Kubernetes v1.37.2-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/kubernetes:v1.37.2-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/kubernetes:v1.37.2-CE-ubuntu24.04-r2
  • Index digestsha256:664856ed3b07522c61397a1c0db0978e4042b46e56399a9fca2e691a8c65e1f2
  • linux/amd64 digestsha256:1f4895c24f159d8fb234890dda2ae57c1f6aefce8d472712d14382cda41c4487
  • ArchiveReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now8b561f90270d2b771abf370f7373e5c8a57bb2b65fddb57a0f59ed1bd61dc458
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-12T10:24:29Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.trail.json
ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.trail.jsonReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.trail.mdKubernetes product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductKubernetes (kubernetes) [MANIFEST.json]
  • Release tagv1.37.2-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/kubernetes:v1.37.2-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:664856ed3b07522c61397a1c0db0978e4042b46e56399a9fca2e691a8c65e1f2 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:1f4895c24f159d8fb234890dda2ae57c1f6aefce8d472712d14382cda41c4487 [ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.tar.gz (bytes 610743804) [MANIFEST.json]
  • Archive sha256 at publish8b561f90270d2b771abf370f7373e5c8a57bb2b65fddb57a0f59ed1bd61dc458 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/kubernetes/kubernetes [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv1.37.2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitc50e5395f1ae2d4a2c05f28fdcc38c0916cc1a32 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashb6f41eac32ed0acabe358cf8afdac9fe0bdf9b38a0950f0f5a258d081acab553 (files 31265) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:a278037797c848db1bd6d3b82a2df539e9064e833fffb967674771b3ec870b5b [ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794391135 (utc 2026-11-11T09:58:55Z) [ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.11-bookworm@sha256:dc40a13b61304647ed7e5d581d246b86413dfc29d63c6d018310feb93cd98fc0 · platform digest sha256:79ecd0a7157c7a4cf3b281ced8465350591bf54fedab540e75374a003e1fde7e
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit a09bd1cdda98a0fdbed6236e2bb209da3e6cc509 · dirty yes · first drive 4321
    • commit d37a66407cd196f2bd6ddc33e05388201d1645bb · dirty yes · first drive 4332
    • commit 610e38b4db1278bcf2eddc75bc160bb967a516ed · dirty yes · first drive 4378
    • commit 31c1e6418d56f0e5e2b8dcbfde0e0fff1fba715c · dirty yes · first drive 4386
    • commit c8155eab7005e164326d14c384d473b047cfc227 · dirty yes · first drive 4398
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain987 (created 2026-11-11T23:12:12Z · trigger customer_request · upstream version v1.37.2) [chains, chains #987]
  • Requestbuild request #657 (rebuild) (requested at 2026-11-11T09:58:58Z · requested by kitforge-agent · version v1.37.2) [build_requests, build_requests #657]
  • Reasonrerelease agenda REVISION -> v1.37.2-CE-ubuntu24.04-r2 (decay loop, IMP-08) [build_requests, build_requests #657 request_reason]
  • Supersedesreadystack/kubernetes:v1.37.2-CE-ubuntu24.04-r1 (chain 749) [chains, chains #749]

The path through the harness

Fully recorded

1 chain · 5 drives · 18 stages · 4 rewinds

Chain 987 release · ready_to_ship

Created 2026-11-11T23:12:12Z, upstream v1.37.2, build request 657 [chains, chains #987]

DriveStartedMinutesBuild hostHow it stopped
43212026-11-11T23:12:52Z73.9build host 2 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4321]
43322026-11-12T01:13:58Z7.7build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4332]
43782026-11-12T08:28:14Z8.5build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4378]
43862026-11-12T09:22:32Z8.1build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4386]
43982026-11-12T10:13:40Z—build host 2 publish-held not recorded [drive_runs, drive_runs #4398]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-11T23:13:03Z2026-11-11T23:13:03Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json e79c33f20705…
acquire 2026-11-11T23:13:19Z2026-11-11T23:13:22Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree c6fed1f2fb14…
license_file cfc7749b96f6…
custody_inputs 7a792eda935b…
source_tree_hash a20cdf36bfdd…
source_file_manifest 56536f662778…
plan 2026-11-11T23:14:14Z2026-11-11T23:14:15Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 2f0c33f456ef…
input_pin_plan e9b3893709c6…
toolchain_lock 9e273b68a788…
assemble_kit 2026-11-11T23:26:25Z2026-11-11T23:26:25Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 63759329609a…
build_recipe 9ae6b31bbf89…
system_pinning eb3022ff0e97…
build_offline_sh 6ab4f08a6ec7…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health c3cdb388d837…
verify_offline_sh 3e8184ea230c…
base_image_digests 0c27c3d4b5c5…
dockerfile_offline 63759329609a…
first_build_digest e5f14ff8f936…
remediate 2026-11-11T23:27:29Z2026-11-11T23:27:30Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 92557b33b6df…
security_report be74dc1b7d61…
build_kit 2026-11-11T23:44:42Z2026-11-11T23:44:43Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 9289a0ea32b5…
locked_digest ffdc6cb2450e…
freeze_manifest d7a9307033f9…
offline_rebuild_transcript 7a1ba442defd…
verdict 2026-11-11T23:46:51Z2026-11-11T23:46:51Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 43a0aec2d2ba…
publish_image 2026-11-11T23:47:54Z2026-11-11T23:47:55Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 45999c2d9dab…
promotion_record aa6920d1c00d…
boot_instance 2026-11-11T23:48:14Z2026-11-11T23:48:18Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 0c22a7856c7b…
sbom 2026-11-11T23:48:45Z2026-11-11T23:48:46Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md ae4312c0737d…
sbom_json 56a0dafbca45…
schema_discovery 2026-11-11T23:48:49Z2026-11-11T23:48:49Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash b885302354be…
dependency_tree 86d01b66573d…
table_classification da16303b0e2a…
admin_handbook 2026-11-11T23:57:27Z2026-11-11T23:57:28Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 3914c3658f82…
admin_handbook 58a8f7aac5f4…
db_handbook 2026-11-12T00:06:38Z2026-11-12T00:06:39Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook c974d2fbe553…
seed_isolation 101587b85ef3…
seed_data 2026-11-12T00:06:49Z2026-11-12T00:06:50Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 0538112eb492…
seed_cases_json eb002c53f005…
seed_validate 2026-11-12T00:06:52Z2026-11-12T00:06:53Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 11d1894e1bcf…
usecase_validate 2026-11-12T00:07:23Z2026-11-12T00:07:24Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests bea4c785166f…
test_results 9e189ba41557…
usecase_contract 91ca92facf95…
finalize_docs 2026-11-12T00:07:30Z2026-11-12T00:07:31Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json f0974a0f93e8…
release_notes 2affafc337b3…
api_integration_guide ad42503204dc…
package_archive invalidated 2026-11-12T10:13:05Z 2026-11-12T00:26:42Z2026-11-12T09:30:38Z4
36 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 unpack_files
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar f30f0b173ba2…
checksums 6ec112fa4cf0…
verify_md ebcae9fbaae6…
rebuild_md 1a9a632c22fc…
manifest_txt 44efb0a69822…
actions_jsonl fe467fd501fa…
provenance_md ec1dc6f2bd9d…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 89287f4344aa…

[stage_runs]

Rewinds

  • 2026-11-12T01:04:00Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #32363]
  • 2026-11-12T01:50:40Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #32418]
  • 2026-11-12T09:11:40Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33305]
  • 2026-11-12T10:13:05Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33473]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-12T09:30:38Z.

81 calls over 4 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 016201 —
remediate2001 022124 L-A08, L-038, L-036, L-034, L-032
admin_handbook411603 5256373 —
db_handbook361203 3213784 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

4 rounds, 4 counted, $6.48 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-12T00:28:30Z 0213 findings to repackage [held_rounds, held_rounds #1769] $1.80 3 rounds, $40.00 efa87a6e25f5…
22026-11-12T01:22:12Z 219 findings to repackage [held_rounds, held_rounds #1770] $1.99 3 rounds, $40.00 cdd0be57a0f4…
32026-11-12T08:37:12Z 023 findings to repackage [held_rounds, held_rounds #1796] $1.33 3 rounds, $40.00 7f01ecddc468…
42026-11-12T09:31:23Z 004 clean to publish [held_rounds, held_rounds #1804] $1.36 3 rounds, $40.00 f30f0b173ba2…

Defects

Fully recorded
  • Ledger entries34 [defects, defects where product_slug=kubernetes and this tag or chain]
  • Disclosed in the archive34 [docs/defects/defects.json, entries]

34 ledger entries: by severity high 5, low 28, critical 1; by status fixed-before-release 34.

DefectSeverityStatusFound byFixed in
RSD-kubernetes-198e6bf676
Database handbook: States the image's runtime identity is root; the image default is uid 999 (kube). [defects, defects #255468]		highfixed-before-releaseheld review (review model)—
RSD-kubernetes-353b29d637
Admin handbook: Says the offline-rebuilt image carries the release tag; BUILD_OFFLINE.sh produces an untagged image. [defects, defects #255469]		highfixed-before-releaseheld review (review model)—
RSD-kubernetes-960f915580
Admin handbook: Opens with the root identity (from a --user 0 run) as if it were the image's identity, contradicting the default user 999 stated elsewhere. [defects, defects #255470]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-0e2c197e86
Admin handbook: Says the customer must edit admin.conf and that KUBE_API_SANS controls the certificate; admin.conf is rewritten automatically and an existing certificate is not updated by KUBE_API_SANS. [defects, defects #255471]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-251a34fea3
Database handbook: The /version endpoint does not report a Kustomize version. [defects, defects #255472]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-89cb561a45
Database handbook: Names the cluster DNS Service wrongly. [defects, defects #255473]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-758a34febd
Database handbook: Plain /readyz returns ok; the detailed list requires ?verbose. [defects, defects #255474]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-4c38154f42
Admin handbook: Plain /readyz does not return a detailed status. [defects, defects #255475]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-021ec0c0ed
Database handbook: The endpoint is not placed into the certificate's Common Name (CN is kube-apiserver). [defects, defects #255476]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-a59fc38b94
Database handbook: Calls the single-node command the container's unchanged default. [defects, defects #255477]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-e1bee87496
Database handbook: The verification script never uses an existing data volume. [defects, defects #255478]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-03fa0ecbb0
Admin handbook: No startup compatibility validation exists. [defects, defects #255479]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-a03ec69bca
Admin handbook: The image does not start with no network at all. [defects, defects #255480]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-3dfd8b7bf3
Database handbook: Control-plane section uses the single-node container name. [defects, defects #255481]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-a4ab5a89c6
Database handbook: No separate kube-apiserver healthz listener exists. [defects, defects #255482]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-7ac72ee2fd
Admin handbook: The documented etcd restore works once, then silently restores nothing on the next use: the mv into the existing etcd-old fails, the later steps still succeed and etcd restarts on the old,… [defects, defects #255930]		criticalfixed-before-releaseheld review (review model)—
RSD-kubernetes-bb88e19e2a
Admin handbook: The sentence says the entrypoint processes arguments to configure the cluster and that this is how to supply environment variables or cluster configuration; the entrypoint never reads its arguments,… [defects, defects #255931]		highfixed-before-releaseheld review (review model)—
RSD-kubernetes-7f354e3c4f
Database handbook: The heading calls the single-node command 'the Default Cluster' although the image's default, and the handbook's own definition of default elsewhere, is the control-plane mode. [defects, defects #255932]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-8255b64f27
Database handbook: 'Suitable for managing external clusters' is unsupported: this API server manages only its own etcd-backed cluster. [defects, defects #255933]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-27bac61a1c
Admin handbook: The handbook points the customer to 'verified request examples and integration guidance' in the API guide; the guide has no request examples. [defects, defects #255934]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-8cf462dd25
Admin handbook: Repeats the promise of verified integration examples that the API guide does not contain. [defects, defects #255935]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-cef9da6e81
Database handbook: Promises verified request examples the API guide does not contain. [defects, defects #255936]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-0d1b6f2b08
Database handbook: Container names switch between kubernetes and kubernetes-api inside one control-plane procedure, so a customer who started the default mode gets 'No such container' on part of the commands. [defects, defects #255937]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-edc3e5a33b
Database handbook: Two names for the backup file between the Operating facts and the restore procedure of the same handbook. [defects, defects #255938]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-700cb56b37
Admin handbook: The documented docker exec kubectl commands stop working when KUBE_PUBLIC_ENDPOINT is set to a name the container cannot resolve; the handbook only warns about the host side. [defects, defects #255939]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-93bee594f8
Docker Hub README: The README calls the build kit a free download for any registered account while the bundle manifest records it as a paid file (1000 cents, free_release false). [defects, defects #255940]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-831a41cd6d
Admin handbook: The restore steps read /var/lib/kubernetes/etcd-snapshot.db inside the container, but the handbook tells the customer to keep the snapshot outside the volume and never says how to put it back. [defects, defects #262231]		highfixed-before-releaseheld review (review model)—
RSD-kubernetes-27c8e6801c
Database handbook: Same as the Admin Handbook: the restore reads the snapshot from inside the volume while the handbook says to keep it elsewhere, with no step to copy it back; after a failed restore command the… [defects, defects #262232]		highfixed-before-releaseheld review (review model)—
RSD-kubernetes-76c0c9072c
Admin handbook: The backup and restore commands all use `docker exec kubernetes`/`docker cp kubernetes:`, but the default (control-plane) run command names its container kubernetes-api, so a customer who started… [defects, defects #262233]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-86b8927789
Database handbook: Backup and restore commands name only the container `kubernetes`, while this handbook's default control-plane run command names it kubernetes-api; no note here says to substitute the name. [defects, defects #262234]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-5efffde171
Database handbook: Contradicts the previous paragraph and the Operating facts (the API serving certificate is re-issued when the container's address changes, with the current KUBE_PUBLIC_ENDPOINT/KUBE_API_SANS names)… [defects, defects #262235]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-c99352ee53
Database handbook: KUBE_ADVERTISE_ADDRESS is described three different ways in this handbook and the Admin Handbook ('kubelet advertises', 'API server advertises', 'control plane advertises'). [defects, defects #265012]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-b29dc3a1ec
Admin handbook: The restore text offers 'into a new container' but only restores the etcd snapshot; the PKI the handbook says is critical is never put back, so a new volume starts with a new CA. [defects, defects #265013]		lowfixed-before-releaseheld review (review model)—
RSD-kubernetes-495b46296a
Database handbook: Same gap as the Admin Handbook: restore from the off-volume copy never restores pki/, which the handbook calls critical. [defects, defects #265014]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:1f4895c24f159d8fb234890dda2ae57c1f6aefce8d472712d14382cda41c4487 · published digest sha256:1f4895c24f159d8fb234890dda2ae57c1f6aefce8d472712d14382cda41c4487 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 463) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
  • Grade at releaseB (percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T10:14:12Z · failing Base image docker.io/library/ubuntu:24.04 has been updated since this image was built: it was built on sha256:78d4744ead1f…, and the tag's current linux/amd64 image is sha256:77eb101c607d…., Docker Scout counts 118 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T10:13:53Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3830189924 · transparency-log entry · integrated 2026-11-12T10:22:40Z) [ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:664856ed3b07522c61397a1c0db0978e4042b46e56399a9fca2e691a8c65e1f2 · state attached · log index 3830198558 · transparency-log entry
    • kind sbom · digest sha256:664856ed3b07522c61397a1c0db0978e4042b46e56399a9fca2e691a8c65e1f2 · state attached · log index 3830200532 · transparency-log entry
    • kind vsa · digest sha256:664856ed3b07522c61397a1c0db0978e4042b46e56399a9fca2e691a8c65e1f2 · state attached · log index 3830203513 · transparency-log entry
    • kind provenance · digest sha256:1f4895c24f159d8fb234890dda2ae57c1f6aefce8d472712d14382cda41c4487 · state attached · log index 3830205731 · transparency-log entry
    • kind sbom · digest sha256:1f4895c24f159d8fb234890dda2ae57c1f6aefce8d472712d14382cda41c4487 · state attached · log index 3830207210 · transparency-log entry
    • kind vsa · digest sha256:1f4895c24f159d8fb234890dda2ae57c1f6aefce8d472712d14382cda41c4487 · state attached · log index 3830208824 · transparency-log entry
    (at 2026-11-12T10:22:44Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/kubernetes/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-12T00:28:36Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:1f4895c24f159d8fb234890dda2ae57c1f6aefce8d472712d14382cda41c4487 [clean-room rebuild ledger, runs[765]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-11T23:47:55Z [stage_runs, stage_runs chain 987 stage publish_image]
  • Archive manifests written2026-11-12T10:18:09Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 968 · probed 2026-11-11T23:36:38Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-12T10:24:29Z generated: by KitForge release/build_trail.py · generator commit c8155eab7005e164326d14c384d473b047cfc227
  • 2026-11-12T10:26:51Z publication: promoted at 2026-11-12T10:25:02Z · promoted digest sha256:664856ed3b07522c61397a1c0db0978e4042b46e56399a9fca2e691a8c65e1f2 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 495 · checklist status complete · checklist at 2026-11-12T10:26:51Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/kubernetes/v1.37.2-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/kubernetes/v1.37.2-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/kubernetes/v1.37.2-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-kubernetes-v1.37.2-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/kubernetes/v1.37.2-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/kubernetes/v1.37.2-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)657
chainssadb, ReadyStack's engine database (not published)987
defectssadb, ReadyStack's engine database (not published)kubernetes v1.37.2-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 987
held_roundssadb, ReadyStack's engine database (not published)chain 987
lesson_recallssadb, ReadyStack's engine database (not published)chain 987
micro_step_runssadb, ReadyStack's engine database (not published)chain 987
release_imagessadb, ReadyStack's engine database (not published)kubernetes v1.37.2-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 987
stage_runssadb, ReadyStack's engine database (not published)chain 987
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—