kube-proxy v1.36.6-CE-ubuntu24.04-r3 build trail
How ReadyStack built readystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r3 - Index digestsha256:70d8939c692f41fed8f16357f105484bdea6323fd928748e399f84b9f4da38b7
- linux/amd64 digestsha256:aae88405e949493ce34567cd84f487d7dc416ce0542228641a6c7201c36644ba
- Archive
ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.tar.gz - Archive SHA-256 now50bd5010adee1e4dc66e4f31507b021f0936e394d2fba76fe9dad54640775175
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-12T12:18:31Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- Productkube-proxy (kubeproxy) [MANIFEST.json]
- Release tagv1.36.6-CE-ubuntu24.04-r3 [MANIFEST.json]
- Imagereadystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r3 [MANIFEST.json]
- Image index digestsha256:70d8939c692f41fed8f16357f105484bdea6323fd928748e399f84b9f4da38b7 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:aae88405e949493ce34567cd84f487d7dc416ce0542228641a6c7201c36644ba [ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.tar.gz (bytes 524437873) [MANIFEST.json]
- Archive sha256 at publish50bd5010adee1e4dc66e4f31507b021f0936e394d2fba76fe9dad54640775175 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/kubernetes/kubernetes [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv1.36.6 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit1b2171b110bb2a2542e1322035c6583ec86eb976 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash803692e6a7661d2d72c4cdf0a2a2459bdf6646e2b6c955ed7362f279ee4fa004 (files 29206) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:3f77cf12c847e30cf24a365a76b4ca5274f9fded748d06d9d3038c7e88630e85 [ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794391158 (utc 2026-11-11T09:59:18Z) [ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.26.11-bookworm@sha256:dc40a13b61304647ed7e5d581d246b86413dfc29d63c6d018310feb93cd98fc0 · platform digest sha256:79ecd0a7157c7a4cf3b281ced8465350591bf54fedab540e75374a003e1fde7e
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.rebuild.json, engine]
- Engine commit(s)
- commit 28713a5f8609b228967998dd71acc203cdd43d34 · dirty yes · first drive 4410
- commit c246b07263c970f79b0cac3134ed74c255294a2f · dirty yes · first drive 4420
Why this release exists
Fully recorded- Chain1018 (created 2026-11-12T11:29:06Z · trigger customer_request · upstream version v1.36.6) [chains, chains #1018]
- Requestbuild request #669 (rebuild) (requested at 2026-11-11T09:59:19Z · requested by kitforge-agent · version v1.36.6) [build_requests, build_requests #669]
- Reasonrerelease agenda REVISION -> v1.36.6-CE-ubuntu24.04-r3 (decay loop, IMP-08) [build_requests, build_requests #669 request_reason]
- Supersedesreadystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r2 (chain 906) [chains, chains #906]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1018 release · ready_to_ship
Created 2026-11-12T11:29:06Z, upstream v1.36.6, build request 669 [chains, chains #1018]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4410 | 2026-11-12T11:29:43Z | 28.2 | build host 5 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4410] |
| 4420 | 2026-11-12T12:12:01Z | — | build host 5 publish-held | not recorded [drive_runs, drive_runs #4420] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-12T11:29:53Z | 2026-11-12T11:29:54Z | 1 | 4
|
order_json 52b60ee94400… |
acquire |
2026-11-12T11:30:07Z | 2026-11-12T11:30:10Z | 1 | 12
|
source_tree 96b79f03cd5d…license_file cfc7749b96f6…custody_inputs e16e80fee856…source_tree_hash c3b1bfe48594…source_file_manifest 9d1af0fe53cd… |
plan |
2026-11-12T11:30:57Z | 2026-11-12T11:30:57Z | 1 | 10
|
recon_report dbd55c8bd1b7…input_pin_plan 720215809f75…toolchain_lock 0b9d91aca25e… |
assemble_kit |
2026-11-12T11:39:22Z | 2026-11-12T11:39:23Z | 1 | 27
|
dockerfile 00dfe6bca256…build_recipe 02b7bcbb54d6…system_pinning f92416ae24fc…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health 242d741dee22…verify_offline_sh 3e8184ea230c…base_image_digests 4d7a6dc765fa…dockerfile_offline 00dfe6bca256…first_build_digest 8a9a6e456361… |
remediate |
2026-11-12T11:40:18Z | 2026-11-12T11:40:19Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log b6d8dde96ada…security_report 9cf3b06c78a5… |
build_kit |
2026-11-12T11:46:45Z | 2026-11-12T11:46:46Z | 1 | 9
|
cosign_stamp 66f5f28e5f0f…locked_digest ddc3e07aadae…freeze_manifest f33762641838…offline_rebuild_transcript c6bd9b5a9dd9… |
verdict |
2026-11-12T11:47:52Z | 2026-11-12T11:47:53Z | 1 | 8
|
scout_verdict 11d0a4fed0d7… |
publish_image |
2026-11-12T11:48:38Z | 2026-11-12T11:48:39Z | 1 | 7
|
hub_readme e6325aee52c7…promotion_record 527ce45e910f… |
boot_instance |
2026-11-12T11:48:41Z | 2026-11-12T11:48:42Z | 1 | 3
|
instance_handle da591af745c8… |
sbom |
2026-11-12T11:48:55Z | 2026-11-12T11:48:56Z | 1 | 5
|
sbom_md d6d84eb4e911…sbom_json 795e6b10b360… |
schema_discovery |
2026-11-12T11:48:58Z | 2026-11-12T11:48:59Z | 1 | 7
|
schema_hash e59473b49742…dependency_tree b4a4f0effc10…table_classification 7f4304308d4c… |
admin_handbook |
2026-11-12T11:49:02Z | 2026-11-12T11:49:03Z | 1 | 7
|
api_map ecf675742faf…admin_handbook f4c7b09d1c97… |
db_handbook |
2026-11-12T11:49:05Z | 2026-11-12T11:49:06Z | 1 | 8
|
db_handbook 8cb63b4b84f4…seed_isolation fb1894ce611b… |
seed_data |
2026-11-12T11:49:09Z | 2026-11-12T11:49:10Z | 1 | 6
|
seed_data_sql a2c897ef3ea7…seed_cases_json 0ca9921de148… |
seed_validate |
2026-11-12T11:49:12Z | 2026-11-12T11:49:13Z | 1 | 3
|
seed_data_contract 17ab0aac456e… |
usecase_validate |
2026-11-12T11:49:15Z | 2026-11-12T11:49:16Z | 1 | 10
|
failed_tests f1ff6cd59c5f…passed_tests 0af961c75190…test_results 4a57fb1f00ff…usecase_contract 9f777127c509… |
finalize_docs |
2026-11-12T11:49:20Z | 2026-11-12T11:49:21Z | 1 | 9
|
defects_json 4c4a962be383…release_notes 0bdbf8680c0f…api_integration_guide 35c71efe9d1e… |
package_archive invalidated 2026-11-12T12:11:33Z |
2026-11-12T11:57:54Z | 2026-11-12T11:57:56Z | 1 | 37 (final gate PASS)
|
sale_tar a295c2ba2d3c…checksums 92241c6e9154…verify_md baf37318c687…rebuild_md 72e3395f7d1c…manifest_txt 9a4041a809c3…actions_jsonl af9fdb341f68…provenance_md c28f9b6acdf5…assetchain_log_md e9eccaec0c0f…assetchain_log_json 5a66d5a3f91a… |
[stage_runs]
Rewinds
- 2026-11-12T12:11:33Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33720]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-12T11:57:56Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 14264 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 16628 | L-A183, L-A15 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.22 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-12T11:59:14Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1811] | $0.22 | 3 rounds, $40.00 | a295c2ba2d3c… |
Defects
Fully recorded- Ledger entries0 [defects, defects where product_slug=kubeproxy and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
0 ledger entries.
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:aae88405e949493ce34567cd84f487d7dc416ce0542228641a6c7201c36644ba · published digest sha256:aae88405e949493ce34567cd84f487d7dc416ce0542228641a6c7201c36644ba · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 186) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T12:12:25Z · failing Docker Scout counts 99 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T12:12:11Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3831736884 · transparency-log entry
- log index 3831739436 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3832173805 · transparency-log entry · integrated 2026-11-12T12:17:02Z) [ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:70d8939c692f41fed8f16357f105484bdea6323fd928748e399f84b9f4da38b7 · state attached · log index 3832178062 · transparency-log entry
- kind sbom · digest sha256:70d8939c692f41fed8f16357f105484bdea6323fd928748e399f84b9f4da38b7 · state attached · log index 3832179463 · transparency-log entry
- kind vsa · digest sha256:70d8939c692f41fed8f16357f105484bdea6323fd928748e399f84b9f4da38b7 · state attached · log index 3832180437 · transparency-log entry
- kind provenance · digest sha256:aae88405e949493ce34567cd84f487d7dc416ce0542228641a6c7201c36644ba · state attached · log index 3832182398 · transparency-log entry
- kind sbom · digest sha256:aae88405e949493ce34567cd84f487d7dc416ce0542228641a6c7201c36644ba · state attached · log index 3832185652 · transparency-log entry
- kind vsa · digest sha256:aae88405e949493ce34567cd84f487d7dc416ce0542228641a6c7201c36644ba · state attached · log index 3832188029 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/kubeproxy/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-12T11:59:18Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:aae88405e949493ce34567cd84f487d7dc416ce0542228641a6c7201c36644ba [clean-room rebuild ledger, runs[788]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-12T11:48:39Z [stage_runs, stage_runs chain 1018 stage publish_image]
- Archive manifests written2026-11-12T12:14:35Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 862 · probed 2026-11-12T11:43:17Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-12T12:18:31Z generated: by KitForge release/build_trail.py · generator commit 27badbefbe8aac72eb90e98ea8f843a03c177b52
- 2026-11-12T12:20:17Z publication: promoted at 2026-11-12T12:19:04Z · promoted digest sha256:70d8939c692f41fed8f16357f105484bdea6323fd928748e399f84b9f4da38b7 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 503 · checklist status complete · checklist at 2026-11-12T12:20:17Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/kubeproxy/v1.36.6-CE-ubuntu24.04-r3/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/kubeproxy/v1.36.6-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.rebuild.json | beside the archive (prodasset /data/production/kubeproxy/v1.36.6-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r3.rebuild.json.sigstore | beside the archive (prodasset /data/production/kubeproxy/v1.36.6-CE-ubuntu24.04-r3/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/kubeproxy/v1.36.6-CE-ubuntu24.04-r3/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 669 |
chains | sadb, ReadyStack's engine database (not published) | 1018 |
defects | sadb, ReadyStack's engine database (not published) | kubeproxy v1.36.6-CE-ubuntu24.04-r3 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1018 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1018 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1018 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1018 |
release_images | sadb, ReadyStack's engine database (not published) | kubeproxy v1.36.6-CE-ubuntu24.04-r3 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1018 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1018 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |