11-10T06:02:19Z · requested by kitforge-agent · version stable-11248) [build_requests, build_requests #629]
  • Reasonrevision stable-11248-CE-ubuntu24.04-r4: same upstream version re-dated by its own release (owner 2026-11-10 "date images correctly") [build_requests, build_requests #629 request_reason]
  • Supersedesreadystack/jitsi:stable-11248-CE-ubuntu24.04-r3 (chain 835) [chains, chains #835]

The path through the harness

Fully recorded

1 chain · 3 drives · 18 stages · 2 rewinds

Chain 949 release · ready_to_ship

Created 2026-11-10T06:37:04Z, upstream stable-11248, build request 629 [chains, chains #949]

DriveStartedMinutesBuild hostHow it stopped
41562026-11-10T06:37:26Z42.4build host 4 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4156]
41752026-11-10T09:17:14Z3.6build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4175]
41762026-11-10T09:47:59Z—build host 4 publish-held not recorded [drive_runs, drive_runs #4176]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-10T06:37:36Z2026-11-10T06:37:37Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json c639687d3eb2…
acquire 2026-11-10T06:37:47Z2026-11-10T06:37:49Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree eb0727742286…
license_file eae52e200cd8…
custody_inputs d12747c74bcc…
source_tree_hash bb5d2fe87560…
source_file_manifest 7a6a65146a6f…
plan 2026-11-10T06:38:23Z2026-11-10T06:38:23Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report c23e9faa6841…
input_pin_plan 4dad75a06d42…
toolchain_lock 1118452de5a8…
assemble_kit 2026-11-10T06:49:19Z2026-11-10T06:49:20Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile d0ed0d1ff853…
build_recipe f89e88cbb5cf…
system_pinning f6fceb2bc81c…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health bb0156547e6f…
verify_offline_sh 3e8184ea230c…
base_image_digests c095da27ce6f…
dockerfile_offline d0ed0d1ff853…
first_build_digest a1c6e053cf6a…
remediate 2026-11-10T06:50:00Z2026-11-10T06:50:01Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 7d0c066cbd4c…
security_report 2f6cf3ded7cd…
build_kit 2026-11-10T06:52:06Z2026-11-10T06:52:07Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 37b8cb99a150…
locked_digest 9f4e15a98f84…
freeze_manifest 2e253183743c…
offline_rebuild_transcript 35db815c667d…
verdict 2026-11-10T06:53:01Z2026-11-10T06:53:02Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict dc143a835c90…
publish_image 2026-11-10T06:53:42Z2026-11-10T06:53:42Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 9f4bc5d600a2…
promotion_record 4e15811de667…
boot_instance 2026-11-10T06:53:48Z2026-11-10T06:53:51Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 5bd62b441e9c…
sbom 2026-11-10T06:54:03Z2026-11-10T06:54:04Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md ea60de68c7a5…
sbom_json 6b2b0429438a…
schema_discovery 2026-11-10T06:54:07Z2026-11-10T06:54:07Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 07c2d7241486…
dependency_tree ee058ba58960…
table_classification a8d6fe03a3f8…
admin_handbook 2026-11-10T06:59:18Z2026-11-10T06:59:18Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 90a7268745a4…
admin_handbook e1505beaa717…
db_handbook 2026-11-10T07:05:52Z2026-11-10T07:05:53Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 67b52dfbdf5b…
seed_isolation 4783fe9d6bca…
seed_data 2026-11-10T07:05:59Z2026-11-10T07:06:00Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql d51b5136c74f…
seed_cases_json a0db249a628f…
seed_validate 2026-11-10T07:06:02Z2026-11-10T07:06:03Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 8e7f87adcef1…
usecase_validate 2026-11-10T07:06:22Z2026-11-10T07:06:23Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests 1761e8f7fced…
passed_tests a92082069faa…
test_results 7c8268c2b00e…
usecase_contract 3a2f4b404955…
finalize_docs 2026-11-10T07:12:47Z2026-11-10T07:12:48Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json e5a0e3f4c560…
release_notes cd5291bf28c1…
api_integration_guide eb6330fe19cd…
package_archive invalidated 2026-11-10T09:47:35Z 2026-11-10T07:19:50Z2026-11-10T09:20:50Z2
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar b6247910051c…
checksums 7881c647f8be…
verify_md 99d3f42dd13e…
rebuild_md 95ab79e70e8e…
manifest_txt db658d579926…
actions_jsonl 8239d3bb0b0c…
provenance_md 95078375ff0e…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json c73c9430488b…

[stage_runs]

Rewinds

  • 2026-11-10T07:41:22Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30330]
  • 2026-11-10T09:47:35Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30480]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-10T09:20:50Z.

100 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 07556 —
remediate2001 011132 L-A08, L-038, L-036, L-034, L-032
admin_handbook25703 1110633 —
db_handbook371503 5190463 —
usecase_validate1001 01724 —
finalize_docs331103 3158362 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $2.90 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-10T07:20:34Z 0230 findings to repackage [held_rounds, held_rounds #1688] $1.46 3 rounds, $40.00 b00b0d45fd86…
22026-11-10T09:21:28Z 0017 clean to publish [held_rounds, held_rounds #1692] $1.44 3 rounds, $40.00 b6247910051c…

Defects

Fully recorded
  • Ledger entries49 [defects, defects where product_slug=jitsi and this tag or chain]
  • Disclosed in the archive49 [docs/defects/defects.json, entries]

49 ledger entries: by severity high 2, low 47; by status fixed-before-release 49.

DefectSeverityStatusFound byFixed in
RSD-jitsi-a22fc42213
Database handbook: Live: docker run -e XMPP_BOSH_URL_BASE=http://p:5280/http-bind exits rc=1 ('jitsi-web: XMPP_BOSH_URL_BASE must look like http://host:port (no path)'); entrypoint regex… [defects, defects #229231]		highfixed-before-releaseheld review (review model)—
RSD-jitsi-ce77f396c2
API guide: Live: XMPP_BOSH_URL_BASE=http://p:5280/http-bind -> container exits rc=1; my_prosody (underscore) also exits 1. [defects, defects #229232]		highfixed-before-releaseheld review (review model)—
RSD-jitsi-63150be6b4
API guide: live (image sha256:759b85…, ENABLE_XMPP_WEBSOCKET=0): config.js tail ends 'delete config.websocket;' while nginx.conf still has 'location = /xmpp-websocket' (line 76) and GET /xmpp-websocket answers… [defects, defects #229233]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-b5c0061fcf
API guide: live (image sha256:759b85…, ENABLE_XMPP_WEBSOCKET=0): config.js tail ends 'delete config.websocket;' while nginx.conf still has 'location = /xmpp-websocket' (line 76) and GET /xmpp-websocket answers… [defects, defects #229234]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-741063391d
API guide: Contradicts API_INTEGRATION_GUIDE.md:203, :315, :491 and :583, which document the flag. [defects, defects #229235]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-89be6af2f2
Admin handbook: live (image sha256:759b85…, ENABLE_XMPP_WEBSOCKET=0): config.js tail ends 'delete config.websocket;' while nginx.conf still has 'location = /xmpp-websocket' (line 76) and GET /xmpp-websocket answers… [defects, defects #229236]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-559c8096b3
Admin handbook: live (image sha256:759b85…, ENABLE_XMPP_WEBSOCKET=0): config.js tail ends 'delete config.websocket;' while nginx.conf still has 'location = /xmpp-websocket' (line 76) and GET /xmpp-websocket answers… [defects, defects #229237]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-875e84af27
API guide: live config.js tail: config.hosts.domain = 'meet.jitsi'; config.hosts.muc = 'muc.meet.jitsi'; config.hosts.authdomain; config.hosts.anonymousdomain; no config.xmpp.* and no config.anonymousdomain. [defects, defects #229238]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-887bd1165c
API guide: live config.js tail: config.hosts.domain = 'meet.jitsi'; config.hosts.muc = 'muc.meet.jitsi'; config.hosts.authdomain; config.hosts.anonymousdomain; no config.xmpp.* and no config.anonymousdomain. [defects, defects #229239]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-9e2de0610c
API guide: live config.js tail: config.hosts.domain = 'meet.jitsi'; config.hosts.muc = 'muc.meet.jitsi'; config.hosts.authdomain; config.hosts.anonymousdomain; no config.xmpp.* and no config.anonymousdomain. [defects, defects #229240]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-16ee6467b5
API guide: entrypoint writes only config.hosts.authdomain (and, with ENABLE_GUESTS, config.hosts.anonymousdomain) to config.js; live tail with ENABLE_AUTH=1 ENABLE_GUESTS=1 shows just those lines;… [defects, defects #229241]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-f8ae2decc1
API guide: entrypoint writes only config.hosts.authdomain (and, with ENABLE_GUESTS, config.hosts.anonymousdomain) to config.js; live tail with ENABLE_AUTH=1 ENABLE_GUESTS=1 shows just those lines;… [defects, defects #229242]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-a204c634fa
API guide: entrypoint writes only config.hosts.authdomain (and, with ENABLE_GUESTS, config.hosts.anonymousdomain) to config.js; live tail with ENABLE_AUTH=1 ENABLE_GUESTS=1 shows just those lines;… [defects, defects #229243]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-37e794560f
API guide: Entrypoint: the anonymousdomain echo is inside `if is_true "$ENABLE_AUTH"`; API_INTEGRATION_GUIDE.md:205, :313 and :744 say AUTH is required. [defects, defects #229244]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-21bb88086e
API guide: entrypoint writes only config.hosts.authdomain (and, with ENABLE_GUESTS, config.hosts.anonymousdomain) to config.js; live tail with ENABLE_AUTH=1 ENABLE_GUESTS=1 shows just those lines;… [defects, defects #229245]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-8c07820066
API guide: Live: docker exec <c> grep -o 'LoginDialog' /usr/share/jitsi-meet/libs/app.bundle.min.js -> LoginDialog present (same evidence as the previous round's first finding); contradicts… [defects, defects #229246]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-e0de86723f
Database handbook: entrypoint writes only config.hosts.authdomain (and, with ENABLE_GUESTS, config.hosts.anonymousdomain) to config.js; live tail with ENABLE_AUTH=1 ENABLE_GUESTS=1 shows just those lines;… [defects, defects #229247]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-8bebdef552
Database handbook: entrypoint writes only config.hosts.authdomain (and, with ENABLE_GUESTS, config.hosts.anonymousdomain) to config.js; live tail with ENABLE_AUTH=1 ENABLE_GUESTS=1 shows just those lines;… [defects, defects #229248]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-8eb07af1c1
Database handbook: entrypoint writes only config.hosts.authdomain (and, with ENABLE_GUESTS, config.hosts.anonymousdomain) to config.js; live tail with ENABLE_AUTH=1 ENABLE_GUESTS=1 shows just those lines;… [defects, defects #229249]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-5715cdf646
Admin handbook: Entrypoint: XMPP_GUEST_DOMAIN is only echoed inside the ENABLE_AUTH and ENABLE_GUESTS branch; ADMIN_HANDBOOK.md:529 says so. [defects, defects #229250]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-049cdffc83
Admin handbook: Entrypoint: XMPP_DOMAIN="${XMPP_DOMAIN:-meet.jitsi}"; live container with only ENABLE_* set started healthy. [defects, defects #229251]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-025b75214b
Admin handbook: Live: XMPP_BOSH_URL_BASE=https://prosody.example starts healthy; the entrypoint regex accepts https; ADMIN_HANDBOOK.md:584 says http:// or https://; the container cannot terminate TLS… [defects, defects #229252]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-692887f00c
Admin handbook: Documents themselves say jicofo and jitsi-videobridge are separate services that need prosody (ADMIN_HANDBOOK.md:568); 'sole XMPP client' is false. [defects, defects #229253]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-8cc341135b
API guide: Same as ADMIN_HANDBOOK.md:572: jicofo and jvb are XMPP clients of prosody (API_INTEGRATION_GUIDE.md:175-176). [defects, defects #229254]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-97c7786f43
API guide: Kit: strategy source.ref 'stable/jitsi-meet_11248', image revision label f765042bf280; no ref or version named 'stable-jitsi-meet_11248' exists. [defects, defects #229255]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-54052507ca
API guide: nginx.conf.tmpl: 'location = /config.js { alias /run/jitsi-web/config.js; }' — it is an explicit, served location; live GET /config.js 200. [defects, defects #229256]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-bb74226f4e
API guide: nginx.conf.tmpl: 'location = /external_api.js { alias /usr/share/jitsi-meet/libs/external_api.min.js; }'. [defects, defects #229257]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-2291542be6
Database handbook: nginx.conf.tmpl: 'location = /config.js' is an explicit served location. [defects, defects #229258]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-e15ead2785
API guide: Live: GET /a/b -> 404, GET /static/x/y -> 404 with empty redirect_url; nginx.conf.tmpl uses 'rewrite ^/(.*)$ / break' (internal), no return/redirect. [defects, defects #229259]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-3ce609ea8c
Database handbook: Live: bind-mounting an empty config.js over /usr/share/jitsi-meet/config.js starts and is healthy (GET / 200); only a missing file fails (sed in the entrypoint under set -e). [defects, defects #229260]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-a6776f5f94
Database handbook: The HEALTHCHECK runs inside the container against 127.0.0.1:8080 (IMAGE_CONFIG.json Healthcheck); a reverse proxy outside the container cannot change it. [defects, defects #229261]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-73dfae845c
Database handbook: Port 8080 needs no sysctl; the sysctl (0 here, live) only matters below 1024, where the entrypoint rejects HTTP_PORT anyway. [defects, defects #229262]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-bfb622ed41
Database handbook: Quoted error text is paraphrased. [defects, defects #229867]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-5cf07216fd
Database handbook: The sentence names http://localhost:8080/ as the endpoint to use after HTTP_PORT is changed, but nothing listens on 8080 then. [defects, defects #229868]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-1fa87b4ba7
Database handbook: Second bullet repeats `GET /` instead of naming the example room path. [defects, defects #229869]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-26de31c9f0
Admin handbook: No volume is needed to inspect logs or the generated configuration (nginx logs to stdout/stderr; docker exec cat works without a volume). [defects, defects #229870]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-392bb9b69e
Admin handbook: nginx writes no log files into a mounted directory; the one writable path is /run/jitsi-web. [defects, defects #229871]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-55c356bd42
Admin handbook: Files persist in a stopped container (and in a volume mounted at /run/jitsi-web). [defects, defects #229872]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-8e69c8323c
API guide: 'destroyed when the container stops' is false: the files remain in a stopped container. [defects, defects #229873]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-c13206ab53
Admin handbook: Implies the volume holds customer data to be restored; /run/jitsi-web content is regenerated (contradicts 'no data to back up', lines 141, 558). [defects, defects #229874]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-d65eeff4f5
API guide: nginx.conf.tmpl treats the two locations differently (Upgrade/Connection headers, proxy_read_timeout 900s on websocket); API_INTEGRATION_GUIDE.md:229 says so. [defects, defects #229875]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-658a12ce6c
API guide: 'Leave as 1' contradicts lines 203/315/583, which document 0. [defects, defects #229876]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-a41c044eb5
API guide: The anonymousdomain line is inside the ENABLE_AUTH branch; ENABLE_GUESTS alone writes nothing. [defects, defects #229877]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-aeeecc7227
API guide: Same as line 206. [defects, defects #229878]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-633c0e09a8
Admin handbook: Same as line 206; contradicts ADMIN_HANDBOOK.md:581. [defects, defects #229879]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-ef89c38d15
Database handbook: Residual of the round-1 'required' finding: the entrypoint defaults XMPP_DOMAIN, XMPP_MUC_DOMAIN and XMPP_BOSH_URL_BASE. [defects, defects #229880]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-030ac45f7f
API guide: Heading says required, but the section itself lists defaults and the entrypoint applies them. [defects, defects #229881]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-b564f1d6dc
API guide: Same 'required' residual. [defects, defects #229882]		lowfixed-before-releaseheld review (review model)—
RSD-jitsi-9be84dea9b
Database handbook: Same 'required' residual. [defects, defects #229883]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:759b8528be92efe5d13aa4ba70d3b9f2a5df5ddfc8c562196ebd24325cdd8737 · published digest sha256:759b8528be92efe5d13aa4ba70d3b9f2a5df5ddfc8c562196ebd24325cdd8737 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 42) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-10T09:48:22Z · failing Docker Scout counts 104 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-10T09:48:10Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3783140306 · transparency-log entry · integrated 2026-11-10T09:51:30Z) [ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:a6c5fd563d14a1abbfc5c6b559bd32e5332781431e5a31271c58c17078b9fc51 · state attached · log index 3783143684 · transparency-log entry
    • kind sbom · digest sha256:a6c5fd563d14a1abbfc5c6b559bd32e5332781431e5a31271c58c17078b9fc51 · state attached · log index 3783146801 · transparency-log entry
    • kind vsa · digest sha256:a6c5fd563d14a1abbfc5c6b559bd32e5332781431e5a31271c58c17078b9fc51 · state attached · log index 3783149211 · transparency-log entry
    • kind provenance · digest sha256:759b8528be92efe5d13aa4ba70d3b9f2a5df5ddfc8c562196ebd24325cdd8737 · state attached · log index 3783151948 · transparency-log entry
    • kind sbom · digest sha256:759b8528be92efe5d13aa4ba70d3b9f2a5df5ddfc8c562196ebd24325cdd8737 · state attached · log index 3783155146 · transparency-log entry
    • kind vsa · digest sha256:759b8528be92efe5d13aa4ba70d3b9f2a5df5ddfc8c562196ebd24325cdd8737 · state attached · log index 3783159298 · transparency-log entry
    (at 2026-11-10T09:51:31Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/jitsi/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-10T07:20:38Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:759b8528be92efe5d13aa4ba70d3b9f2a5df5ddfc8c562196ebd24325cdd8737 [clean-room rebuild ledger, runs[720]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-10T06:53:42Z [stage_runs, stage_runs chain 949 stage publish_image]
  • Archive manifests written2026-11-10T09:49:55Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 768 · probed 2026-11-10T06:51:10Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-10T09:53:04Z generated: by KitForge release/build_trail.py · generator commit 2886aade6b1847d1535d733bf5f5a96a150c2c2a
  • 2026-11-10T09:54:27Z publication: promoted at 2026-11-10T09:53:39Z · promoted digest sha256:a6c5fd563d14a1abbfc5c6b559bd32e5332781431e5a31271c58c17078b9fc51 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 448 · checklist status complete · checklist at 2026-11-10T09:54:27Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/jitsi/stable-11248-CE-ubuntu24.04-r4/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/jitsi/stable-11248-CE-ubuntu24.04-r4/), as staged for publishing—
ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.rebuild.jsonbeside the archive (prodasset /data/production/jitsi/stable-11248-CE-ubuntu24.04-r4/), as staged for publishing—
ReadyStack-jitsi-stable-11248-CE-ubuntu24.04-r4.rebuild.json.sigstorebeside the archive (prodasset /data/production/jitsi/stable-11248-CE-ubuntu24.04-r4/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/jitsi/stable-11248-CE-ubuntu24.04-r4/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)629
chainssadb, ReadyStack's engine database (not published)949
defectssadb, ReadyStack's engine database (not published)jitsi stable-11248-CE-ubuntu24.04-r4
drive_runssadb, ReadyStack's engine database (not published)chain 949
held_roundssadb, ReadyStack's engine database (not published)chain 949
lesson_recallssadb, ReadyStack's engine database (not published)chain 949
micro_step_runssadb, ReadyStack's engine database (not published)chain 949
release_imagessadb, ReadyStack's engine database (not published)jitsi stable-11248-CE-ubuntu24.04-r4
stage_eventssadb, ReadyStack's engine database (not published)chain 949
stage_runssadb, ReadyStack's engine database (not published)chain 949
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—