kube-vip v1.3.1-CE-ubuntu24.04-r3 build trail
How ReadyStack built readystack/kubevip:v1.3.1-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/kubevip:v1.3.1-CE-ubuntu24.04-r3 - Index digestsha256:e7b6afbb7d9e039dae777704a686d535d9f7acd4a5caeb703091c86df43ac058
- linux/amd64 digestsha256:18ac5b7b6dabc301e0d55ac59e00f8fb65a97376294f604df8b61592334dcea4
- Archive
ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.tar.gz - Archive SHA-256 now0bf2d0f1998cd27415063c79fd4faa84e311111f356d36ccb31d4f9cf7ada18a
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-13T04:09:48Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- Productkube-vip (kubevip) [MANIFEST.json]
- Release tagv1.3.1-CE-ubuntu24.04-r3 [MANIFEST.json]
- Imagereadystack/kubevip:v1.3.1-CE-ubuntu24.04-r3 [MANIFEST.json]
- Image index digestsha256:e7b6afbb7d9e039dae777704a686d535d9f7acd4a5caeb703091c86df43ac058 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:18ac5b7b6dabc301e0d55ac59e00f8fb65a97376294f604df8b61592334dcea4 [ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.tar.gz (bytes 466090389) [MANIFEST.json]
- Archive sha256 at publish0bf2d0f1998cd27415063c79fd4faa84e311111f356d36ccb31d4f9cf7ada18a [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/kube-vip/kube-vip [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv1.3.1 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit6da770eac1eed9409a9feaccda3d782c94424c24 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashd60b5906d58daea49f560973d574c32f1accf28d8a801dad65ad35aaa8f3e2fb (files 295) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:6c4c3cc53728c7fd3989ffa560761871a7f035764113e4bd97e395a9fcc77024 [ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794448197 (utc 2026-11-12T01:49:57Z) [ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.27.4-bookworm@sha256:4fa7c968ba93f1635670522dbb01a2c78150443e1385746924566079f36570ea · platform digest sha256:fb7cceb528b47141eccd9b60bf3cbd27d5ef5f8cf5b7d338bec866da495b50dc
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.rebuild.json, engine]
- Engine commit(s)
- commit 8e2ccd89012b505323ed4fe7a92c08c20259debd · dirty yes · first drive 4533
- commit 96f3323140891ba62fe76c4b7c36875344807578 · dirty yes · first drive 4537
Why this release exists
Fully recorded- Chain1059 (created 2026-11-13T03:39:55Z · trigger customer_request · upstream version v1.3.1) [chains, chains #1059]
- Requestbuild request #696 (rebuild) (requested at 2026-11-12T01:49:59Z · requested by kitforge-agent · version v1.3.1) [build_requests, build_requests #696]
- Reasonrevision v1.3.1-CE-ubuntu24.04-r3: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #696 request_reason]
- Supersedesreadystack/kubevip:v1.3.1-CE-ubuntu24.04-r2 (chain 859) [chains, chains #859]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1059 release · ready_to_ship
Created 2026-11-13T03:39:55Z, upstream v1.3.1, build request 696 [chains, chains #1059]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4533 | 2026-11-13T03:40:21Z | 15.4 | build host 4 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4533] |
| 4537 | 2026-11-13T04:05:35Z | — | build host 4 publish-held | not recorded [drive_runs, drive_runs #4537] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-13T03:40:32Z | 2026-11-13T03:40:33Z | 1 | 4
|
order_json 9310ec6c9440… |
acquire |
2026-11-13T03:40:37Z | 2026-11-13T03:40:38Z | 1 | 12
|
source_tree ae9c13988f73…license_file c71d239df917…custody_inputs 8d4f4ddf7d8b…source_tree_hash 3c84f809fa47…source_file_manifest 77a68c59ab88… |
plan |
2026-11-13T03:41:07Z | 2026-11-13T03:41:08Z | 1 | 10
|
recon_report fac78a367dbf…input_pin_plan e543d377b6dc…toolchain_lock b55d629cc7a7… |
assemble_kit |
2026-11-13T03:44:04Z | 2026-11-13T03:44:05Z | 1 | 27
|
dockerfile 871790207989…build_recipe 1f56abbbda3c…system_pinning aa8db05a9a8a…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health 98edd96ecee6…verify_offline_sh 3e8184ea230c…base_image_digests 6d6437528b43…dockerfile_offline 871790207989…first_build_digest 01299f917702… |
remediate |
2026-11-13T03:44:46Z | 2026-11-13T03:44:47Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log cb15c809945c…security_report 3ec20de09d0f… |
build_kit |
2026-11-13T03:49:27Z | 2026-11-13T03:49:28Z | 1 | 9
|
cosign_stamp 7f5cb8bf33da…locked_digest 131ec787af67…freeze_manifest 2cc5b010f6bf…offline_rebuild_transcript ad72ce0f40a5… |
verdict |
2026-11-13T03:49:55Z | 2026-11-13T03:49:56Z | 1 | 8
|
scout_verdict e856185c5e73… |
publish_image |
2026-11-13T03:50:27Z | 2026-11-13T03:50:28Z | 1 | 7
|
hub_readme 71d95389dbd8…promotion_record 5bbe4b1720a7… |
boot_instance |
2026-11-13T03:50:30Z | 2026-11-13T03:50:31Z | 1 | 3
|
instance_handle cca0a34c5eab… |
sbom |
2026-11-13T03:50:40Z | 2026-11-13T03:50:40Z | 1 | 5
|
sbom_md 492b3ae684f4…sbom_json dbbda9cccbad… |
schema_discovery |
2026-11-13T03:50:43Z | 2026-11-13T03:50:44Z | 1 | 7
|
schema_hash aa8267b90a9a…dependency_tree 8d95ba2088e5…table_classification 0fc146e762f3… |
admin_handbook |
2026-11-13T03:50:46Z | 2026-11-13T03:50:47Z | 1 | 7
|
api_map fc87387f9352…admin_handbook bce206bd64cb… |
db_handbook |
2026-11-13T03:50:50Z | 2026-11-13T03:50:50Z | 1 | 8
|
db_handbook 468b88e955d0…seed_isolation 7bf8c3e705be… |
seed_data |
2026-11-13T03:50:53Z | 2026-11-13T03:50:54Z | 1 | 6
|
seed_data_sql 28c499a8efeb…seed_cases_json 01a5d9def5b0… |
seed_validate |
2026-11-13T03:50:56Z | 2026-11-13T03:50:57Z | 1 | 3
|
seed_data_contract 30dd3a52e89d… |
usecase_validate |
2026-11-13T03:51:00Z | 2026-11-13T03:51:01Z | 1 | 10
|
failed_tests 1e2c1d4c8458…passed_tests 11d07e6fc53e…test_results 235baf354286…usecase_contract 53feed441b81… |
finalize_docs |
2026-11-13T03:51:05Z | 2026-11-13T03:51:06Z | 1 | 9
|
defects_json 9de69c12b88e…release_notes 41890043f6d6…api_integration_guide 144c73c22d6d… |
package_archive invalidated 2026-11-13T04:05:12Z |
2026-11-13T03:55:39Z | 2026-11-13T03:55:41Z | 1 | 37 (final gate PASS)
|
sale_tar e3a05e2fc1ca…checksums 7a92c7baff59…verify_md 02996804a608…rebuild_md 2e74a46d974b…manifest_txt 71387f6e426c…actions_jsonl a76f073ce208…provenance_md 518ef557a353…assetchain_log_md e9eccaec0c0f…assetchain_log_json 21273ad355b4… |
[stage_runs]
Rewinds
- 2026-11-13T04:05:12Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #35374]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-13T03:55:41Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 6957 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 10765 | L-A08, L-038, L-036, L-034, L-032 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.16 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-13T03:56:23Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1857] | $0.16 | 3 rounds, $40.00 | e3a05e2fc1ca… |
Defects
Fully recorded- Ledger entries0 [defects, defects where product_slug=kubevip and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
0 ledger entries.
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:18ac5b7b6dabc301e0d55ac59e00f8fb65a97376294f604df8b61592334dcea4 · published digest sha256:18ac5b7b6dabc301e0d55ac59e00f8fb65a97376294f604df8b61592334dcea4 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 126) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T04:05:56Z · failing Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T04:05:46Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3845292547 · transparency-log entry
- log index 3845294730 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3845644521 · transparency-log entry · integrated 2026-11-13T04:08:12Z) [ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:e7b6afbb7d9e039dae777704a686d535d9f7acd4a5caeb703091c86df43ac058 · state attached · log index 3845647403 · transparency-log entry
- kind sbom · digest sha256:e7b6afbb7d9e039dae777704a686d535d9f7acd4a5caeb703091c86df43ac058 · state attached · log index 3845650201 · transparency-log entry
- kind vsa · digest sha256:e7b6afbb7d9e039dae777704a686d535d9f7acd4a5caeb703091c86df43ac058 · state attached · log index 3845653701 · transparency-log entry
- kind provenance · digest sha256:18ac5b7b6dabc301e0d55ac59e00f8fb65a97376294f604df8b61592334dcea4 · state attached · log index 3845656868 · transparency-log entry
- kind sbom · digest sha256:18ac5b7b6dabc301e0d55ac59e00f8fb65a97376294f604df8b61592334dcea4 · state attached · log index 3845658908 · transparency-log entry
- kind vsa · digest sha256:18ac5b7b6dabc301e0d55ac59e00f8fb65a97376294f604df8b61592334dcea4 · state attached · log index 3845661773 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/kubevip/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-13T03:56:28Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:18ac5b7b6dabc301e0d55ac59e00f8fb65a97376294f604df8b61592334dcea4 [clean-room rebuild ledger, runs[819]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-13T03:50:28Z [stage_runs, stage_runs chain 1059 stage publish_image]
- Archive manifests written2026-11-13T04:07:02Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 57 · probed 2026-11-13T03:47:05Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-13T04:09:48Z generated: by KitForge release/build_trail.py · generator commit 96f3323140891ba62fe76c4b7c36875344807578
- 2026-11-13T04:11:14Z publication: promoted at 2026-11-13T04:10:29Z · promoted digest sha256:e7b6afbb7d9e039dae777704a686d535d9f7acd4a5caeb703091c86df43ac058 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 532 · checklist status complete · checklist at 2026-11-13T04:11:14Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/kubevip/v1.3.1-CE-ubuntu24.04-r3/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/kubevip/v1.3.1-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.rebuild.json | beside the archive (prodasset /data/production/kubevip/v1.3.1-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-kubevip-v1.3.1-CE-ubuntu24.04-r3.rebuild.json.sigstore | beside the archive (prodasset /data/production/kubevip/v1.3.1-CE-ubuntu24.04-r3/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/kubevip/v1.3.1-CE-ubuntu24.04-r3/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 696 |
chains | sadb, ReadyStack's engine database (not published) | 1059 |
defects | sadb, ReadyStack's engine database (not published) | kubevip v1.3.1-CE-ubuntu24.04-r3 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1059 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1059 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1059 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1059 |
release_images | sadb, ReadyStack's engine database (not published) | kubevip v1.3.1-CE-ubuntu24.04-r3 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1059 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1059 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |