kube-proxy v1.36.6-CE-ubuntu24.04-r2 build trail
How ReadyStack built readystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r2 - Index digestsha256:81061bf1cae874295555934361682ed881b2445b946edda3eefda5766a0d679e
- linux/amd64 digestsha256:6c996278676c933a0b4b1f1eafa738d314e150117fbd7b4f1d5e5c2e95bdd58a
- Archive
ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.tar.gz - Archive SHA-256 now7226f802135f75bc928a21113cc019aefd838a01956523dd4faa743079c6cec6
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-09T00:10:51Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- Productkube-proxy (kubeproxy) [MANIFEST.json]
- Release tagv1.36.6-CE-ubuntu24.04-r2 [MANIFEST.json]
- Imagereadystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r2 [MANIFEST.json]
- Image index digestsha256:81061bf1cae874295555934361682ed881b2445b946edda3eefda5766a0d679e [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:6c996278676c933a0b4b1f1eafa738d314e150117fbd7b4f1d5e5c2e95bdd58a [ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.tar.gz (bytes 524701137) [MANIFEST.json]
- Archive sha256 at publish7226f802135f75bc928a21113cc019aefd838a01956523dd4faa743079c6cec6 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/kubernetes/kubernetes [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv1.36.6 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit1b2171b110bb2a2542e1322035c6583ec86eb976 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash803692e6a7661d2d72c4cdf0a2a2459bdf6646e2b6c955ed7362f279ee4fa004 (files 29206) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:fc7b239769790540db67fa914a96292d7a1286ff03acfba58e4a2b87f1c84970 [ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1793102572 (utc 2026-10-27T12:02:52Z) [ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.rebuild.json, engine]
- Engine commit(s)
- commit 42b0ae13e2b8f5856f5ce2017c8b13a12c192d23 · dirty yes · first drive 3899
- commit 182984d38fc2822b1b65f61c9546104003bca50e · dirty yes · first drive 3902
Why this release exists
Fully recorded- Chain906 (created 2026-11-08T23:35:02Z · trigger customer_request · upstream version v1.36.6) [chains, chains #906]
- Requestbuild request #600 (rebuild) (requested at 2026-11-08T23:28:42Z · requested by kitforge-agent · version v1.36.6) [build_requests, build_requests #600]
- Reasonrevision v1.36.6-CE-ubuntu24.04-r2: golang.org/x/net v0.62.0 + apt floors, PR #250; hand-bumped strategy opened no request and the line skipped it 20:42Z [build_requests, build_requests #600 request_reason]
- Supersedesreadystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r1 (chain 786) [chains, chains #786]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 906 release · ready_to_ship
Created 2026-11-08T23:35:02Z, upstream v1.36.6, build request 600 [chains, chains #906]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 3899 | 2026-11-08T23:35:37Z | 20.3 | build host 4 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3899] |
| 3902 | 2026-11-09T00:03:34Z | — | build host 4 publish-held | not recorded [drive_runs, drive_runs #3902] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-08T23:35:49Z | 2026-11-08T23:35:50Z | 1 | 4
|
order_json 41f9a17a1e8e… |
acquire |
2026-11-08T23:36:02Z | 2026-11-08T23:36:05Z | 1 | 12
|
source_tree 96b79f03cd5d…license_file cfc7749b96f6…custody_inputs e16e80fee856…source_tree_hash c3b1bfe48594…source_file_manifest 9d1af0fe53cd… |
plan |
2026-11-08T23:36:58Z | 2026-11-08T23:36:59Z | 1 | 10
|
recon_report d09db35f8ada…input_pin_plan c38ca3141eeb…toolchain_lock d14a88e9d21b… |
assemble_kit |
2026-11-08T23:42:15Z | 2026-11-08T23:42:15Z | 1 | 27
|
dockerfile b7e8bf0ff53a…build_recipe 959479bbb392…system_pinning f92416ae24fc…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health cd62b6a0260b…verify_offline_sh 3e8184ea230c…base_image_digests 692531f8d51d…dockerfile_offline b7e8bf0ff53a…first_build_digest ae8c6d1f5530… |
remediate |
2026-11-08T23:43:08Z | 2026-11-08T23:43:09Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 1df78cb8fa0d…security_report 5f42308660e8… |
build_kit |
2026-11-08T23:47:40Z | 2026-11-08T23:47:41Z | 1 | 9
|
cosign_stamp 5c7040593903…locked_digest 684028e908e3…freeze_manifest 9b68a5032e64…offline_rebuild_transcript 58d11e6c5f55… |
verdict |
2026-11-08T23:48:24Z | 2026-11-08T23:48:25Z | 1 | 8
|
scout_verdict dc6bb5a81e34… |
publish_image |
2026-11-08T23:49:00Z | 2026-11-08T23:49:01Z | 1 | 7
|
hub_readme 9193cabe603e…promotion_record 8fbd3498b738… |
boot_instance |
2026-11-08T23:49:04Z | 2026-11-08T23:49:04Z | 1 | 3
|
instance_handle 118046224d63… |
sbom |
2026-11-08T23:49:16Z | 2026-11-08T23:49:16Z | 1 | 5
|
sbom_md 95d34e726e62…sbom_json 28bee961544b… |
schema_discovery |
2026-11-08T23:49:19Z | 2026-11-08T23:49:20Z | 1 | 7
|
schema_hash e59473b49742…dependency_tree b4a4f0effc10…table_classification 7f4304308d4c… |
admin_handbook |
2026-11-08T23:49:23Z | 2026-11-08T23:49:24Z | 1 | 7
|
api_map ecf675742faf…admin_handbook 803e9a383cc4… |
db_handbook |
2026-11-08T23:49:26Z | 2026-11-08T23:49:27Z | 1 | 8
|
db_handbook 8cb63b4b84f4…seed_isolation fb1894ce611b… |
seed_data |
2026-11-08T23:49:30Z | 2026-11-08T23:49:30Z | 1 | 6
|
seed_data_sql a2c897ef3ea7…seed_cases_json 0ca9921de148… |
seed_validate |
2026-11-08T23:49:33Z | 2026-11-08T23:49:34Z | 1 | 3
|
seed_data_contract 17ab0aac456e… |
usecase_validate |
2026-11-08T23:49:37Z | 2026-11-08T23:49:38Z | 1 | 10
|
failed_tests f1ff6cd59c5f…passed_tests 0af961c75190…test_results 4a57fb1f00ff…usecase_contract 9f777127c509… |
finalize_docs |
2026-11-08T23:49:42Z | 2026-11-08T23:49:43Z | 1 | 9
|
defects_json 30738c0c7be9…release_notes 2a70c24f3b6c…api_integration_guide de59d54d7593… |
package_archive invalidated 2026-11-09T00:02:56Z |
2026-11-08T23:55:51Z | 2026-11-08T23:55:54Z | 1 | 34 (final gate PASS)
|
sale_tar 30440ea64763…checksums 1d12ffe99148…verify_md 3d77ed760320…rebuild_md 5dd8ad441d90…manifest_txt 55ec47c2e52c…actions_jsonl 9a7756ca3191…provenance_md e31e024ae076…assetchain_log_md e9eccaec0c0f…assetchain_log_json 8af17b647b59… |
[stage_runs]
Rewinds
- 2026-11-09T00:02:56Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27629]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-08T23:55:54Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 14863 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 16353 | L-A183, L-A15 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.17 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-08T23:56:47Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1553] | $0.17 | 3 rounds, $40.00 | 30440ea64763… |
Defects
Fully recorded- Ledger entries1 [defects, defects where product_slug=kubeproxy and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
1 ledger entry: by severity low 1; by status fixed-in-release 1.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-kubeproxy-0db2ae02acAPI guide: The guide says it lists the routes declared in the product's routing table, but the metrics listener registers more routes than the five shown. [defects, defects #187749] | low | fixed-in-release | held review (review model) | v1.36.6-CE-ubuntu24.04-r2 |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:6c996278676c933a0b4b1f1eafa738d314e150117fbd7b4f1d5e5c2e95bdd58a · published digest sha256:6c996278676c933a0b4b1f1eafa738d314e150117fbd7b4f1d5e5c2e95bdd58a · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 121) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T00:03:58Z · failing Docker Scout counts 99 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T00:03:47Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3759620937 · transparency-log entry
- log index 3759621113 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3759667682 · transparency-log entry · integrated 2026-11-09T00:09:19Z) [ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:81061bf1cae874295555934361682ed881b2445b946edda3eefda5766a0d679e · state attached · log index 3759669224 · transparency-log entry
- kind sbom · digest sha256:81061bf1cae874295555934361682ed881b2445b946edda3eefda5766a0d679e · state attached · log index 3759669748 · transparency-log entry
- kind vsa · digest sha256:81061bf1cae874295555934361682ed881b2445b946edda3eefda5766a0d679e · state attached · log index 3759670330 · transparency-log entry
- kind provenance · digest sha256:6c996278676c933a0b4b1f1eafa738d314e150117fbd7b4f1d5e5c2e95bdd58a · state attached · log index 3759670865 · transparency-log entry
- kind sbom · digest sha256:6c996278676c933a0b4b1f1eafa738d314e150117fbd7b4f1d5e5c2e95bdd58a · state attached · log index 3759671430 · transparency-log entry
- kind vsa · digest sha256:6c996278676c933a0b4b1f1eafa738d314e150117fbd7b4f1d5e5c2e95bdd58a · state attached · log index 3759671796 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/kubeproxy/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-08T23:56:54Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:6c996278676c933a0b4b1f1eafa738d314e150117fbd7b4f1d5e5c2e95bdd58a [clean-room rebuild ledger, runs[673]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-08T23:49:01Z [stage_runs, stage_runs chain 906 stage publish_image]
- Archive manifests written2026-11-09T00:06:30Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 862 · probed 2026-11-08T23:45:20Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-09T00:10:51Z generated: by KitForge release/build_trail.py · generator commit 6fea9ff144cd791177c6db2073a02de7624d4710
- 2026-11-09T00:12:30Z publication: promoted at 2026-11-09T00:11:23Z · promoted digest sha256:81061bf1cae874295555934361682ed881b2445b946edda3eefda5766a0d679e · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 396 · checklist status complete · checklist at 2026-11-09T00:12:30Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/kubeproxy/v1.36.6-CE-ubuntu24.04-r2/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/kubeproxy/v1.36.6-CE-ubuntu24.04-r2/), as staged for publishing | — |
ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.rebuild.json | beside the archive (prodasset /data/production/kubeproxy/v1.36.6-CE-ubuntu24.04-r2/), as staged for publishing | — |
ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r2.rebuild.json.sigstore | beside the archive (prodasset /data/production/kubeproxy/v1.36.6-CE-ubuntu24.04-r2/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/kubeproxy/v1.36.6-CE-ubuntu24.04-r2/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 600 |
chains | sadb, ReadyStack's engine database (not published) | 906 |
defects | sadb, ReadyStack's engine database (not published) | kubeproxy v1.36.6-CE-ubuntu24.04-r2 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 906 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 906 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 906 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 906 |
release_images | sadb, ReadyStack's engine database (not published) | kubeproxy v1.36.6-CE-ubuntu24.04-r2 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 906 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 906 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |