Kubernetes v1.37.1-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/kubernetes:v1.37.1-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/kubernetes:v1.37.1-CE-ubuntu24.04-r2
  • Index digestsha256:a3dcd105da2495f5ee790589b4cbba4431993708933e012e919a31bcaad18ecd
  • linux/amd64 digestsha256:fd30476fb8e96b42deaaafcb7ba25e0437b57c83ceeac7c6ae42572559ca20e7
  • ArchiveReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now6e0e7822b8a2ffbe5ff4d987dbf7978ff54888320d08daf3453b948d740927ca
  • Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
  • Sections9 sections, 3 fully recorded; 13 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.trail.json
ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.trail.jsonReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.trail.mdKubernetes product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

1 item not recorded
  • ProductKubernetes (kubernetes) [MANIFEST.json]
  • Release tagv1.37.1-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/kubernetes:v1.37.1-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:a3dcd105da2495f5ee790589b4cbba4431993708933e012e919a31bcaad18ecd [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:fd30476fb8e96b42deaaafcb7ba25e0437b57c83ceeac7c6ae42572559ca20e7 [ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.tar.gz (bytes 605363469) [MANIFEST.json]
  • Archive sha256 at publish3bc000df0acdc64483a4a81fba0e0005904024f7ca833c03046ad8665e186d42 [MANIFEST.json, repack_history[0].previous_tarball_sha256]
  • Archive sha256 now6e0e7822b8a2ffbe5ff4d987dbf7978ff54888320d08daf3453b948d740927ca [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack history
    • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 3bc000df0acdc64483a4a81fba0e0005904024f7ca833c03046ad8665e186d42 · sha256 6e0e7822b8a2ffbe5ff4d987dbf7978ff54888320d08daf3453b948d740927ca · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
    [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/kubernetes/kubernetes [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv1.37.1 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitf78e722310e50bcaca9276be22276d9e91d91308 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash9b6ed1d7a503ebb54aa8e5bd0e2266e698c640f4a2dd445039391337d052a0ed (files 31262) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:9db02e109e81c94834658470ae7dff81baad8d422df30c12a61c330a7e0f876e [ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1790183182 (utc 2026-09-23T17:06:22Z) [ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded
  • Chain657 (created 2026-10-27T02:28:59Z · trigger customer_request · upstream version v1.37.1) [chains, chains #657]
  • Requestbuild request #339 (rebuild) (requested at 2026-10-27T01:49:53Z · requested by kitforge-agent · version v1.37.1) [build_requests, build_requests #339]
  • Reasonrevision v1.37.1-CE-ubuntu24.04-r2: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #339 request_reason]
  • Supersedesreadystack/kubernetes:v1.37.1-CE-ubuntu24.04-r1 (chain 612) [chains, chains #612]

The path through the harness

2 items not recorded

1 chain · 5 drives · 18 stages · 3 rewinds

Chain 657 release · shipped

Created 2026-10-27T02:28:59Z, upstream v1.37.1, build request 339 [chains, chains #657]

DriveStartedMinutesBuild hostHow it stopped
1882026-10-27T02:30:43Z55.6build host 1 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #188] rebuilt from a build line's log
1932026-10-27T04:54:54Z17build host 1 withhold-publish ready_to_ship [drive_runs, drive_runs #193] rebuilt from a build line's log
1952026-10-27T06:04:57Z7.9build host 1 withhold-publish ready_to_ship [drive_runs, drive_runs #195] rebuilt from a build line's log
1992026-10-27T08:10:28Z8build host 1 withhold-publish ready_to_ship [drive_runs, drive_runs #199] rebuilt from a build line's log
2022026-10-27T08:50:33Z11.4build host 1 publish-held shipped [drive_runs, drive_runs #202] rebuilt from a build line's log

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-27T02:30:49Z2026-10-27T02:30:50Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-27T02:31:04Z2026-10-27T02:31:05Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-27T02:31:54Z2026-10-27T02:31:55Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-27T02:43:48Z2026-10-27T02:43:48Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 —
remediate 2026-10-27T02:44:55Z2026-10-27T02:44:56Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 —
build_kit 2026-10-27T03:01:30Z2026-10-27T03:01:31Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 —
verdict 2026-10-27T03:03:59Z2026-10-27T03:04:00Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 —
publish_image 2026-10-27T03:05:07Z2026-10-27T03:05:08Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 —
boot_instance 2026-10-27T03:05:26Z2026-10-27T03:05:28Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 —
sbom 2026-10-27T03:05:57Z2026-10-27T03:05:58Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 —
schema_discovery 2026-10-27T03:06:00Z2026-10-27T03:06:01Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 —
admin_handbook 2026-10-27T03:14:27Z2026-10-27T03:14:28Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 —
db_handbook 2026-10-27T03:23:08Z2026-10-27T03:23:09Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 —
seed_data 2026-10-27T03:23:18Z2026-10-27T03:23:19Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 —
seed_validate 2026-10-27T03:23:21Z2026-10-27T03:23:22Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 —
usecase_validate 2026-10-27T03:23:51Z2026-10-27T03:23:52Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 —
finalize_docs 2026-10-27T03:23:57Z2026-10-27T03:23:58Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 —
package_archive 2026-10-27T03:26:14Z2026-10-27T09:01:51Z5
33 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 scout_grade_a
  • G8 script_copies
  • G8 three_way_sha
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 assetchain_coverage
 —

[stage_runs]

Rewinds

  • 2026-10-27T05:45:26Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2106]
  • 2026-10-27T06:31:44Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2107]
  • 2026-10-27T08:50:05Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #230]
  • Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
  • Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-10-27T09:01:51Z.

79 calls over 4 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook422003 not recordednot recorded —
db_handbook331003 not recordednot recorded —

[micro_step_runs]

  • Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
  • Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

2 items not recorded

Role: review model.

3 rounds, 3 counted, $4.98 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-10-27T05:12:30Z 3217 findings to repackage [held_rounds, held_rounds #81] rebuilt from a held-review state file $1.83 not recorded not recorded
22026-10-27T06:13:10Z 223 findings to repackage [held_rounds, held_rounds #82] rebuilt from a held-review state file $1.49 not recorded not recorded
32026-10-27T08:18:50Z 008 clean to publish [held_rounds, held_rounds #83] rebuilt from a held-review state file $1.66 not recorded not recorded
  • Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
  • Not recorded: the round cap in force at each round (the state files did not keep it)

Defects

Fully recorded
  • Ledger entries37 [defects, defects where product_slug=kubernetes and this tag or chain]
  • Disclosed in the archive37 [docs/defects/defects.json, entries]

37 ledger entries: by severity critical 5, high 4, low 28; by status fixed-before-release 37.

DefectSeverityStatusFound byFixed in
RSD-kubernetes-c3771c2155
Database handbook: Restoring into /var/lib/etcd-restore and swapping /var/lib/etcd never touches the live data directory, /var/lib/kubernetes/etcd; the documented restore completes with exit 0 and the cluster silently… [defects, defects #99555]		criticalfixed-before-releaseheld review (review model)—
RSD-kubernetes-c00ab3edc8
Database handbook: The data directory etcd runs with is /var/lib/kubernetes/etcd (kube-entrypoint.sh: dataDir $K/etcd). [defects, defects #99556]		criticalfixed-before-releaseheld review (review model)—
RSD-kubernetes-ca4f3a76d4
Database handbook: etcd serves only TLS with client-certificate authentication on 127.0.0.1:2379; this command has no certificates, so the snapshot is never taken (the command hangs until the client times out), and… [defects, defects #99557]		criticalfixed-before-releaseheld review (review model)—
RSD-kubernetes-bc50b7f5e9
API guide: Port 6443 serves HTTPS only and the guide's only connection instruction gives http://, which cannot connect; the guide also has no authentication statement although all but four routes require the… [defects, defects #99558]		highfixed-before-releaseheld review (review model)—
RSD-kubernetes-0c4eb61a92
Admin handbook: Contradicts the Operating facts of the same handbook (re-issued at a start within 30 days of expiry); nothing in the running container renews certificates, so a customer who relies on automatic… [defects, defects #99559]		highfixed-before-releaseheld review (review model)—
RSD-kubernetes-ff55f8282a
Admin handbook: The image's default user is 999; root only with --user 0. [defects, defects #99560]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-bf3abb4d95
Admin handbook: CoreDNS does not run in control-plane mode; contradicts lines 261, 425 and 1072. [defects, defects #99561]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-63ce7d6c44
Admin handbook: The component kubeconfigs name the container's advertise address, not 127.0.0.1. [defects, defects #99562]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-b82e59e6a9
Admin handbook: CoreDNS runs as kube (as lines 241 and 1066 and DB_HANDBOOK 369 state); the processes run inside the container, not on the host. [defects, defects #99563]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-132244ff94
Admin handbook: admin.conf embeds the cluster CA (certificate-authority-data), not the API server's serving certificate. [defects, defects #99564]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-27a6b142af
Admin handbook: Contradicts the table at line 590, which lists GET for `/`, and the live behaviour (GET / with the admin certificate returns the path list). [defects, defects #99565]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-f42c662ea2
Admin handbook: Plain /readyz returns only `ok`; the check list appears only with ?verbose. [defects, defects #99566]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-3ce491e216
Admin handbook: The documented command (no ?verbose) prints only `ok`. [defects, defects #99567]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-0af7742ee3
Database handbook: kube-scheduler runs in the default control-plane mode too (line 361 and the supervisorctl output). [defects, defects #99568]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-4e9b3b41ee
Database handbook: Plain /readyz returns only `ok`. [defects, defects #99569]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-a7477da94f
Database handbook: The documented command (no ?verbose) prints only `ok`. [defects, defects #99570]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-f2490691c0
Database handbook: The documented command (no ?verbose) prints only `ok`. [defects, defects #99571]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-b917b97118
Database handbook: The process group is 999 (kube), not 0; contradicts line 317 of the same handbook. [defects, defects #99572]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-d320f41149
Database handbook: Group is 999, not 0. [defects, defects #99573]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-1b0aeb6279
Database handbook: VERIFY_OFFLINE.sh asserts only the probe_exec from TARGET_DIGEST.txt (livez); it does not call /readyz. [defects, defects #99574]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-b67b940db4
Database handbook: The boot check asserts only the livez probe, not controller-manager/scheduler startup or kube-init RBAC state (line 976). [defects, defects #99575]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-d7b87b17fb
Database handbook: Not asserted by VERIFY_OFFLINE.sh (it checks only the probe). [defects, defects #99576]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-3138bb7de7
Database handbook: The backup copy-out step fails: the snapshot is saved under /var/lib/kubernetes, but docker cp reads /tmp, so the customer gets no off-container backup. [defects, defects #100715]		criticalfixed-before-releaseheld review (review model)—
RSD-kubernetes-36e769740b
Database handbook: Followed in order, the restore names a file that was never created (only etcd-backup.db exists) and fails after kube-apiserver and etcd were already stopped, leaving the cluster down. [defects, defects #100716]		criticalfixed-before-releaseheld review (review model)—
RSD-kubernetes-fcd20e6b96
Database handbook: Presents renewal as automatic, contradicting the Operating facts and the Admin Handbook; a customer relying on it in a long-running container will have certificates expire after one year (the r1… [defects, defects #100717]		highfixed-before-releaseheld review (review model)—
RSD-kubernetes-7321bb8f5b
Database handbook: The documented way to change the address on a kept volume produces a kubeconfig whose server name is not in the serving certificate, so clients fail TLS validation; contradicts the Admin Handbook. [defects, defects #100718]		highfixed-before-releaseheld review (review model)—
RSD-kubernetes-d4addc1470
Database handbook: Plain /readyz does not list checks (r1 minor class). [defects, defects #100719]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-eb0b933736
Database handbook: Claims the boot validates that controller-manager and scheduler initialize without errors; only the livez probe is asserted (r1 minor class). [defects, defects #100720]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-10a33f837c
Admin handbook: Plain /readyz returns only `ok`; contradicts line 'returns 200 with the body ok' in Health Checks and Readiness. [defects, defects #100721]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-ad4011d933
API guide: The sentence says no machine-readable specification is served, which contradicts the OpenAPI routes the guide itself lists. [defects, defects #103905]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-d02e4209e8
Admin handbook: Points the customer to a guide that contains none of the promised content. [defects, defects #103906]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-f30bd2aa1c
Admin handbook: Same overclaim as line 620, repeated. [defects, defects #103907]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-a1c52ff7fe
Admin handbook: Backup advice leaves the only copy inside the volume that a loss would destroy; the restore itself was run end to end and works (value 'before' came back after restore, single-node and control-plane… [defects, defects #103908]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-6f7cfee6b7
Admin handbook: Statement is only true when the address is unchanged; it contradicts the sentence before it (serving certificate re-issued when the address changes). [defects, defects #103909]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-a185aead4c
Admin handbook: Cross-section contradiction. [defects, defects #103910]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-7612c1255b
Database handbook: Cross-section contradiction on what /healthz is. [defects, defects #103911]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-7e76b8b0e8
Database handbook: Cross-section contradiction. [defects, defects #103912]		lowfixed-before-releaseheld review (review model)—

Verification

3 items not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:fd30476fb8e96b42deaaafcb7ba25e0437b57c83ceeac7c6ae42572559ca20e7 · published digest sha256:fd30476fb8e96b42deaaafcb7ba25e0437b57c83ceeac7c6ae42572559ca20e7 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 488) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 657 package_archive gate_result.g8.result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-27T08:51:00Z · failing Docker Scout counts 118 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • First own scan of the releaseA (at 2026-10-27T09:02:06Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-27T06:30:41Z) [image_scans, image_scans #1316]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-27T08:50:39Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [docs/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3624247912 · transparency-log entry · integrated 2026-11-01T08:14:02Z) [ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]

Offline clean-room rebuilds

  • 2026-10-27T05:12:33Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:fd30476fb8e96b42deaaafcb7ba25e0437b57c83ceeac7c6ae42572559ca20e7 [clean-room rebuild ledger, runs[430]]
  • 2026-11-01T09:08:53Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:fd30476fb8e96b42deaaafcb7ba25e0437b57c83ceeac7c6ae42572559ca20e7 [clean-room rebuild ledger, runs[575]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
  • Not recorded: the attestations' transparency-log entries (no attestation record in the release's workspace)
  • Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

2 items not recorded
  • Image pushed (internal tag), publish_image passed2026-10-27T03:05:08Z [stage_runs, stage_runs chain 657 stage publish_image]
  • Archive manifests written2026-10-27T08:54:19Z [PUBLISH_MANIFEST.json, published_at]
  • Archive cut over on prodasset, package_archive passed2026-10-27T09:01:51Z [stage_runs, stage_runs chain 657 stage package_archive]
  • Cut-over markerpresent (chain 657) [.cutover.json]
  • Not recorded: when the release tag was promoted (the promotion record in the archive was written before the promotion, and the release's workspace no longer holds this chain)
  • Not recorded: the site event's time (the release checklist is in the chain's workspace, which no longer holds this chain)

Packages and CPU level

Fully recorded
  • Packages in the image1748 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 968 · probed 2026-11-02T17:04:23Z · source backfill) [release_images, isa_level_hard]

History

1 event
  • 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records

Records

23 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PROMOTION_RECORD.jsoninside the archive (ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.tar.gz)—
.cutover.jsonbeside the archive (prodasset /data/production/kubernetes/v1.37.1-CE-ubuntu24.04-r2/)—
MANIFEST.jsonbeside the archive (prodasset /data/production/kubernetes/v1.37.1-CE-ubuntu24.04-r2/)—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/kubernetes/v1.37.1-CE-ubuntu24.04-r2/)—
ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/kubernetes/v1.37.1-CE-ubuntu24.04-r2/)—
ReadyStack-kubernetes-v1.37.1-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/kubernetes/v1.37.1-CE-ubuntu24.04-r2/)—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/kubernetes/v1.37.1-CE-ubuntu24.04-r2/)—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)339
chainssadb, ReadyStack's engine database (not published)657
defectssadb, ReadyStack's engine database (not published)kubernetes v1.37.1-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 657
held_roundssadb, ReadyStack's engine database (not published)chain 657
image_scanssadb, ReadyStack's engine database (not published)1316
micro_step_runssadb, ReadyStack's engine database (not published)chain 657
release_imagessadb, ReadyStack's engine database (not published)kubernetes v1.37.1-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 657
stage_runssadb, ReadyStack's engine database (not published)chain 657