Keycloak 26.8.2-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/keycloak:26.8.2-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/keycloak:26.8.2-CE-ubuntu24.04-r2
  • Index digestsha256:18fc73e7ed57158304213adb89fe5b9cd3f8fa2668890da5f99572e7fe53c56e
  • linux/amd64 digestsha256:a119df11a7d54db963e5009c309638c897af5ed629b993f3f6340ec56ab6ff59
  • ArchiveReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now17ded5f8fea3e9622e2a302b40e34023bdae5112e0fad17cb8a28fe45c6d2c6f
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T19:43:40Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.trail.json
ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.trail.jsonReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.trail.mdKeycloak product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductKeycloak (keycloak) [MANIFEST.json]
  • Release tag26.8.2-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/keycloak:26.8.2-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:18fc73e7ed57158304213adb89fe5b9cd3f8fa2668890da5f99572e7fe53c56e [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:a119df11a7d54db963e5009c309638c897af5ed629b993f3f6340ec56ab6ff59 [ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.tar.gz (bytes 2545455082) [MANIFEST.json]
  • Archive sha256 at publish17ded5f8fea3e9622e2a302b40e34023bdae5112e0fad17cb8a28fe45c6d2c6f [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/keycloak/keycloak [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref26.8.2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commite514445f9dcdabc5bdcf67cab56c1e49655de067 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash5dd18d89b866300380e8063e8d776b341a341f81c6b9ca3e3f30ce4313139a78 (files 13524) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:82532027708f9cf9c96fcfe743a0547923250298c0ffe49226a3f9038fe5f857 [ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793892444 (utc 2026-11-05T15:27:24Z) [ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref eclipse-temurin:21-jre-noble@sha256:161310cd5bd41fd549d19cf9f90b614897cb4a1532555c613b43b7e0628fe5d6 · platform digest sha256:db724162e4ff5f71fa0a2815026314d9e5e0e9a139f49be1d4717e6930e93341
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref maven:3.9.8-eclipse-temurin-21@sha256:de18e4e51396ad9266f76669779ed6d6b49fbb0f45ed6f39169d87378d548d7d · platform digest sha256:6847cbbf21e159f97819f18336cf6bbc24a89f9eb6439317520d93f904e9a916
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit f9ca2688eec26b7aba26a7b4d01ef8cffbb8d76d · dirty yes · first drive 3974
    • commit 58dc3a08facd9f932ad6b50ee1bc4c0fc009e696 · dirty yes · first drive 4005
    • commit fdc352235a15db6b6b5459f848431065ad578721 · dirty yes · first drive 4051
    • commit 762b14205276731d25047ecbc7e53d9425b5b471 · dirty yes · first drive 4070
    • commit 12b2b288aa48f48d3d1572934777edf0602849d6 · dirty yes · first drive 4082
    • commit 4e069b7fdf7791b93f45d55244181834e57cd2b8 · dirty yes · first drive 4092
    • commit 7fc9ad6b7dac22709514b511bc5b2ad1d762fb69 · dirty yes · first drive 4102
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain910 (created 2026-11-09T06:41:15Z · trigger customer_request · upstream version 26.8.2) [chains, chains #910]
  • Requestbuild request #556 (rebuild) (requested at 2026-11-08T05:00:40Z · requested by kitforge-agent · version 26.8.2) [build_requests, build_requests #556]
  • Reasonrevision 26.8.2-CE-ubuntu24.04-r2: same upstream version rebuilt on the chiselled runtime (slim base, #206) [build_requests, build_requests #556 request_reason]
  • Supersedesreadystack/keycloak:26.8.2-CE-ubuntu24.04-r1 (chain 822) [chains, chains #822]

The path through the harness

Fully recorded

1 chain · 7 drives · 18 stages · 3 rewinds

Chain 910 release · ready_to_ship

Created 2026-11-09T06:41:15Z, upstream 26.8.2, build request 556 [chains, chains #910]

DriveStartedMinutesBuild hostHow it stopped
39742026-11-09T06:42:21Z60.9build host 4 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3974]
40052026-11-09T11:37:59Z1.5build host 4 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #4005]
40512026-11-09T15:10:20Z2.2build host 4 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #4051]
40702026-11-09T16:16:36Z19.5build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4070]
40822026-11-09T17:49:35Z11.8build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4082]
40922026-11-09T18:37:38Z11.9build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4092]
41022026-11-09T19:28:56Z—build host 4 publish-held not recorded [drive_runs, drive_runs #4102]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-09T06:42:32Z2026-11-09T06:42:33Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 6fafcb8a245e…
acquire 2026-11-09T06:42:44Z2026-11-09T06:42:46Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 7fe47cd54964…
license_file cfc7749b96f6…
custody_inputs 5ea1bc70b7c9…
source_tree_hash 7f6afb85f068…
source_file_manifest dfeac2d3858b…
plan 2026-11-09T06:43:59Z2026-11-09T06:44:00Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report e3701c487b04…
input_pin_plan c3eef3bfd10c…
toolchain_lock dda2a2b64c17…
assemble_kit 2026-11-09T07:00:46Z2026-11-09T07:00:47Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 7034f201a2c2…
build_recipe a60d512cd38b…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 766cf58ecbf2…
verify_offline_sh 3e8184ea230c…
base_image_digests d8333cbb49c2…
dockerfile_offline 7034f201a2c2…
first_build_digest c3a42ad013f1…
remediate 2026-11-09T07:01:37Z2026-11-09T07:01:38Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log fc644a52bb86…
security_report ed7c2edac804…
build_kit 2026-11-09T07:13:46Z2026-11-09T07:13:47Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp bc5192c00f92…
locked_digest 5aec8d0e1c2e…
freeze_manifest 462f50336cef…
offline_rebuild_transcript 2081b7a930b2…
verdict 2026-11-09T07:15:01Z2026-11-09T07:15:02Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 55abb22c5f2e…
publish_image 2026-11-09T07:15:54Z2026-11-09T07:15:55Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme c20ce365688c…
promotion_record d19778501021…
boot_instance 2026-11-09T07:16:42Z2026-11-09T07:16:48Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 7825d59a9d76…
sbom 2026-11-09T07:17:11Z2026-11-09T07:17:12Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md a2bda60d87a4…
sbom_json 86849d78377b…
schema_discovery 2026-11-09T07:17:14Z2026-11-09T07:17:15Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash eeb3d6b3b4fa…
dependency_tree 09b63ba164a9…
table_classification 5d9d661dcc1b…
admin_handbook 2026-11-09T07:25:04Z2026-11-09T07:25:05Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 781d0d05b3cb…
admin_handbook 0aca69d2d174…
db_handbook 2026-11-09T07:37:16Z2026-11-09T07:37:17Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 7d6daee88d64…
seed_isolation 53ce2b5dc035…
seed_data 2026-11-09T07:37:25Z2026-11-09T07:37:26Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql efab968dd7ac…
seed_cases_json 5b0d272a7542…
seed_validate 2026-11-09T07:37:29Z2026-11-09T07:37:30Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract fcff39c03a2b…
usecase_validate 2026-11-09T07:37:50Z2026-11-09T07:37:51Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 9fe50335a5f5…
test_results eed6836dd743…
usecase_contract 618d0e9733a9…
finalize_docs 2026-11-09T07:37:59Z2026-11-09T07:38:00Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json fcb2d4db40dc…
release_notes 3d40388091f9…
api_integration_guide fe918dc0f698…
package_archive invalidated 2026-11-09T19:28:31Z 2026-11-09T07:43:15Z2026-11-09T18:49:33Z6
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar bc1793ad82c9…
checksums 21a4ab3cbbfd…
verify_md 5a0ffeb5075a…
rebuild_md fd8bc1b2e97b…
manifest_txt c6eaf5cb8dfb…
actions_jsonl 2684088d6d83…
provenance_md f03140d2ae08…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json dc5adf38f1ac…

[stage_runs]

Rewinds

  • 2026-11-09T17:21:11Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29484]
  • 2026-11-09T18:36:31Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29578]
  • 2026-11-09T19:28:31Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29691]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T18:49:33Z.

129 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 022101 L-A183, L-A15
remediate2001 020205 L-A183, L-A15
admin_handbook642503 11559074 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook601903 5508375 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate1001 01815 L-A59

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $6.01 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T16:37:08Z 82119 findings to repackage [held_rounds, held_rounds #1653] $3.12 3 rounds, $40.00 feadc2fcbc01…
22026-11-09T18:02:13Z 0314 findings to repackage [held_rounds, held_rounds #1657] $2.11 3 rounds, $40.00 f3eb321c81b0…
32026-11-09T18:50:15Z 002 clean to publish [held_rounds, held_rounds #1665] $0.78 3 rounds, $40.00 bc1793ad82c9…

Defects

Fully recorded
  • Ledger entries60 [defects, defects where product_slug=keycloak and this tag or chain]
  • Disclosed in the archive60 [docs/defects/defects.json, entries]

60 ledger entries: by severity critical 3, high 24, low 33; by status fixed-before-release 60.

DefectSeverityStatusFound byFixed in
RSD-keycloak-9ce8a326bd
Admin handbook: The documented PostgreSQL setup leaves the keycloak role unable to create tables in the public schema (PostgreSQL 15+, including the tested 16), so the first start of the documented run command… [defects, defects #220575]		criticalfixed-before-releaseheld review (review model)—
RSD-keycloak-432c8b6dc2
Admin handbook: The restore drops the database and then fails to recreate it when the keycloak role is the limited role the handbook's own PostgreSQL Setup creates (no CREATEDB): the customer is left with no… [defects, defects #220576]		criticalfixed-before-releaseheld review (review model)—
RSD-keycloak-cc0950a1c0
Admin handbook: The documented derived-image Dockerfile fails to build: the chiselled image has no chown, so the step exits 127; the 'tested' statement does not hold for this image. [defects, defects #220577]		criticalfixed-before-releaseheld review (review model)—
RSD-keycloak-1188755346
Admin handbook: The documented one-off bootstrap-admin command has no --username/--password:env, so without a console it fails and creates no administrator. [defects, defects #220578]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-9dddd50332
Database handbook: KC_DB_URL_HOST with a :port suffix does not connect, so the documented way to use a non-standard port fails. [defects, defects #220579]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-a71cd3bb1d
Admin handbook: The documented service-account procedure yields a token that the 26.8.2 Admin REST API rejects (HTTP 401) because the new client lacks the kc-admin-api client scope; the step that fixes it appears… [defects, defects #220580]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-878d6a6799
Database handbook: The documented service-account procedure yields a token that the 26.8.2 Admin REST API rejects (HTTP 401) because the new client lacks the kc-admin-api client scope; the step that fixes it appears… [defects, defects #220581]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-52dcbfbd40
Database handbook: The documented service-account procedure yields a token that the 26.8.2 Admin REST API rejects (HTTP 401) because the new client lacks the kc-admin-api client scope; the step that fixes it appears… [defects, defects #220582]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-fdc09f49c8
Database handbook: The documented service-account procedure yields a token that the 26.8.2 Admin REST API rejects (HTTP 401) because the new client lacks the kc-admin-api client scope; the step that fixes it appears… [defects, defects #220583]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-3eebafea1e
Database handbook: The documented service-account procedure yields a token that the 26.8.2 Admin REST API rejects (HTTP 401) because the new client lacks the kc-admin-api client scope; the step that fixes it appears… [defects, defects #220584]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-4d62ad32df
Database handbook: POST /admin/realms/<realm>/components creates realm components (key providers and the like), not client-scope assignments; the programmatic route given is wrong. [defects, defects #220585]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-e8f49fbf9a
Database handbook: --hostname is the public URL Keycloak puts in tokens and discovery documents, not a per-node cluster name; per-node values make the issuer differ between members, and the admin handbook's own… [defects, defects #220586]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-8351969bf2
Database handbook: The documented reachability check always fails: /dev/tcp is a bash feature and the image's /bin/sh is dash, so the check reports 'cannot reach PostgreSQL' even when it can. [defects, defects #220587]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-4084fe8f45
Admin handbook: States the reproduction host as 4 CPUs / 7.8 GB (in places a minimum of 7.8 / 8 GB), which no record shows; the record is an 8-CPU, 23.5 GB host, so the stated figures and minimum are unsupported… [defects, defects #220588]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-8bc3ff1faf
Admin handbook: States the reproduction host as 4 CPUs / 7.8 GB (in places a minimum of 7.8 / 8 GB), which no record shows; the record is an 8-CPU, 23.5 GB host, so the stated figures and minimum are unsupported… [defects, defects #220589]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-21694a0c2f
Admin handbook: States the reproduction host as 4 CPUs / 7.8 GB (in places a minimum of 7.8 / 8 GB), which no record shows; the record is an 8-CPU, 23.5 GB host, so the stated figures and minimum are unsupported… [defects, defects #220590]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-349c744383
Database handbook: States the reproduction host as 4 CPUs / 7.8 GB (in places a minimum of 7.8 / 8 GB), which no record shows; the record is an 8-CPU, 23.5 GB host, so the stated figures and minimum are unsupported… [defects, defects #220591]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-00607745c1
Database handbook: States the reproduction host as 4 CPUs / 7.8 GB (in places a minimum of 7.8 / 8 GB), which no record shows; the record is an 8-CPU, 23.5 GB host, so the stated figures and minimum are unsupported… [defects, defects #220592]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-d8f9790641
Database handbook: States the reproduction host as 4 CPUs / 7.8 GB (in places a minimum of 7.8 / 8 GB), which no record shows; the record is an 8-CPU, 23.5 GB host, so the stated figures and minimum are unsupported… [defects, defects #220593]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-03829dc243
Database handbook: States the reproduction host as 4 CPUs / 7.8 GB (in places a minimum of 7.8 / 8 GB), which no record shows; the record is an 8-CPU, 23.5 GB host, so the stated figures and minimum are unsupported… [defects, defects #220594]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-b184023754
Admin handbook: False statement of the image's base; the release notes, PROVENANCE and the Dockerfile say it has no base image (FROM scratch). [defects, defects #220595]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-e7a2187e7a
Database handbook: False statement of the image's base; contradicts the release notes and PROVENANCE ('none (FROM scratch)'). [defects, defects #220596]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-452f464fea
Admin handbook: False licence statement: contradicted by the next paragraph (JRE under EPL-2.0 / GPL-2.0 with Classpath Exception) and by IMAGE_EVIDENCE.json scout copyleft-license (13 operating-system packages… [defects, defects #220597]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-f65e877e45
Admin handbook: Wrong statement about a credential: removing the variables does not disable the temporary account, and the Administrator account section and the other copies of this procedure say it keeps its… [defects, defects #220598]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-bb34524376
Admin handbook: Not every variable in the list is a build-time option: LANG, JAVA_HOME and KC_RUN_IN_CONTAINER are plain environment and KC_HTTP_ENABLED is a runtime option that -e does change; only KC_DB,… [defects, defects #220599]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-9d2cd39345
Admin handbook: Not every variable in the list is a build-time option: LANG, JAVA_HOME and KC_RUN_IN_CONTAINER are plain environment and KC_HTTP_ENABLED is a runtime option that -e does change; only KC_DB,… [defects, defects #220600]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-516bb27413
Database handbook: Not every variable in the list is a build-time option: LANG, JAVA_HOME and KC_RUN_IN_CONTAINER are plain environment and KC_HTTP_ENABLED is a runtime option that -e does change; only KC_DB,… [defects, defects #220601]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-f83ceb9491
Admin handbook: Not every variable in the list is a build-time option: LANG, JAVA_HOME and KC_RUN_IN_CONTAINER are plain environment and KC_HTTP_ENABLED is a runtime option that -e does change; only KC_DB,… [defects, defects #220602]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-a19bd2125f
Admin handbook: Wrong cause for the warning: it is logged at start when --proxy-headers is missing, not per direct request; it contradicts the Operating facts. [defects, defects #220603]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-04e5d6a1bd
Admin handbook: The list under 'served on port 8080' includes /health, /health/live, /health/ready, /health/started and /metrics, which answer 404 on 8080 (the next paragraph says so). [defects, defects #220604]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-51429d1469
API guide: The Routes table lists /health, /health/live, /health/ready, /health/started and /metrics under the 8080 base URL, but they return 404 on 8080 and are served on 9000. [defects, defects #220605]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-bb9cf6b7a7
Database handbook: A token without the kc-admin-api scope is rejected with 401 on this release, not 403. [defects, defects #220606]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-bcd1911b55
Database handbook: A token without the kc-admin-api scope is rejected with 401 on this release, not 403. [defects, defects #220607]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-1f4028512e
Database handbook: A docker --env-file line ends at the newline, so a newline cannot be part of a password in keycloak.env. [defects, defects #220608]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-3cce4c9883
Database handbook: Garbled and wrong: an unhealthy container keeps running; the same handbook says Docker does not stop or restart it. [defects, defects #220609]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-ff393c8fc8
Database handbook: Only a missing start command prints usage; a missing database setting or hostname gives other errors, and a missing --proxy-headers does not stop the start at all. [defects, defects #220610]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-598d4d6629
Database handbook: Contradicts the same handbook's later copy of this procedure ('Manage > Users'); users are not under Realm settings. [defects, defects #220611]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-cdf571a2f2
Database handbook: The next sentence says to stop the running Keycloak container first, and the Admin recovery fact says the same; this sentence contradicts them. [defects, defects #220612]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-7e7a6cc185
Database handbook: With Docker's default json-file logging driver a removed container's logs are gone. [defects, defects #220613]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-a460c3e273
Database handbook: Typo: 9000 is listed as 8443. [defects, defects #220614]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-2022c032b1
Database handbook: Contradicts the documented run command, which publishes -p 9000:9000 on all host addresses, so the endpoints are reachable from outside the container network; the next sentence then tells the… [defects, defects #220615]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-c6c9aea46b
Database handbook: Startup does not fail: the container keeps running and is only marked unhealthy, as the rest of the handbooks say. [defects, defects #220616]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-ab15275da2
Admin handbook: Without -it the shell gets no terminal and no stdin, so the command exits at once and no shell opens (the Running Additional Programs section uses -it). [defects, defects #220617]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-7c8b2e9708
Database handbook: The rewritten 'non-standard port' instruction tells the customer to repeat KC_DB_URL_HOST, which sets no port, so Keycloak still connects to 5432 and fails; the documented way to use a non-standard… [defects, defects #221641]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-063ed6362c
Database handbook: Tells the customer to add an ownership-fix step to the derived image; the chiselled image has no chown (a RUN chown exits 127 and the build fails), and the step is unnecessary: the same handbook's… [defects, defects #221642]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-deb716be1d
Admin handbook: Says the whole image and its contents may be used and distributed under Apache-2.0, which contradicts the previous paragraph and the Scout copyleft finding (the round-1 false licence statement,… [defects, defects #221643]		highfixed-before-releaseheld review (review model)—
RSD-keycloak-9ca62df48d
Admin handbook: Without -it the shell gets no terminal and no stdin and exits at once (round-1 minor, still present). [defects, defects #221644]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-e3f634c9e4
Admin handbook: The documented identity check fails with an error; the ps format must include pid. [defects, defects #221645]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-5e704696a4
Admin handbook: A start with the database unreachable does not leave a container answering 503; it exits, as the Database Connection Troubleshooting section says. [defects, defects #221646]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-fe0c322173
Admin handbook: Implies only localhost may read the health and metrics endpoints; they answer every client that reaches the published port. [defects, defects #221647]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-e4f01d8aa9
Admin handbook: Calls the plain-HTTP setting fixed in the image; it is a runtime option that an -e value changes, as line 972 says. [defects, defects #221648]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-b31976959f
Admin handbook: Contradicts the documented run command, which publishes 9000 on all host addresses (round-1 minor, still present here). [defects, defects #221649]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-3adaeee1dd
Admin handbook: Says kc.sh does not read other arguments, which the handbook's own recovery command contradicts. [defects, defects #221650]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-a81fd29c23
Admin handbook: Suggests the temporary account stops working once a permanent one exists; it stays a live administrator until deleted. [defects, defects #221651]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-69d3fb0e2c
Database handbook: Tells the customer to add -p 9000:9000, which the documented run command already has (round-1 minor, second half still present). [defects, defects #221652]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-90b6ade27b
Database handbook: <client-id> reads as the client's clientId, which answers 404; the path takes the internal UUID. [defects, defects #221653]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-bd3a9e526e
Database handbook: Lists --hostname among the docker run options; it belongs after the image name. [defects, defects #221654]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-26829ff943
Database handbook: Combines --network host with -p; the mappings are discarded in host network mode. [defects, defects #221655]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-f81ea83e18
Database handbook: Says verification confirms the PostgreSQL requirement; it only compares digests and skips the boot check. [defects, defects #221656]		lowfixed-before-releaseheld review (review model)—
RSD-keycloak-802f102af2
Admin handbook: Restore step names a role (postgres) that does not exist in the paragraph's own example container; the documented createdb fails after dropdb has already run. [defects, defects #223257]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:a119df11a7d54db963e5009c309638c897af5ed629b993f3f6340ec56ab6ff59 · published digest sha256:a119df11a7d54db963e5009c309638c897af5ed629b993f3f6340ec56ab6ff59 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 341) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T19:29:25Z · failing Docker Scout counts 13 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T19:29:07Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3768987442 · transparency-log entry · integrated 2026-11-09T19:40:48Z) [ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:18fc73e7ed57158304213adb89fe5b9cd3f8fa2668890da5f99572e7fe53c56e · state attached · log index 3768998078 · transparency-log entry
    • kind sbom · digest sha256:18fc73e7ed57158304213adb89fe5b9cd3f8fa2668890da5f99572e7fe53c56e · state attached · log index 3768999619 · transparency-log entry
    • kind vsa · digest sha256:18fc73e7ed57158304213adb89fe5b9cd3f8fa2668890da5f99572e7fe53c56e · state attached · log index 3769001283 · transparency-log entry
    • kind provenance · digest sha256:a119df11a7d54db963e5009c309638c897af5ed629b993f3f6340ec56ab6ff59 · state attached · log index 3769002814 · transparency-log entry
    • kind sbom · digest sha256:a119df11a7d54db963e5009c309638c897af5ed629b993f3f6340ec56ab6ff59 · state attached · log index 3769004081 · transparency-log entry
    • kind vsa · digest sha256:a119df11a7d54db963e5009c309638c897af5ed629b993f3f6340ec56ab6ff59 · state attached · log index 3769005381 · transparency-log entry
    (at 2026-11-09T19:40:49Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/keycloak/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T16:37:22Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:a119df11a7d54db963e5009c309638c897af5ed629b993f3f6340ec56ab6ff59 [clean-room rebuild ledger, runs[709]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-09T07:15:55Z [stage_runs, stage_runs chain 910 stage publish_image]
  • Archive manifests written2026-11-09T19:36:01Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 109 · probed 2026-11-09T16:27:55Z · source g8) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T19:43:40Z generated: by KitForge release/build_trail.py · generator commit 6c084534f784f7171ae351892e74c39b28d639ce
  • 2026-11-09T19:46:58Z publication: promoted at 2026-11-09T19:44:46Z · promoted digest sha256:18fc73e7ed57158304213adb89fe5b9cd3f8fa2668890da5f99572e7fe53c56e · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 433 · checklist status complete · checklist at 2026-11-09T19:46:58Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/keycloak/26.8.2-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/keycloak/26.8.2-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/keycloak/26.8.2-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-keycloak-26.8.2-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/keycloak/26.8.2-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/keycloak/26.8.2-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)556
chainssadb, ReadyStack's engine database (not published)910
defectssadb, ReadyStack's engine database (not published)keycloak 26.8.2-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 910
held_roundssadb, ReadyStack's engine database (not published)chain 910
lesson_recallssadb, ReadyStack's engine database (not published)chain 910
micro_step_runssadb, ReadyStack's engine database (not published)chain 910
release_imagessadb, ReadyStack's engine database (not published)keycloak 26.8.2-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 910
stage_runssadb, ReadyStack's engine database (not published)chain 910
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—