Apache Kafka 4.4.0-CE-ubuntu24.04-r3 build trail

How ReadyStack built readystack/kafka:4.4.0-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/kafka:4.4.0-CE-ubuntu24.04-r3
  • Index digestsha256:f88e711b4a44b69eba2a0bb3feef0c55472963ffcd7d7d896eaadbe6eda0b2d4
  • linux/amd64 digestsha256:d40942c179cba3fe7a1dc963ebfd7da620b67bd98cf4c72177646c39dbedcf60
  • ArchiveReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.tar.gz
  • Archive SHA-256 nowbf19724605139d8768ba41366d96643aa0adb980ab667adfe3d2eac71cc945d8
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-08T17:53:12Z by KitForge release/build_trail.py
  • Sections9 sections, 7 fully recorded; 2 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.trail.json
ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.trail.jsonReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.trail.json.sigstoreReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.trail.mdApache Kafka product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductApache Kafka (kafka) [MANIFEST.json]
  • Release tag4.4.0-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Imagereadystack/kafka:4.4.0-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Image index digestsha256:f88e711b4a44b69eba2a0bb3feef0c55472963ffcd7d7d896eaadbe6eda0b2d4 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:d40942c179cba3fe7a1dc963ebfd7da620b67bd98cf4c72177646c39dbedcf60 [ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.tar.gz (bytes 978576005) [MANIFEST.json]
  • Archive sha256 at publishbf19724605139d8768ba41366d96643aa0adb980ab667adfe3d2eac71cc945d8 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/apache/kafka [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref4.4.0-rc4 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit1156b2752aaa28eafc0b4c4d387e63356793268d [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashb5da1e956699ffe902548159723a07726c779eccb63a74c376091efa1d0a83e7 (files 7521) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:46a4f83d0bcff9a266918e4fe838b9ea3a7a235f67267346d3ae45f80edad242 [ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1791303144 (utc 2026-10-06T16:12:24Z) [ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref eclipse-temurin:25-jdk-noble@sha256:589ff4cc3f71aab462e7048a47a0d10edf57fbccde3fceea2281e610bf5880b4 · platform digest sha256:51ae87bbb1949c1afdff51f6a3e6c5f283d84a4bd68512c9657fdc6605026a49
    • ref eclipse-temurin:25-jre-noble@sha256:2ef7a81085e0502d7d4ff7e7c0257b6d4f46433f8ea6021180aa3c8a2b9ca3ec · platform digest sha256:41a70a160a5a157126929c1901e8dcf17ea4fd88eca1e7b9abf3cb1bb04df6c2
    [ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.rebuild.json, engine]
  • Engine commit(s)
    • commit ff3112bd2cb03ee39fd394ed644a9522854803de · dirty yes · first drive 3486
    • commit 21a662bdd6974e1e462fe91e1415f9f9d120bf2d · dirty yes · first drive 3532
    • commit 84cdb58a2214910621bb9bf44c715ab9a064b838 · dirty yes · first drive 3805
    • commit 3179e9e9e7ff3f9414b596de6e552d260c583056 · dirty yes · first drive 3847
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain727 (created 2026-10-27T21:01:52Z · trigger customer_request · upstream version 4.4.0) [chains, chains #727]
  • Requestbuild request #424 (rebuild) (requested at 2026-10-27T20:16:34Z · requested by kitforge-agent · version 4.4.0) [build_requests, build_requests #424]
  • Reasonrevision 4.4.0-CE-ubuntu24.04-r3: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #424 request_reason]
  • Supersedesreadystack/kafka:4.4.0-CE-ubuntu24.04-r2 (chain 683) [chains, chains #683]

The path through the harness

Fully recorded

1 chain · 5 drives · 18 stages · 4 rewinds

Chain 727 release · ready_to_ship

Created 2026-10-27T21:01:52Z, upstream 4.4.0, build request 424 [chains, chains #727]

DriveStartedMinutesBuild hostHow it stopped
4502026-10-27T21:02:25Z23.6build host 2 withhold-publish stage_failed at verdict [drive_runs, drive_runs #450] rebuilt from a build line's log
34862026-11-03T08:11:34Z23.5build host 2 withhold-publish stage_failed at verdict; first failed check scout_verdict:release_check_passed; 4 ticks [drive_runs, drive_runs #3486]
35322026-11-07T01:41:02Z40.1build host 2 withhold-publish ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #3532]
38052026-11-08T13:07:19Z7.2build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3805]
38472026-11-08T17:45:13Z—build host 2 publish-held not recorded [drive_runs, drive_runs #3847]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-27T21:02:32Z2026-10-27T21:02:33Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-27T21:02:43Z2026-10-27T21:02:43Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-27T21:03:15Z2026-10-27T21:03:16Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-27T21:14:33Z2026-11-07T01:52:50Z3
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile b685b468d848…
build_recipe 60a4ae5f6efe…
system_pinning 23adcc4de329…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health cdd32ad918df…
verify_offline_sh 3e8184ea230c…
base_image_digests 181de58ed499…
dockerfile_offline b685b468d848…
first_build_digest 6178d347c488…
remediate 2026-10-27T21:15:17Z2026-11-07T01:52:55Z3
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 8c17b7a3cb1c…
security_report a73421ae16ec…
build_kit 2026-10-27T21:24:12Z2026-11-07T02:02:41Z3
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp ad9a8181a080…
locked_digest 04fd20b29f15…
freeze_manifest eed611c348e1…
offline_rebuild_transcript bd59c3043b0c…
verdict 2026-10-27T21:26:00Z2026-11-07T02:04:05Z3
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 95e9ac78db41…
publish_image 2026-11-07T02:04:57Z2026-11-07T02:04:58Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 6992218cce0d…
promotion_record 993fdf20c330…
boot_instance 2026-11-07T02:05:11Z2026-11-07T02:05:15Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 90684ac2ae85…
sbom 2026-11-07T02:05:34Z2026-11-07T02:05:35Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 9623b1d15e81…
sbom_json fb6d759145aa…
schema_discovery 2026-11-07T02:05:37Z2026-11-07T02:05:38Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 6aa29381920b…
dependency_tree c1d0ae500ee9…
table_classification 4fe048881f6f…
admin_handbook 2026-11-07T02:06:10Z2026-11-07T02:06:10Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map d40df8495977…
admin_handbook 8d889edd71ff…
db_handbook 2026-11-07T02:06:43Z2026-11-07T02:06:43Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 19d33d370c90…
seed_isolation 1e130c1757ce…
seed_data 2026-11-07T02:07:18Z2026-11-07T02:07:19Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 952f22ca2eb5…
seed_cases_json 1558d28c1d5d…
seed_validate 2026-11-07T02:07:22Z2026-11-07T02:07:22Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 60f91a8273cb…
usecase_validate 2026-11-07T02:08:58Z2026-11-07T02:08:59Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 06cf3c640df4…
test_results d4bd52a497fd…
usecase_contract aa7feee737df…
finalize_docs 2026-11-07T02:09:15Z2026-11-07T02:09:16Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json fa04adfac2be…
release_notes c443ad548625…
api_integration_guide 5cd3922b14a9…
package_archive invalidated 2026-11-08T17:44:38Z 2026-11-07T02:21:06Z2026-11-08T13:14:29Z2
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar c3b8a90b350b…
checksums 62d67d93d16d…
verify_md f3be4a3d90b8…
rebuild_md 306e173b92a8…
manifest_txt cee0764b8a45…
actions_jsonl a0f1cc9d7c87…
provenance_md 25bba46f9492…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 815c4f8af942…

[stage_runs]

Rewinds

  • 2026-11-03T08:11:41Z: verdict to assemble_kit on strategy_changed (runtime base eclipse-temurin:25-jre-noble moved (sha256:ce8543ddd307… -> sha256:2ef7a81085e0…) (8a31ce21fc0b -> 8a31ce21fc0b)) [stage_events, stage_events #22403]
  • 2026-11-07T01:41:06Z: verdict to assemble_kit on strategy_changed (strategy changed (8a31ce21fc0b -> 9c1d61f3dee0)) [stage_events, stage_events #23029]
  • 2026-11-08T07:17:11Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #25387]
  • 2026-11-08T17:44:38Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26936]

Model work per stage

1 item not recorded

Role: writer model. Calls up to 2026-11-08T13:14:29Z.

5 calls over 3 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
finalize_docs1001 06494 —

[micro_step_runs]

  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $1.10 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-07T02:21:58Z 081 blocked to blocked [held_rounds, held_rounds #1417] $0.64 3 rounds, $40.00 76ec44c421c7…
22026-11-08T13:14:52Z 000 clean to publish [held_rounds, held_rounds #1512] $0.47 3 rounds, $40.00 c3b8a90b350b…

Defects

Fully recorded
  • Ledger entries7 [defects, defects where product_slug=kafka and this tag or chain]
  • Disclosed in the archive7 [docs/defects/defects.json, entries]

7 ledger entries: by severity high 6, low 1; by status open 1, fixed-before-release 6.

DefectSeverityStatusFound byFixed in
RSD-kafka-7400568400
Unauthenticated access by default [defects, defects #157961]		highopenbuild strategy record—
RSD-kafka-4958c65db7
API guide: Stale JDK version from the superseded build; this image sets JAVA_VERSION=jdk-25.0.5+8, and the guides contradict each other. [defects, defects #158021]		highfixed-before-releaseheld review (review model)—
RSD-kafka-34ec494ff5
Admin handbook: Stale JDK version from the superseded build; this image sets JAVA_VERSION=jdk-25.0.5+8, and the guides contradict each other. [defects, defects #158022]		highfixed-before-releaseheld review (review model)—
RSD-kafka-e9306bd7aa
Database handbook: Stale JDK version from the superseded build; this image sets JAVA_VERSION=jdk-25.0.5+8, and the guides contradict each other. [defects, defects #158023]		highfixed-before-releaseheld review (review model)—
RSD-kafka-0f58f7421b
API guide: The Configuration Reference names the superseded release r2 as the image the reader runs. [defects, defects #158024]		highfixed-before-releaseheld review (review model)—
RSD-kafka-a3e15dfdf4
Admin handbook: The section says upstream 'keeps data' in /etc/kafka/secrets and /mnt/shared/config and that they have 'no counterpart in this image', and tells the reader to move their contents with 'the product's… [defects, defects #158025]		highfixed-before-releaseheld review (review model)—
RSD-kafka-dbd6797a6f
Admin handbook: Table row reads as if this image has no counterpart for the secrets/config directories; they exist (owner 1000) and are used throughout the handbook. [defects, defects #158026]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:d40942c179cba3fe7a1dc963ebfd7da620b67bd98cf4c72177646c39dbedcf60 · published digest sha256:d40942c179cba3fe7a1dc963ebfd7da620b67bd98cf4c72177646c39dbedcf60 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 272) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T17:45:37Z · failing Docker Scout counts 91 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T17:45:24Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3758404356 · transparency-log entry · integrated 2026-11-08T17:51:35Z) [ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:f88e711b4a44b69eba2a0bb3feef0c55472963ffcd7d7d896eaadbe6eda0b2d4 · state attached · log index 3758407706 · transparency-log entry
    • kind sbom · digest sha256:f88e711b4a44b69eba2a0bb3feef0c55472963ffcd7d7d896eaadbe6eda0b2d4 · state attached · log index 3758408942 · transparency-log entry
    • kind vsa · digest sha256:f88e711b4a44b69eba2a0bb3feef0c55472963ffcd7d7d896eaadbe6eda0b2d4 · state attached · log index 3758409907 · transparency-log entry
    • kind provenance · digest sha256:d40942c179cba3fe7a1dc963ebfd7da620b67bd98cf4c72177646c39dbedcf60 · state attached · log index 3758410580 · transparency-log entry
    • kind sbom · digest sha256:d40942c179cba3fe7a1dc963ebfd7da620b67bd98cf4c72177646c39dbedcf60 · state attached · log index 3758411686 · transparency-log entry
    • kind vsa · digest sha256:d40942c179cba3fe7a1dc963ebfd7da620b67bd98cf4c72177646c39dbedcf60 · state attached · log index 3758412624 · transparency-log entry
    (at 2026-11-08T17:51:35Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/kafka/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-07T02:22:05Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:d40942c179cba3fe7a1dc963ebfd7da620b67bd98cf4c72177646c39dbedcf60 [clean-room rebuild ledger, runs[594]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-07T02:04:58Z [stage_runs, stage_runs chain 727 stage publish_image]
  • Archive manifests written2026-11-08T17:48:38Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 792 · probed 2026-11-07T01:57:54Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-08T17:53:12Z generated: by KitForge release/build_trail.py · generator commit 7c6b61ce76feba4df822395cea465de0973154b4
  • 2026-11-08T17:55:01Z publication: promoted at 2026-11-08T17:53:49Z · promoted digest sha256:f88e711b4a44b69eba2a0bb3feef0c55472963ffcd7d7d896eaadbe6eda0b2d4 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 382 · checklist status complete · checklist at 2026-11-08T17:55:01Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

24 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/kafka/4.4.0-CE-ubuntu24.04-r3/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/kafka/4.4.0-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.rebuild.jsonbeside the archive (prodasset /data/production/kafka/4.4.0-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-kafka-4.4.0-CE-ubuntu24.04-r3.rebuild.json.sigstorebeside the archive (prodasset /data/production/kafka/4.4.0-CE-ubuntu24.04-r3/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/kafka/4.4.0-CE-ubuntu24.04-r3/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)424
chainssadb, ReadyStack's engine database (not published)727
defectssadb, ReadyStack's engine database (not published)kafka 4.4.0-CE-ubuntu24.04-r3
drive_runssadb, ReadyStack's engine database (not published)chain 727
held_roundssadb, ReadyStack's engine database (not published)chain 727
micro_step_runssadb, ReadyStack's engine database (not published)chain 727
release_imagessadb, ReadyStack's engine database (not published)kafka 4.4.0-CE-ubuntu24.04-r3
stage_eventssadb, ReadyStack's engine database (not published)chain 727
stage_runssadb, ReadyStack's engine database (not published)chain 727
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—