kube-controller-manager v1.36.6-CE-ubuntu24.04-r4 build trail
How ReadyStack built readystack/kubecontrollermanager:v1.36.6-CE-ubuntu24.04-r4 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/kubecontrollermanager:v1.36.6-CE-ubuntu24.04-r4 - Index digestsha256:d74e3c70ef0bcb4f20a606023da8408fe63f5711ba8fdffa7c74225a23963645
- linux/amd64 digestsha256:a4f215770f8547b1c34ec3466fdabc16ac26f1f23a63485dbce1cba6d9fd343f
- Archive
ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.tar.gz - Archive SHA-256 now9cde074c7f81ebc1b322a1d76473bf91a36bcb4d63cfebf32afb69817176129b
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-13T17:13:04Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.trail.json.sigstore ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- Productkube-controller-manager (kubecontrollermanager) [MANIFEST.json]
- Release tagv1.36.6-CE-ubuntu24.04-r4 [MANIFEST.json]
- Imagereadystack/kubecontrollermanager:v1.36.6-CE-ubuntu24.04-r4 [MANIFEST.json]
- Image index digestsha256:d74e3c70ef0bcb4f20a606023da8408fe63f5711ba8fdffa7c74225a23963645 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:a4f215770f8547b1c34ec3466fdabc16ac26f1f23a63485dbce1cba6d9fd343f [ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.tar.gz (bytes 527057132) [MANIFEST.json]
- Archive sha256 at publish9cde074c7f81ebc1b322a1d76473bf91a36bcb4d63cfebf32afb69817176129b [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/kubernetes/kubernetes [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv1.36.6 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit1b2171b110bb2a2542e1322035c6583ec86eb976 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash803692e6a7661d2d72c4cdf0a2a2459bdf6646e2b6c955ed7362f279ee4fa004 (files 29206) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:a5cf5e3c779f7592d8164bc96f0c984a9d984baedbffc6f1552214a862ad6b89 [ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794578569 (utc 2026-11-13T14:02:49Z) [ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.26.11-bookworm@sha256:dc40a13b61304647ed7e5d581d246b86413dfc29d63c6d018310feb93cd98fc0 · platform digest sha256:79ecd0a7157c7a4cf3b281ced8465350591bf54fedab540e75374a003e1fde7e
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.rebuild.json, engine]
- Engine commit(s)
- commit f264c5a93fc5fe548e62fe3bfbeb279b813432b8 · dirty yes · first drive 4607
- commit 073535c62a45bea8f3f14b90d7062837d7d2da35 · dirty yes · first drive 4614
- commit 1252a76ccb9fe0963d2efc0d07028de8176a15fe · dirty yes · first drive 4623
Why this release exists
Fully recorded- Chain1086 (created 2026-11-13T15:26:59Z · trigger customer_request · upstream version v1.36.6) [chains, chains #1086]
- Requestbuild request #761 (rebuild) (requested at 2026-11-13T14:02:51Z · requested by kitforge-agent · version v1.36.6) [build_requests, build_requests #761]
- Reasonrerelease agenda REVISION -> v1.36.6-CE-ubuntu24.04-r4 (decay loop, IMP-08) [build_requests, build_requests #761 request_reason]
- Supersedesreadystack/kubecontrollermanager:v1.36.6-CE-ubuntu24.04-r3 (chain 1017) [chains, chains #1017]
The path through the harness
Fully recorded1 chain · 3 drives · 18 stages · 1 rewind
Chain 1086 release · ready_to_ship
Created 2026-11-13T15:26:59Z, upstream v1.36.6, build request 761 [chains, chains #1086]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4607 | 2026-11-13T15:27:33Z | 25.4 | build host 4 withhold-publish | infra_hub_rate_limit at package_archive; 18 ticks [drive_runs, drive_runs #4607] |
| 4614 | 2026-11-13T16:10:37Z | 4.2 | build host 4 withhold-publish | ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4614] |
| 4623 | 2026-11-13T17:06:19Z | — | build host 4 publish-held | not recorded [drive_runs, drive_runs #4623] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-13T15:27:43Z | 2026-11-13T15:27:44Z | 1 | 4
|
order_json 3ffc950030da… |
acquire |
2026-11-13T15:27:57Z | 2026-11-13T15:28:01Z | 1 | 12
|
source_tree 96b79f03cd5d…license_file cfc7749b96f6…custody_inputs 19898ae42a12…source_tree_hash 6e4d6eb3dbc8…source_file_manifest b4e6f454c420… |
plan |
2026-11-13T15:28:53Z | 2026-11-13T15:28:53Z | 1 | 10
|
recon_report f098567c27d3…input_pin_plan 3dcd1216fb9f…toolchain_lock 76b90a0df9c8… |
assemble_kit |
2026-11-13T15:34:58Z | 2026-11-13T15:34:59Z | 1 | 27
|
dockerfile 5fec97425e1d…build_recipe 10a1172602c7…system_pinning 0630392bbd9f…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health 6a3192e3c11a…verify_offline_sh 3e8184ea230c…base_image_digests 298003543fb3…dockerfile_offline 5fec97425e1d…first_build_digest 5e8c9fb992d5… |
remediate |
2026-11-13T15:35:54Z | 2026-11-13T15:35:55Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 737e488ddb89…security_report 47436787b355… |
build_kit |
2026-11-13T15:42:04Z | 2026-11-13T15:42:05Z | 1 | 9
|
cosign_stamp dc063b01781c…locked_digest e3498a020b5a…freeze_manifest a6dac5a46fea…offline_rebuild_transcript b4f8e5f13a15… |
verdict |
2026-11-13T15:42:52Z | 2026-11-13T15:42:53Z | 1 | 8
|
scout_verdict 0504cc810e35… |
publish_image |
2026-11-13T15:43:35Z | 2026-11-13T15:43:35Z | 1 | 7
|
hub_readme 895b950bce64…promotion_record 590e4e3752aa… |
boot_instance |
2026-11-13T15:43:38Z | 2026-11-13T15:43:39Z | 1 | 3
|
instance_handle 4a217348c7d5… |
sbom |
2026-11-13T15:43:50Z | 2026-11-13T15:43:51Z | 1 | 5
|
sbom_md 81bfe4328972…sbom_json 319d2ed3fd82… |
schema_discovery |
2026-11-13T15:43:53Z | 2026-11-13T15:43:54Z | 1 | 7
|
schema_hash 5ccd3d9b6527…dependency_tree 7e9fe474da8f…table_classification a7af6d3ccd48… |
admin_handbook |
2026-11-13T15:43:56Z | 2026-11-13T15:43:57Z | 1 | 7
|
api_map 46945a905687…admin_handbook cbbbcc77d9f9… |
db_handbook |
2026-11-13T15:44:00Z | 2026-11-13T15:44:01Z | 1 | 8
|
db_handbook 4838410a853c…seed_isolation b223d0880bab… |
seed_data |
2026-11-13T15:44:03Z | 2026-11-13T15:44:04Z | 1 | 6
|
seed_data_sql 6d5e5772342b…seed_cases_json 3a1562fa9bee… |
seed_validate |
2026-11-13T15:44:06Z | 2026-11-13T15:44:08Z | 1 | 3
|
seed_data_contract 5dcfcaa4c88f… |
usecase_validate |
2026-11-13T15:44:10Z | 2026-11-13T15:44:11Z | 1 | 10
|
failed_tests 8121d2971f2a…passed_tests 4c2e7cb83309…test_results 96f51e6a9a97…usecase_contract 6fee6e8c7e20… |
finalize_docs |
2026-11-13T15:44:15Z | 2026-11-13T15:44:16Z | 1 | 9
|
defects_json e49bb1ad14b0…release_notes f89948bd1b58…api_integration_guide 34892c334edf… |
package_archive invalidated 2026-11-13T17:05:44Z |
2026-11-13T16:14:45Z | 2026-11-13T16:14:47Z | 1 | 37 (final gate PASS)
|
sale_tar e66bbf874fa1…checksums f96a758c4fe4…verify_md cca7f008985c…rebuild_md 89e478dc026d…manifest_txt 833b607c2252…actions_jsonl 104959233488…provenance_md 70acadae35c6…assetchain_log_md e9eccaec0c0f…assetchain_log_json df7a4879f994… |
[stage_runs]
Rewinds
- 2026-11-13T17:05:44Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36803]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-13T16:14:47Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 14565 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 16607 | L-A183, L-A15 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.30 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-13T16:15:15Z | 0 | 0 | 1 | clean to publish [held_rounds, held_rounds #1896] | $0.30 | 3 rounds, $40.00 | e66bbf874fa1… |
Defects
Fully recorded- Ledger entries3 [defects, defects where product_slug=kubecontrollermanager and this tag or chain]
- Disclosed in the archive3 [docs/defects/defects.json, entries]
3 ledger entries: by severity low 3; by status fixed-before-release 1, open 2.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-kubecontrollermanager-e1b0c1c0cbAdmin handbook: Sentence contradicts the release notes' recorded comparison. [defects, defects #285959] | low | fixed-before-release | held review (review model) | — |
RSD-kubecontrollermanager-796d204fa1Admin handbook: Handbook says no comparison of the two images is recorded, but the release notes record one (wording only; no customer action affected). [defects, defects #285960] | low | open | held review (review model) | — |
RSD-kubecontrollermanager-db4f77f513Admin handbook: Handbook says no comparison is recorded; release notes record one. [defects, defects #286174] | low | open | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:a4f215770f8547b1c34ec3466fdabc16ac26f1f23a63485dbce1cba6d9fd343f · published digest sha256:a4f215770f8547b1c34ec3466fdabc16ac26f1f23a63485dbce1cba6d9fd343f · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 175) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T17:06:40Z · failing Docker Scout counts 83 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T17:06:30Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3857157666 · transparency-log entry
- log index 3857160104 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3858600897 · transparency-log entry · integrated 2026-11-13T17:11:08Z) [ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:d74e3c70ef0bcb4f20a606023da8408fe63f5711ba8fdffa7c74225a23963645 · state attached · log index 3858606624 · transparency-log entry
- kind sbom · digest sha256:d74e3c70ef0bcb4f20a606023da8408fe63f5711ba8fdffa7c74225a23963645 · state attached · log index 3858608431 · transparency-log entry
- kind vsa · digest sha256:d74e3c70ef0bcb4f20a606023da8408fe63f5711ba8fdffa7c74225a23963645 · state attached · log index 3858611999 · transparency-log entry
- kind provenance · digest sha256:a4f215770f8547b1c34ec3466fdabc16ac26f1f23a63485dbce1cba6d9fd343f · state attached · log index 3858613919 · transparency-log entry
- kind sbom · digest sha256:a4f215770f8547b1c34ec3466fdabc16ac26f1f23a63485dbce1cba6d9fd343f · state attached · log index 3858615799 · transparency-log entry
- kind vsa · digest sha256:a4f215770f8547b1c34ec3466fdabc16ac26f1f23a63485dbce1cba6d9fd343f · state attached · log index 3858617839 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/kubecontrollermanager/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-13T16:15:19Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:a4f215770f8547b1c34ec3466fdabc16ac26f1f23a63485dbce1cba6d9fd343f [clean-room rebuild ledger, runs[844]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-13T15:43:35Z [stage_runs, stage_runs chain 1086 stage publish_image]
- Archive manifests written2026-11-13T17:08:51Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 726 · probed 2026-11-13T15:38:54Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-13T17:13:04Z generated: by KitForge release/build_trail.py · generator commit 1252a76ccb9fe0963d2efc0d07028de8176a15fe
- 2026-11-13T17:15:31Z publication: promoted at 2026-11-13T17:14:14Z · promoted digest sha256:d74e3c70ef0bcb4f20a606023da8408fe63f5711ba8fdffa7c74225a23963645 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 555 · checklist status complete · checklist at 2026-11-13T17:15:31Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/kubecontrollermanager/v1.36.6-CE-ubuntu24.04-r4/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/kubecontrollermanager/v1.36.6-CE-ubuntu24.04-r4/), as staged for publishing | — |
ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.rebuild.json | beside the archive (prodasset /data/production/kubecontrollermanager/v1.36.6-CE-ubuntu24.04-r4/), as staged for publishing | — |
ReadyStack-kubecontrollermanager-v1.36.6-CE-ubuntu24.04-r4.rebuild.json.sigstore | beside the archive (prodasset /data/production/kubecontrollermanager/v1.36.6-CE-ubuntu24.04-r4/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/kubecontrollermanager/v1.36.6-CE-ubuntu24.04-r4/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 761 |
chains | sadb, ReadyStack's engine database (not published) | 1086 |
defects | sadb, ReadyStack's engine database (not published) | kubecontrollermanager v1.36.6-CE-ubuntu24.04-r4 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1086 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1086 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1086 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1086 |
release_images | sadb, ReadyStack's engine database (not published) | kubecontrollermanager v1.36.6-CE-ubuntu24.04-r4 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1086 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1086 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |