kube-proxy v1.36.6-CE-ubuntu24.04-r4 build trail
How ReadyStack built readystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r4 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r4 - Index digestsha256:56fbb9931272fe86df075d62e71d415d6b85d5384ee8875b15e2b6153d9af93f
- linux/amd64 digestsha256:8ccef894b8f545ebe479c874954bfa75fb14d04769d1f6c6804eab2fe99b806a
- Archive
ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.tar.gz - Archive SHA-256 nowc1f3cc645d34f0fd2c6bc579f5fd1859d1511f574c0a1a7e5a27699aba069652
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-13T16:09:03Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.trail.json.sigstore ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- Productkube-proxy (kubeproxy) [MANIFEST.json]
- Release tagv1.36.6-CE-ubuntu24.04-r4 [MANIFEST.json]
- Imagereadystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r4 [MANIFEST.json]
- Image index digestsha256:56fbb9931272fe86df075d62e71d415d6b85d5384ee8875b15e2b6153d9af93f [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:8ccef894b8f545ebe479c874954bfa75fb14d04769d1f6c6804eab2fe99b806a [ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.tar.gz (bytes 528354115) [MANIFEST.json]
- Archive sha256 at publishc1f3cc645d34f0fd2c6bc579f5fd1859d1511f574c0a1a7e5a27699aba069652 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/kubernetes/kubernetes [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv1.36.6 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit1b2171b110bb2a2542e1322035c6583ec86eb976 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash803692e6a7661d2d72c4cdf0a2a2459bdf6646e2b6c955ed7362f279ee4fa004 (files 29206) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:b9fadb9f48d355b3cb32be03a6929bf1261d5e8e4e9d144b02cdf6e5d1f2c440 [ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794578571 (utc 2026-11-13T14:02:51Z) [ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.26.11-bookworm@sha256:dc40a13b61304647ed7e5d581d246b86413dfc29d63c6d018310feb93cd98fc0 · platform digest sha256:79ecd0a7157c7a4cf3b281ced8465350591bf54fedab540e75374a003e1fde7e
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.rebuild.json, engine]
- Engine commit(s)
- commit f264c5a93fc5fe548e62fe3bfbeb279b813432b8 · dirty yes · first drive 4608
- commit 073535c62a45bea8f3f14b90d7062837d7d2da35 · dirty yes · first drive 4612
Why this release exists
Fully recorded- Chain1087 (created 2026-11-13T15:28:04Z · trigger customer_request · upstream version v1.36.6) [chains, chains #1087]
- Requestbuild request #762 (rebuild) (requested at 2026-11-13T14:02:52Z · requested by kitforge-agent · version v1.36.6) [build_requests, build_requests #762]
- Reasonrerelease agenda REVISION -> v1.36.6-CE-ubuntu24.04-r4 (decay loop, IMP-08) [build_requests, build_requests #762 request_reason]
- Supersedesreadystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r3 (chain 1018) [chains, chains #1018]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1087 release · ready_to_ship
Created 2026-11-13T15:28:04Z, upstream v1.36.6, build request 762 [chains, chains #1087]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4608 | 2026-11-13T15:28:47Z | 21.2 | build host 2 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4608] |
| 4612 | 2026-11-13T16:02:18Z | — | build host 2 publish-held | not recorded [drive_runs, drive_runs #4612] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-13T15:28:57Z | 2026-11-13T15:28:58Z | 1 | 4
|
order_json e800abbce280… |
acquire |
2026-11-13T15:29:12Z | 2026-11-13T15:29:14Z | 1 | 12
|
source_tree 96b79f03cd5d…license_file cfc7749b96f6…custody_inputs e16e80fee856…source_tree_hash c3b1bfe48594…source_file_manifest 9d1af0fe53cd… |
plan |
2026-11-13T15:30:07Z | 2026-11-13T15:30:08Z | 1 | 10
|
recon_report 615aa91fc153…input_pin_plan ebdb228c872b…toolchain_lock c845a2732aab… |
assemble_kit |
2026-11-13T15:35:35Z | 2026-11-13T15:35:35Z | 1 | 27
|
dockerfile 423b9575ea01…build_recipe d50643e2279f…system_pinning f92416ae24fc…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health aef6a1e5f634…verify_offline_sh 3e8184ea230c…base_image_digests 4d7a6dc765fa…dockerfile_offline 423b9575ea01…first_build_digest 1deef1bc3e7c… |
remediate |
2026-11-13T15:36:39Z | 2026-11-13T15:36:39Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log d255c987edec…security_report 4b01b3348c0b… |
build_kit |
2026-11-13T15:41:16Z | 2026-11-13T15:41:17Z | 1 | 9
|
cosign_stamp 11848946dbef…locked_digest 6c45583a36dc…freeze_manifest c2b8d9cca5c4…offline_rebuild_transcript 4d07b3cf112d… |
verdict |
2026-11-13T15:41:59Z | 2026-11-13T15:41:59Z | 1 | 8
|
scout_verdict 1b5d4f858cd5… |
publish_image |
2026-11-13T15:42:44Z | 2026-11-13T15:42:45Z | 1 | 7
|
hub_readme 2b61aaec094d…promotion_record 164ca797cb87… |
boot_instance |
2026-11-13T15:42:47Z | 2026-11-13T15:42:48Z | 1 | 3
|
instance_handle aa34cda94d88… |
sbom |
2026-11-13T15:42:58Z | 2026-11-13T15:42:59Z | 1 | 5
|
sbom_md 293dcfb4164d…sbom_json 8582ef1bcce3… |
schema_discovery |
2026-11-13T15:43:02Z | 2026-11-13T15:43:02Z | 1 | 7
|
schema_hash e59473b49742…dependency_tree b4a4f0effc10…table_classification 7f4304308d4c… |
admin_handbook |
2026-11-13T15:43:05Z | 2026-11-13T15:43:06Z | 1 | 7
|
api_map ecf675742faf…admin_handbook 2f00b5dc2454… |
db_handbook |
2026-11-13T15:43:08Z | 2026-11-13T15:43:09Z | 1 | 8
|
db_handbook 8cb63b4b84f4…seed_isolation fb1894ce611b… |
seed_data |
2026-11-13T15:43:12Z | 2026-11-13T15:43:13Z | 1 | 6
|
seed_data_sql a2c897ef3ea7…seed_cases_json 0ca9921de148… |
seed_validate |
2026-11-13T15:43:15Z | 2026-11-13T15:43:16Z | 1 | 3
|
seed_data_contract 17ab0aac456e… |
usecase_validate |
2026-11-13T15:43:18Z | 2026-11-13T15:43:19Z | 1 | 10
|
failed_tests f1ff6cd59c5f…passed_tests 0af961c75190…test_results 4a57fb1f00ff…usecase_contract 9f777127c509… |
finalize_docs |
2026-11-13T15:43:23Z | 2026-11-13T15:43:24Z | 1 | 9
|
defects_json 25d0d3eef00f…release_notes 39a9e7cb3723…api_integration_guide f7d8a9972901… |
package_archive invalidated 2026-11-13T16:01:46Z |
2026-11-13T15:49:58Z | 2026-11-13T15:50:00Z | 1 | 37 (final gate PASS)
|
sale_tar 7fccaf262ec5…checksums afc46dd8c366…verify_md c7ccaa452999…rebuild_md b2c8a7455ffa…manifest_txt 1a04a9b41ae0…actions_jsonl bd968eb5ea2b…provenance_md facfea458e9f…assetchain_log_md e9eccaec0c0f…assetchain_log_json c570fc1698f1… |
[stage_runs]
Rewinds
- 2026-11-13T16:01:46Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36602]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-13T15:50:00Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 15455 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 19444 | L-A08, L-038, L-036, L-034, L-032 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.18 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-13T15:51:31Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1894] | $0.18 | 3 rounds, $40.00 | 7fccaf262ec5… |
Defects
Fully recorded- Ledger entries0 [defects, defects where product_slug=kubeproxy and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
0 ledger entries.
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:8ccef894b8f545ebe479c874954bfa75fb14d04769d1f6c6804eab2fe99b806a · published digest sha256:8ccef894b8f545ebe479c874954bfa75fb14d04769d1f6c6804eab2fe99b806a · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 123) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T16:02:40Z · failing Docker Scout counts 99 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T16:02:29Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3857139071 · transparency-log entry
- log index 3857141999 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3857586513 · transparency-log entry · integrated 2026-11-13T16:06:47Z) [ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:56fbb9931272fe86df075d62e71d415d6b85d5384ee8875b15e2b6153d9af93f · state attached · log index 3857591309 · transparency-log entry
- kind sbom · digest sha256:56fbb9931272fe86df075d62e71d415d6b85d5384ee8875b15e2b6153d9af93f · state attached · log index 3857592452 · transparency-log entry
- kind vsa · digest sha256:56fbb9931272fe86df075d62e71d415d6b85d5384ee8875b15e2b6153d9af93f · state attached · log index 3857593378 · transparency-log entry
- kind provenance · digest sha256:8ccef894b8f545ebe479c874954bfa75fb14d04769d1f6c6804eab2fe99b806a · state attached · log index 3857594770 · transparency-log entry
- kind sbom · digest sha256:8ccef894b8f545ebe479c874954bfa75fb14d04769d1f6c6804eab2fe99b806a · state attached · log index 3857596031 · transparency-log entry
- kind vsa · digest sha256:8ccef894b8f545ebe479c874954bfa75fb14d04769d1f6c6804eab2fe99b806a · state attached · log index 3857596916 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/kubeproxy/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-13T15:51:36Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:8ccef894b8f545ebe479c874954bfa75fb14d04769d1f6c6804eab2fe99b806a [clean-room rebuild ledger, runs[843]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-13T15:42:45Z [stage_runs, stage_runs chain 1087 stage publish_image]
- Archive manifests written2026-11-13T16:04:41Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 862 · probed 2026-11-13T15:38:57Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-13T16:09:03Z generated: by KitForge release/build_trail.py · generator commit 073535c62a45bea8f3f14b90d7062837d7d2da35
- 2026-11-13T16:10:52Z publication: promoted at 2026-11-13T16:09:43Z · promoted digest sha256:56fbb9931272fe86df075d62e71d415d6b85d5384ee8875b15e2b6153d9af93f · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 554 · checklist status complete · checklist at 2026-11-13T16:10:52Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/kubeproxy/v1.36.6-CE-ubuntu24.04-r4/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/kubeproxy/v1.36.6-CE-ubuntu24.04-r4/), as staged for publishing | — |
ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.rebuild.json | beside the archive (prodasset /data/production/kubeproxy/v1.36.6-CE-ubuntu24.04-r4/), as staged for publishing | — |
ReadyStack-kubeproxy-v1.36.6-CE-ubuntu24.04-r4.rebuild.json.sigstore | beside the archive (prodasset /data/production/kubeproxy/v1.36.6-CE-ubuntu24.04-r4/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/kubeproxy/v1.36.6-CE-ubuntu24.04-r4/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 762 |
chains | sadb, ReadyStack's engine database (not published) | 1087 |
defects | sadb, ReadyStack's engine database (not published) | kubeproxy v1.36.6-CE-ubuntu24.04-r4 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1087 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1087 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1087 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1087 |
release_images | sadb, ReadyStack's engine database (not published) | kubeproxy v1.36.6-CE-ubuntu24.04-r4 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1087 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1087 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |