Kubernetes v1.37.2-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/kubernetes:v1.37.2-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/kubernetes:v1.37.2-CE-ubuntu24.04-r1
  • Index digestsha256:796a0873bb107513d3cb32410005ab7cf1eee356fe90994e191466638ee146a6
  • linux/amd64 digestsha256:c97c5eda5721975f0583e4625b0d02653f972d38e3455585f1f20c2aaef835bf
  • ArchiveReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 nowa170c5532214b2c42f58307c94881b84c33c525958422b2ef85e59d7ff657aad
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-08T21:17:54Z by KitForge release/build_trail.py
  • Sections9 sections, 7 fully recorded; 2 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.trail.json
ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.trail.jsonReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.trail.mdKubernetes product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductKubernetes (kubernetes) [MANIFEST.json]
  • Release tagv1.37.2-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/kubernetes:v1.37.2-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:796a0873bb107513d3cb32410005ab7cf1eee356fe90994e191466638ee146a6 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:c97c5eda5721975f0583e4625b0d02653f972d38e3455585f1f20c2aaef835bf [ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.tar.gz (bytes 608176380) [MANIFEST.json]
  • Archive sha256 at publisha170c5532214b2c42f58307c94881b84c33c525958422b2ef85e59d7ff657aad [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/kubernetes/kubernetes [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv1.37.2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitc50e5395f1ae2d4a2c05f28fdcc38c0916cc1a32 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashb6f41eac32ed0acabe358cf8afdac9fe0bdf9b38a0950f0f5a258d081acab553 (files 31265) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:d16333c9b63704ce2d8f4aff929589c90f0fd40ef003e49a7fbb3d2d7949667c [ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793102464 (utc 2026-10-27T12:01:04Z) [ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit 21a662bdd6974e1e462fe91e1415f9f9d120bf2d · dirty yes · first drive 3536
    • commit edc79852ba16a5e69eeda21d1a93d01cfc9748f9 · dirty yes · first drive 3544
    • commit 120579f1916582dbd0a42b015d97b8dd63740a06 · dirty yes · first drive 3632
    • commit 021891c892ce2ac3a1bdc021d55a3a7ee85ed12f · dirty yes · first drive 3674
    • commit 386e767715417178586a0abb96bca8c2ca92cabb · dirty yes · first drive 3677
    • commit 92dcb99fd5af2466b8a040e9b12f1cd9afdd07b3 · dirty yes · first drive 3689
    • commit 2d1ae189f0cfc9706683f33be126c89e775e7d32 · dirty yes · first drive 3710
    • commit 18261d862c425c2423a19eba7edc819a59a582a4 · dirty yes · first drive 3725
    • commit a5797296229775110455db099d4b5aa29941c582 · dirty yes · first drive 3731
    • commit 140ed2f441b69a1f7286874d7402f1794ec4e478 · dirty yes · first drive 3734
    • commit d8c7ef702518c86819947dd7826390bd0d237932 · dirty yes · first drive 3768
    • commit 8fae2b5b81cf94de3dcf8e35b830dce6d629cb3e · dirty yes · first drive 3813
    • commit 678cbcb0bbd61a6d885eab3d9776ddcdf7ce640d · dirty yes · first drive 3822
    • commit c20aa19bc0ab8c9fef7ff40e1f6a18c4169b166e · dirty yes · first drive 3838
    • commit 9297e5f1902d782e43b6ebf8fe9b54eba0e82889 · dirty yes · first drive 3857
    • commit 0ce62a3a548f16cde73a6e8600cacfdd38930d4d · dirty yes · first drive 3873
    • commit 58e9240297aa7166e0dec2e18a9c5ae2e84212bf · dirty yes · first drive 3881
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain749 (created 2026-10-28T03:36:08Z · trigger customer_request · upstream version v1.37.2) [chains, chains #749]
  • Requestbuild request #409 (rebuild) (requested at 2026-10-27T20:03:01Z · requested by kitforge-agent · version v1.37.1) [build_requests, build_requests #409]
  • Reasonrevision v1.37.1-CE-ubuntu24.04-r3: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #409 request_reason]
  • Supersedesreadystack/kubernetes:v1.37.1-CE-ubuntu24.04-r2 (chain 657) [chains, chains #657]

The path through the harness

Fully recorded

1 chain · 18 drives · 18 stages · 9 rewinds

Chain 749 release · ready_to_ship

Created 2026-10-28T03:36:08Z, upstream v1.37.2, build request 409 [chains, chains #749]

DriveStartedMinutesBuild hostHow it stopped
8272026-10-28T03:36:47Z34build host 4 withhold-publish stage_failed at admin_handbook [drive_runs, drive_runs #827] rebuilt from a build line's log
35362026-11-07T01:48:26Z33.6build host 4 withhold-publish stage_failed at verdict; first failed check scout_verdict:release_check_passed; 6 ticks [drive_runs, drive_runs #3536]
35442026-11-07T02:29:38Z31.9build host 4 withhold-publish stage_failed at verdict; first failed check scout_verdict:release_check_passed; 4 ticks [drive_runs, drive_runs #3544]
36322026-11-07T09:29:16Z53.6build host 4 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 15 ticks [drive_runs, drive_runs #3632]
36742026-11-08T03:36:12Z1.7build host 4 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3674]
36772026-11-08T04:01:29Z0.3build host 4 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3677]
36892026-11-08T04:29:47Z0.3build host 4 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3689]
37102026-11-08T06:00:02Z17.4build host 4 withhold-publish ready_to_ship at package_archive; 3 ticks [drive_runs, drive_runs #3710]
37252026-11-08T07:40:33Z7.6build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3725]
37312026-11-08T08:27:29Z8.1build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3731]
37342026-11-08T09:02:51Z1.4build host 4 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3734]
37682026-11-08T10:31:48Z1.3build host 4 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3768]
38132026-11-08T13:35:39Z0.3build host 4 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3813]
38222026-11-08T15:00:20Z0.3build host 4 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3822]
38382026-11-08T16:52:03Z1.4build host 4 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3838]
38572026-11-08T18:24:34Z7.8build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3857]
38732026-11-08T20:15:03Z7.1build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3873]
38812026-11-08T21:07:49Z—build host 4 publish-held not recorded [drive_runs, drive_runs #3881]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-28T03:36:53Z2026-10-28T03:36:53Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-28T03:37:20Z2026-11-07T01:48:59Z2
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree c6fed1f2fb14…
license_file cfc7749b96f6…
custody_inputs 7a792eda935b…
source_tree_hash a20cdf36bfdd…
source_file_manifest 56536f662778…
plan 2026-10-28T03:38:05Z2026-11-07T01:49:03Z2
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report e9886266f645…
input_pin_plan bf83a5da10d5…
toolchain_lock 93d444d692c0…
assemble_kit 2026-10-28T03:49:37Z2026-11-07T09:40:15Z4
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 2964f0d35988…
build_recipe aa1349b25175…
system_pinning eb3022ff0e97…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 40308db8f376…
verify_offline_sh 3e8184ea230c…
base_image_digests dbc51fdf0367…
dockerfile_offline 2964f0d35988…
first_build_digest 72c6066bba18…
remediate 2026-10-28T03:50:47Z2026-11-07T09:40:19Z4
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log d4c7f488c400…
security_report 93d74953c991…
build_kit 2026-10-28T04:06:40Z2026-11-07T09:56:28Z4
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 7ab8accc87db…
locked_digest 52177e0fd787…
freeze_manifest 627599eb52c1…
offline_rebuild_transcript 37fd2c226f84…
verdict 2026-10-28T04:08:40Z2026-11-07T09:58:33Z4
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 5087f41ad1cc…
publish_image 2026-10-28T04:09:45Z2026-11-07T09:59:39Z2
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 1addca42f007…
promotion_record 03e3d32852ca…
boot_instance 2026-10-28T04:10:03Z2026-11-08T06:00:42Z5 — instance_handle f33fa8a19c00…
sbom 2026-10-28T04:10:31Z2026-11-07T10:00:32Z2
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 367967677601…
sbom_json 6b8e143cab85…
schema_discovery 2026-10-28T04:10:34Z2026-11-07T10:00:35Z2
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash b885302354be…
dependency_tree 86d01b66573d…
table_classification da16303b0e2a…
admin_handbook 2026-10-28T04:10:44Z2026-11-07T10:10:37Z2
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 3914c3658f82…
admin_handbook d778ade55d65…
db_handbook 2026-11-07T10:20:13Z2026-11-07T10:20:13Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 9e0fce33b1d8…
seed_isolation 101587b85ef3…
seed_data 2026-11-07T10:20:23Z2026-11-07T10:20:24Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 0538112eb492…
seed_cases_json 803e3a4361a0…
seed_validate 2026-11-07T10:20:27Z2026-11-07T10:20:27Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 6b6d853e38c0…
usecase_validate 2026-11-07T10:20:57Z2026-11-07T10:20:58Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests bea4c785166f…
test_results 9e189ba41557…
usecase_contract 9e59328fa26b…
finalize_docs 2026-11-07T10:21:04Z2026-11-08T06:00:48Z2
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 5980def484e4…
release_notes b92a5d2873e4…
api_integration_guide f5845e674720…
package_archive invalidated 2026-11-08T21:07:08Z 2026-11-07T10:22:49Z2026-11-08T20:22:11Z14
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 273b9bc5d92f…
checksums b0b675515f00…
verify_md b0f865728bba…
rebuild_md 9127721c2478…
manifest_txt 7f91928ab7da…
actions_jsonl 1c20e66f2a81…
provenance_md 1ad5a8d25cf4…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 1274ffec367e…

[stage_runs]

Rewinds

  • 2026-11-07T01:48:28Z: admin_handbook to acquire on source_changed (source changed: the acquired source is v1.37.1 (commit f78e722310e5) but the strategy builds v1.37.2: acquire runs again so the source tree, its hash, the custody record and the acquisition copy describe what is built) [stage_events, stage_events #23060]
  • 2026-11-07T02:29:41Z: verdict to assemble_kit on strategy_changed (strategy changed (8b7e8fb933e2 -> 3dd462ddf865)) [stage_events, stage_events #23238]
  • 2026-11-07T09:29:20Z: verdict to assemble_kit on strategy_changed (strategy changed (3dd462ddf865 -> b0ccfb6fba6b)) [stage_events, stage_events #24396]
  • 2026-11-08T05:57:12Z: package_archive to finalize_docs on docs_redo (scripts/redo-docs.py --stage finalize_docs --delete deliverables/api-guide/API_INTEGRATION_GUIDE.md) [stage_events, stage_events #25246]
  • 2026-11-08T07:32:17Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #25421]
  • 2026-11-08T08:09:51Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #25499]
  • 2026-11-08T08:59:35Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #25658]
  • 2026-11-08T18:58:17Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27113]
  • 2026-11-08T21:07:08Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27400]

Model work per stage

1 item not recorded

Role: writer model. Calls up to 2026-11-08T20:22:11Z.

90 calls over 4 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook411713 2241891 —
db_handbook451903 4283899 —

[micro_step_runs]

  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

Fully recorded

Role: review model.

5 rounds, 5 counted, $8.89 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-08T06:18:39Z 1028 findings to repackage [held_rounds, held_rounds #1481] $2.24 3 rounds, $40.00 a16456eef94b…
22026-11-08T07:48:41Z 0011 clean to repackage [held_rounds, held_rounds #1486] $1.44 3 rounds, $40.00 06de34886fa7…
32026-11-08T08:36:41Z 0415 findings to repackage [held_rounds, held_rounds #1490] $1.82 3 rounds, $40.00 c674a3389d6c…
42026-11-08T18:32:52Z 0221 findings to repackage [held_rounds, held_rounds #1533] $1.75 3 rounds, $40.00 bcf8bd1cf19b…
52026-11-08T20:22:27Z 006 clean to publish [held_rounds, held_rounds #1538] $1.66 3 rounds, $40.00 273b9bc5d92f…

Defects

Fully recorded
  • Ledger entries83 [defects, defects where product_slug=kubernetes and this tag or chain]
  • Disclosed in the archive83 [docs/defects/defects.json, entries]

83 ledger entries: by severity critical 1, low 76, high 6; by status fixed-before-release 83.

DefectSeverityStatusFound byFixed in
RSD-kubernetes-2ec26141fe
Database handbook: Ran the documented backup then restore on this image in both modes (control plane, and --privileged --user 0). [defects, defects #171341]		criticalfixed-before-releaseheld review (review model)—
RSD-kubernetes-a5a47b2a28
Database handbook: No 'Operating' section exists (only 'Operating facts', which has a backup but no restore); the restore in Storage and Volumes (:1210-1215) fails as written (see :1213), so no tested restore exists. [defects, defects #171342]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-10ea96a377
Database handbook: api-guide/API_INTEGRATION_GUIDE.md is 37 lines: a route table only; line 5 says 'It does not list request fields' and it has no request/response examples or integration guidance (same defect as the… [defects, defects #171343]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-4df9a8ff3b
Database handbook: API_INTEGRATION_GUIDE.md:5 'It does not list request fields; read them from that specification' and has no request/response documentation. [defects, defects #171344]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-9a9b11dc92
Database handbook: IMAGE_CONFIG.json "User": "999"; live: control-plane container `docker exec ... [defects, defects #171345]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-18fc9f2014
Admin handbook: IMAGE_CONFIG.json "User": "999"; IMAGE_EVIDENCE.json user 999 nonroot true; live `id` in the default container -> uid=999(kube) gid=999(kube). [defects, defects #171346]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-8c80cc05ef
Admin handbook: Live control-plane container: `supervisorctl status` lists only etcd, kube-apiserver, kube-controller-manager, kube-scheduler, kube-init; `kubectl get nodes` -> 'No resources found'. [defects, defects #171347]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-a376d15b62
Admin handbook: Live (after startup, ~40 s): anonymous `curl -sk https://127.0.0.1:6443/metrics`, `/openapi/v2`, `/openapi/v3` -> HTTP 403 (Forbidden); /livez /readyz /healthz /version -> 200. [defects, defects #171348]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-bb25dd4ebb
Admin handbook: Live: anonymous GET /version returns the server's JSON ({major:1, minor:37, ...}); the API server has no client version. [defects, defects #171349]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-5993421083
Database handbook: Live: GET /version returns only the server's version JSON. [defects, defects #171350]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-c26f905796
Admin handbook: Live: `openssl x509 -in /var/lib/kubernetes/pki/apiserver.crt -noout -dates` -> 2026-11-08 to 2027-11-08 (also healthcheck-client.crt); ca.crt notAfter 2036-11-05. [defects, defects #171351]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-bb09d75149
Admin handbook: The sentence names four endpoints and says three; ADMIN_HANDBOOK.md:168 says four. [defects, defects #171352]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-afe057d884
Admin handbook: Live single-node `ss -ltnp`: kube-proxy 127.0.0.1:10249 and 127.0.0.1:10256, kubelet *:10250. [defects, defects #171353]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-af940d59a7
Admin handbook: Live: `kubectl get node -o jsonpath={.items[0].spec.podCIDR}` -> 10.244.0.0/24; /etc/cni/net.d conflist ranges subnet 10.244.0.0/24. [defects, defects #171354]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-854be02391
Admin handbook: Live: node podCIDR 10.244.0.0/24; CNI ptp subnet 10.244.0.0/24; contradicts ADMIN_HANDBOOK.md:263 and :528. [defects, defects #171355]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-8fd3f8e285
Admin handbook: Live single-node `kubectl get clusterrole | wc -l` -> 75 (incl. [defects, defects #171356]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-8b23cbd047
Admin handbook: On this cgroup v2 host `head -3 /proc/cgroups` lists controller names (cpuset, cpu, ...) in the first column, never 'cgroup2'; `stat -fc %T /sys/fs/cgroup` -> cgroup2fs. [defects, defects #171357]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-674e78adb6
Admin handbook: Live: re-created the control-plane container on the same volume with -e KUBE_PUBLIC_ENDPOINT=kube.example.test:7443 (same IP 172.17.0.2): apiserver.crt SAN unchanged (no kube.example.test),… [defects, defects #171358]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-385041addf
Admin handbook: Same live evidence as ADMIN_HANDBOOK.md:945 (certificate re-issued with the new endpoint name at an address change); contradicts :218 and :1259. [defects, defects #171359]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-78e7fd8d43
Database handbook: Same live evidence as ADMIN_HANDBOOK.md:945; contradicts the sentence before it in this paragraph ('re-issued on the next start' when the address changes). [defects, defects #171360]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-af54fb569d
Database handbook: Live: re-created the container on the same volume with new -e values: it started healthy and kept the data (cm1 intact). [defects, defects #171361]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-3543fe69a6
Database handbook: Live: `curl -sk https://127.0.0.1:6443/readyz` -> `ok`; only `/readyz?verbose` lists the checks ([+]ping ok ...). [defects, defects #171362]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-cda96cfcb0
Database handbook: Live: plain /readyz returns `ok` with no detail; contradicts DB_HANDBOOK.md:1391. [defects, defects #171363]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-5dbef1626b
Database handbook: Live: plain /readyz -> `ok`; `[+]` lines and `readyz check passed` appear only with ?verbose. [defects, defects #171364]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-f50917cb1e
Database handbook: Under 'Four endpoints are readable without authentication' this entry says unauthenticated access is refused; the list omits /healthz, which answers 200 anonymously (live), contradicting :682, :1152… [defects, defects #171365]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-a5e371c251
Database handbook: Live `ss -ltnp`: kube-apiserver *:6443; contradicts DB_HANDBOOK.md:760 and :1281. [defects, defects #171366]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-8937d7265d
Database handbook: Live: started the documented run commands with volumes that did not exist (jt-ha749-kube-data, jt-ha749-kube-containerd, jt-ha749-kube-api-data); Docker created them and the containers started… [defects, defects #171367]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-4e48f4873e
Admin handbook: Live: control-plane container started with -e KUBE_PUBLIC_ENDPOINT=kube.example.test:7443: admin.conf server is https://kube.example.test:7443 and `docker exec ... [defects, defects #171368]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-f32ac82947
Admin handbook: The restore summary ends 'and start the container', but the procedure stops two programs inside a running container; docker start does nothing then. [defects, defects #172783]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-b6b701e56e
Admin handbook: Says the release runs as a single-node cluster only and that the cluster consists of one registered node, but the default mode has no node. [defects, defects #172784]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-f0456792b2
Admin handbook: Recommends the control-plane mode for deployments where worker nodes are added separately, contradicting the statements that no node can be added; no record tests an external node. [defects, defects #172785]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-bab09d730f
Database handbook: Says the mode suits a host with separate node machines and in the next sentence that there is no way to add nodes. [defects, defects #172786]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-19c5303573
Database handbook: States the endpoint cannot be changed without a new volume, contradicting the same-volume routes documented elsewhere and the measured behaviour. [defects, defects #172787]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-a31a2d0089
Admin handbook: Says the log format identifies the component, but five components use the same glog format and containerd/CoreDNS formats are not listed. [defects, defects #172788]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-0337051e27
Database handbook: Same overclaim: a source cannot be identified by format among the glog components, and containerd and CoreDNS formats are missing. [defects, defects #172789]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-a0bcde576a
Admin handbook: Tells the reader to point admin.conf at the host's IP or DNS name, which fails certificate verification unless that name was given at creation. [defects, defects #172790]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-3a4af0ce2e
API guide: The API guide contains only a route table; it states it does not list request fields and gives no example. [defects, defects #172791]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-3e40b8e81b
API guide: Cluster-scoped create (POST /api/v1/{resource}) is served but not listed; the same applies to the /apis/{group}/{version}/{resource} row. [defects, defects #172792]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-0cbabbc870
API guide: Lists the cluster-scoped group collection as GET only; POST create (clusterroles 201) and DELETE (200) are served. [defects, defects #172793]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-05a80fb6a0
Admin handbook: Setting KUBE_API_SANS on an existing kube-data volume does not add the name to the serving certificate while the container's address is unchanged (measured); only a changed address or a fresh volume… [defects, defects #173312]		highfixed-before-releaseheld review (review model)—
RSD-kubernetes-82e062e492
Admin handbook: Setting KUBE_API_SANS on an existing kube-data volume does not add the name to the serving certificate while the container's address is unchanged (measured); only a changed address or a fresh volume… [defects, defects #173313]		highfixed-before-releaseheld review (review model)—
RSD-kubernetes-c7040aa3cc
Database handbook: Setting KUBE_API_SANS on an existing kube-data volume does not add the name to the serving certificate while the container's address is unchanged (measured); only a changed address or a fresh volume… [defects, defects #173314]		highfixed-before-releaseheld review (review model)—
RSD-kubernetes-2055d8a7f6
Database handbook: Setting KUBE_API_SANS on an existing kube-data volume does not add the name to the serving certificate while the container's address is unchanged (measured); only a changed address or a fresh volume… [defects, defects #173315]		highfixed-before-releaseheld review (review model)—
RSD-kubernetes-8fdbcd8f13
Admin handbook: The handbook lists the cluster-scoped collection routes as GET only, contradicting the API guide and the measured behaviour (cluster-scoped create is served); this is the paraphrase of the round-2… [defects, defects #173316]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-25a968ad31
Admin handbook: The handbook lists the cluster-scoped collection routes as GET only, contradicting the API guide and the measured behaviour (cluster-scoped create is served); this is the paraphrase of the round-2… [defects, defects #173317]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-a0dfb8014c
Database handbook: The handbook lists the cluster-scoped collection routes as GET only, contradicting the API guide and the measured behaviour (cluster-scoped create is served); this is the paraphrase of the round-2… [defects, defects #173318]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-8019ccc7f1
Database handbook: The handbook lists the cluster-scoped collection routes as GET only, contradicting the API guide and the measured behaviour (cluster-scoped create is served); this is the paraphrase of the round-2… [defects, defects #173319]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-6cfbfe63f4
Database handbook: The handbook lists the cluster-scoped collection routes as GET only, contradicting the API guide and the measured behaviour (cluster-scoped create is served); this is the paraphrase of the round-2… [defects, defects #173320]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-d16589cf4f
Database handbook: The handbook lists the cluster-scoped collection routes as GET only, contradicting the API guide and the measured behaviour (cluster-scoped create is served); this is the paraphrase of the round-2… [defects, defects #173321]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-f63fab087d
Database handbook: The handbook lists the cluster-scoped collection routes as GET only, contradicting the API guide and the measured behaviour (cluster-scoped create is served); this is the paraphrase of the round-2… [defects, defects #173322]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-0978279171
Database handbook: The description calls a namespaced collection route 'cluster-scoped resources within a namespace', which is self-contradictory. [defects, defects #173323]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-f7f106ac63
API guide: The route table omits POST on subresources (eviction, binding, token) and DELETE on cluster-scoped collections, which are served: the same class as the round-2 finding that served create was not… [defects, defects #173324]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-8251c5dd48
Admin handbook: Paraphrase of the round-2 finding 'the format identifies the component'. [defects, defects #173325]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-84bc9532e3
Admin handbook: The sentence says both modes need cgroup v2, contradicting the Node requirements fact and the control-plane host requirement. [defects, defects #173326]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-e8cfc36bbf
Admin handbook: kubelet's API is bound to the wildcard address, not only the container's own address (the sentence is repeated in several sections). [defects, defects #173327]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-d3d285460f
Database handbook: Contradicts the following sentence and the measured listener. [defects, defects #173328]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-3723a33b5c
Database handbook: The handbooks state kubernetes-admin is the only administrator account/credential, but a second, RBAC-bypassing credential is in the same volume (disclosed in the release notes only). [defects, defects #173329]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-cc655f6af5
Database handbook: Paraphrase of the round-3 major (KUBE_API_SANS / KUBE_PUBLIC_ENDPOINT on an existing volume): this sentence gives setting KUBE_PUBLIC_ENDPOINT as the remedy for remote access with no volume caveat;… [defects, defects #182827]		highfixed-before-releaseheld review (review model)—
RSD-kubernetes-5fe301ae98
Database handbook: Same class as the round-3 major: states the SANS/endpoint remedy with no existing-volume caveat; measured to leave the certificate unchanged while the address is unchanged. [defects, defects #182828]		highfixed-before-releaseheld review (review model)—
RSD-kubernetes-1cd483cc9a
Admin handbook: Remedy bullet does not say it applies to a fresh volume only; the caveat is in the preceding section. [defects, defects #182829]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-868f79b296
Admin handbook: Round-3 minor not fixed in the admin handbook: states one administrator account while a second, RBAC-bypassing credential is in the same volume (DB_HANDBOOK.md:1040 discloses it). [defects, defects #182830]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-20af280ef5
Admin handbook: 'cannot be bypassed' is contradicted by the RBAC-bypassing super-admin credential in the same volume (same round-3 class). [defects, defects #182831]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-44c142be3c
Database handbook: 'one administrator account' contradicts the second credential disclosed in the same section. [defects, defects #182832]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-b04dd25a26
Admin handbook: Round-3 minor paraphrased: says the host needs cgroup v2 'for the container to function', i.e. [defects, defects #182833]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-e73a438d20
Admin handbook: Round-3 minor not fixed here: kubelet's API is bound to the wildcard address, not the container's own address. [defects, defects #182834]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-47538cb9c6
Database handbook: Round-3 minor: kubelet's API listens on *:10250, not only the container's own address. [defects, defects #182835]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-3650a80c06
API guide: Route table omits DELETE on cluster-scoped collections, which is served (round-3 minor, same class as the round-2 'served create not listed'). [defects, defects #182836]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-460ccbe326
API guide: Same: DELETE on a cluster-scoped group collection is served (clusterroles DELETE with labelSelector 200) but not listed. [defects, defects #182837]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-de1118475b
Database handbook: Rewritten section still omits the served DELETE on cluster-scoped collections. [defects, defects #182838]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-3186260643
Database handbook: Rewritten section still omits the served DELETE on cluster-scoped group collections. [defects, defects #182839]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-7ea269019d
Admin handbook: Omits DELETE on cluster-scoped collections. [defects, defects #182840]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-48554a1e33
Admin handbook: Lists named namespaced resources as GET,PATCH,PUT (DELETE is served: the API guide row, and the same list's API-group entry) and omits DELETE on cluster-scoped collections. [defects, defects #182841]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-7c50b66140
Admin handbook: Route list omits POST on subresources and on cluster-scoped collections and DELETE on cluster-scoped collections (round-3 minors, same class), contradicting the API guide. [defects, defects #182842]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-4540a4710e
Database handbook: Lists POST on a named resource; measured POST /api/v1/namespaces/zz1/pods/x 405 (the API guide lists no POST here). [defects, defects #182843]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-5bd686a4a4
Database handbook: Lists the cluster-scoped collection as GET only; POST (create) 201 and DELETE 200 are served (the round-2/3 class). [defects, defects #182844]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-8e00a6713b
Database handbook: Lists POST on a named cluster-scoped resource; measured POST /api/v1/namespaces/zz1 405. [defects, defects #182845]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-5d0b6d58f1
Database handbook: Lists POST on a named group resource, which the API guide does not list (named resources answer 405 to POST). [defects, defects #182846]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-d18a5d1e80
Database handbook: Lists POST on a named cluster-scoped group resource, not served (405 class). [defects, defects #182847]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-2f04c7fd73
Admin handbook: Says all six entries are masked; the entrypoint masks only entries whose host value differs (3 of 6 on the review host). [defects, defects #184052]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-66438ee35d
Admin handbook: Same: 'mounts read-only files over six kernel settings' is not what happens when the host value already matches. [defects, defects #184053]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-68cad4aa47
Admin handbook: Attributes cgroups and mounts to the network namespace. [defects, defects #184054]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-9ba2df65bf
Admin handbook: The documented remote-access remedy breaks the documented in-container kubectl commands; the caveat is in one other section only. [defects, defects #184055]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-813866cd76
Admin handbook: 'mount a fresh directory' contradicts the named-volumes-only rule for the default mode. [defects, defects #184056]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:c97c5eda5721975f0583e4625b0d02653f972d38e3455585f1f20c2aaef835bf · published digest sha256:c97c5eda5721975f0583e4625b0d02653f972d38e3455585f1f20c2aaef835bf · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 459) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T21:08:25Z · failing Docker Scout counts 118 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T21:07:59Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3759113611 · transparency-log entry · integrated 2026-11-08T21:16:17Z) [ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:796a0873bb107513d3cb32410005ab7cf1eee356fe90994e191466638ee146a6 · state attached · log index 3759113813 · transparency-log entry
    • kind sbom · digest sha256:796a0873bb107513d3cb32410005ab7cf1eee356fe90994e191466638ee146a6 · state attached · log index 3759113917 · transparency-log entry
    • kind vsa · digest sha256:796a0873bb107513d3cb32410005ab7cf1eee356fe90994e191466638ee146a6 · state attached · log index 3759113995 · transparency-log entry
    • kind provenance · digest sha256:c97c5eda5721975f0583e4625b0d02653f972d38e3455585f1f20c2aaef835bf · state attached · log index 3759114110 · transparency-log entry
    • kind sbom · digest sha256:c97c5eda5721975f0583e4625b0d02653f972d38e3455585f1f20c2aaef835bf · state attached · log index 3759114220 · transparency-log entry
    • kind vsa · digest sha256:c97c5eda5721975f0583e4625b0d02653f972d38e3455585f1f20c2aaef835bf · state attached · log index 3759114352 · transparency-log entry
    (at 2026-11-08T21:16:18Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/kubernetes/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-08T06:18:50Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:c97c5eda5721975f0583e4625b0d02653f972d38e3455585f1f20c2aaef835bf [clean-room rebuild ledger, runs[631]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-07T09:59:39Z [stage_runs, stage_runs chain 749 stage publish_image]
  • Archive manifests written2026-11-08T21:12:04Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 968 · probed 2026-11-07T09:48:29Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-08T21:17:54Z generated: by KitForge release/build_trail.py · generator commit 58e9240297aa7166e0dec2e18a9c5ae2e84212bf
  • 2026-11-08T21:20:07Z publication: promoted at 2026-11-08T21:18:27Z · promoted digest sha256:796a0873bb107513d3cb32410005ab7cf1eee356fe90994e191466638ee146a6 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 389 · checklist status complete · checklist at 2026-11-08T21:20:07Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

24 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/kubernetes/v1.37.2-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/kubernetes/v1.37.2-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/kubernetes/v1.37.2-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/kubernetes/v1.37.2-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/kubernetes/v1.37.2-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)409
chainssadb, ReadyStack's engine database (not published)749
defectssadb, ReadyStack's engine database (not published)kubernetes v1.37.2-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 749
held_roundssadb, ReadyStack's engine database (not published)chain 749
micro_step_runssadb, ReadyStack's engine database (not published)chain 749
release_imagessadb, ReadyStack's engine database (not published)kubernetes v1.37.2-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 749
stage_runssadb, ReadyStack's engine database (not published)chain 749
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—