MariaDB 12.3.3-CE-ubuntu24.04-r4 build trail
How ReadyStack built readystack/mariadb:12.3.3-CE-ubuntu24.04-r4 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/mariadb:12.3.3-CE-ubuntu24.04-r4 - Index digestsha256:46214d6c22dbd6c86c151f0a6aab629bd09857f4f5fac42c30084d6d562db1a6
- linux/amd64 digestsha256:ce6df3f1fa1e14f5226d41f59d61b86c1656563e8a879f28cd78831625ee56cd
- Archive
ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.tar.gz - Archive SHA-256 nowb4da5ef74b260dd31f7e33c499ecc591d5c6ed6d54849fc2d00d818c9b77207b
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-05T05:36:46Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.trail.json.sigstore ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductMariaDB (mariadb) [MANIFEST.json]
- Release tag12.3.3-CE-ubuntu24.04-r4 [MANIFEST.json]
- Imagereadystack/mariadb:12.3.3-CE-ubuntu24.04-r4 [MANIFEST.json]
- Image index digestsha256:46214d6c22dbd6c86c151f0a6aab629bd09857f4f5fac42c30084d6d562db1a6 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:ce6df3f1fa1e14f5226d41f59d61b86c1656563e8a879f28cd78831625ee56cd [ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.tar.gz (bytes 360089681) [MANIFEST.json]
- Archive sha256 at publishb4da5ef74b260dd31f7e33c499ecc591d5c6ed6d54849fc2d00d818c9b77207b [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/MariaDB/server [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refmariadb-12.3.3 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash596889517844b2c754de15fc2971efe9fc2dbaa1cd55ec90c049453e2f3351a1 (files 26928) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:5b1ea55759b4f0cd59ed1eb9a6c179f1b9d938181287b99de537062a4c134357 [ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1787207273 (utc 2026-08-20T06:27:53Z) [ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.rebuild.json, engine]
- Engine commit(s)
- commit f2b315730b18edeb7d76a7f9321303dc1de25083 · dirty yes · first drive 3493
- commit 2f6b3554016d791d4b4d9411529494f4e7df273f · dirty yes · first drive 3502
Why this release exists
Fully recorded- Chain815 (created 2026-11-05T04:22:21Z · trigger customer_request · upstream version 12.3.3) [chains, chains #815]
- Requestbuild request #496 (rebuild) (requested at 2026-11-05T04:21:04Z · requested by kitforge-agent · version 12.3.3) [build_requests, build_requests #496]
- Reasonrerelease agenda REVISION -> 12.3.3-CE-ubuntu24.04-r4 (decay loop, IMP-08) [build_requests, build_requests #496 request_reason]
- Supersedesreadystack/mariadb:12.3.3-CE-ubuntu24.04-r3 (chain 664) [chains, chains #664]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 815 release · ready_to_ship
Created 2026-11-05T04:22:21Z, upstream 12.3.3, build request 496 [chains, chains #815]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 3493 | 2026-11-05T04:22:53Z | 53.2 | build host 2 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3493] |
| 3502 | 2026-11-05T05:31:09Z | — | build host 2 publish-held | not recorded [drive_runs, drive_runs #3502] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-05T04:23:04Z | 2026-11-05T04:23:04Z | 1 | 4
|
order_json aa0cbd4d8f60… |
acquire |
2026-11-05T04:23:20Z | 2026-11-05T04:23:23Z | 1 | 12
|
source_tree 83874c89c137…license_file 240a15a1d0f3…custody_inputs 9c52e4312783…source_tree_hash 0c1402e355e4…source_file_manifest e2192bbacd64… |
plan |
2026-11-05T04:24:02Z | 2026-11-05T04:24:03Z | 1 | 10
|
recon_report bc92330e0e17…input_pin_plan 338a830850d2…toolchain_lock 236ee91bf9fc… |
assemble_kit |
2026-11-05T04:36:01Z | 2026-11-05T04:36:02Z | 1 | 27
|
dockerfile c8ab42128db0…build_recipe d75fbc54f0a8…system_pinning 20c318f16cfd…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health 3b2699c3091a…verify_offline_sh 3e8184ea230c…base_image_digests f6646a1368d0…dockerfile_offline c8ab42128db0…first_build_digest d62e27c49083… |
remediate |
2026-11-05T04:36:46Z | 2026-11-05T04:36:47Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log a5429d436890…security_report b18dae9c6a37… |
build_kit |
2026-11-05T04:57:54Z | 2026-11-05T04:57:54Z | 1 | 9
|
cosign_stamp 8d9690cdf169…locked_digest b84bbebec737…freeze_manifest 8d4991e3e2ad…offline_rebuild_transcript dcc6a37de3a3… |
verdict |
2026-11-05T04:58:48Z | 2026-11-05T04:58:49Z | 1 | 8
|
scout_verdict a5b54c3d867e… |
publish_image |
2026-11-05T04:59:29Z | 2026-11-05T04:59:30Z | 1 | 7
|
hub_readme 7fe8530407e2…promotion_record 0ba72bba48f6… |
boot_instance |
2026-11-05T04:59:48Z | 2026-11-05T04:59:51Z | 2 | 3
|
instance_handle bf6aa3171fea… |
sbom |
2026-11-05T05:00:05Z | 2026-11-05T05:00:06Z | 1 | 5
|
sbom_md 17f19deeda01…sbom_json 0f2551679327… |
schema_discovery |
2026-11-05T05:00:08Z | 2026-11-05T05:00:09Z | 1 | 7
|
schema_hash 614b78a2b2e5…dependency_tree 7507c8ee93eb…table_classification 39289f654292… |
admin_handbook |
2026-11-05T05:00:20Z | 2026-11-05T05:00:21Z | 1 | 7
|
api_map aef45610634e…admin_handbook 52c69945251b… |
db_handbook |
2026-11-05T05:00:35Z | 2026-11-05T05:00:36Z | 1 | 8
|
db_handbook 2e8bd99645e1…seed_isolation c11f78a14018… |
seed_data |
2026-11-05T05:00:43Z | 2026-11-05T05:00:44Z | 1 | 6
|
seed_data_sql 42c2d001fbdc…seed_cases_json c37af485a3bb… |
seed_validate |
2026-11-05T05:00:47Z | 2026-11-05T05:00:48Z | 1 | 3
|
seed_data_contract 83c00528c4ec… |
usecase_validate |
2026-11-05T05:01:17Z | 2026-11-05T05:01:18Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 82ac8a95019a…test_results 073921d6f1bc…usecase_contract 33b6ab263726… |
finalize_docs |
2026-11-05T05:01:24Z | 2026-11-05T05:01:25Z | 1 | 9
|
defects_json cd524bb20674…release_notes 15820487a725…api_integration_guide 920002c9e12c… |
package_archive invalidated 2026-11-05T05:30:40Z |
2026-11-05T05:16:04Z | 2026-11-05T05:16:06Z | 1 | 34 (final gate PASS)
|
sale_tar 6f0f9988aff7…checksums 89df550220c0…verify_md 0a98cc7eb6b5…rebuild_md de0ba9d75f20…manifest_txt 1a75dcd83a16…actions_jsonl abbfd77b9b56…provenance_md 6730bcd7c760…assetchain_log_md e9eccaec0c0f…assetchain_log_json 0314542dc7ab… |
[stage_runs]
Rewinds
- 2026-11-05T05:30:40Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #22747]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-05T05:16:06Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 9917 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 13055 | L-A08, L-038, L-036, L-034, L-032 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.31 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-05T05:16:51Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1398] | $0.31 | 3 rounds, $40.00 | 6f0f9988aff7… |
Defects
Fully recorded- Ledger entries6 [defects, defects where product_slug=mariadb and this tag or chain]
- Disclosed in the archive3 [docs/defects/defects.json, entries]
6 ledger entries: by severity medium 2, low 4; by status open 3, fixed-in-release 3.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-mariadb-d287047ee1The seed-data record says the product has no SQL database ('config/CRD-native product') [defects, defects #154138] | medium | open | engine review | — |
RSD-mariadb-19cd28d18dMariaDB accepts an account host written in CIDR form (192.168.1.0/24) but it never matches [defects, defects #154139] | medium | open | build strategy record | — |
RSD-mariadb-e9c16a835bAdmin handbook: The following commands (docker run --rm -i ... [defects, defects #154406] | low | fixed-in-release | held review (review model) | 12.3.3-CE-ubuntu24.04-r4 |
RSD-mariadb-88127a47e1API guide: The same section's backup commands already run --prepare before tar; the restore commands that follow contain no prepare step and restored correctly on the held digest. [defects, defects #154407] | low | fixed-in-release | held review (review model) | 12.3.3-CE-ubuntu24.04-r4 |
RSD-mariadb-09c4f9ada0API guide: Run verbatim on the held digest with MARIADB_ROOT_PASSWORD_FILE pointing at a file holding YOUR_ROOT_PASSWORD: the container exits with 'readystack: MARIADB_ROOT_PASSWORD is shorter than 8… [defects, defects #154408] | low | fixed-in-release | held review (review model) | 12.3.3-CE-ubuntu24.04-r4 |
RSD-mariadb-4eaa9e9d37API guide: The table of contents no longer lists the three subsections, but '### Overriding Configuration' (line 1021), '### Runtime Arguments' and '### Important Notes' still exist in the section. [defects, defects #154409] | low | open | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:ce6df3f1fa1e14f5226d41f59d61b86c1656563e8a879f28cd78831625ee56cd · published digest sha256:ce6df3f1fa1e14f5226d41f59d61b86c1656563e8a879f28cd78831625ee56cd · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 617) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-05T05:31:32Z · failing Docker Scout counts 82 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-05T05:31:19Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3692589164 · transparency-log entry
- log index 3692589271 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3692643152 · transparency-log entry · integrated 2026-11-05T05:35:30Z) [ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:46214d6c22dbd6c86c151f0a6aab629bd09857f4f5fac42c30084d6d562db1a6 · state attached · log index 3692643556 · transparency-log entry
- kind sbom · digest sha256:46214d6c22dbd6c86c151f0a6aab629bd09857f4f5fac42c30084d6d562db1a6 · state attached · log index 3692643708 · transparency-log entry
- kind vsa · digest sha256:46214d6c22dbd6c86c151f0a6aab629bd09857f4f5fac42c30084d6d562db1a6 · state attached · log index 3692643902 · transparency-log entry
- kind provenance · digest sha256:ce6df3f1fa1e14f5226d41f59d61b86c1656563e8a879f28cd78831625ee56cd · state attached · log index 3692644125 · transparency-log entry
- kind sbom · digest sha256:ce6df3f1fa1e14f5226d41f59d61b86c1656563e8a879f28cd78831625ee56cd · state attached · log index 3692644294 · transparency-log entry
- kind vsa · digest sha256:ce6df3f1fa1e14f5226d41f59d61b86c1656563e8a879f28cd78831625ee56cd · state attached · log index 3692644536 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/mariadb/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-05T05:16:55Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:ce6df3f1fa1e14f5226d41f59d61b86c1656563e8a879f28cd78831625ee56cd [clean-room rebuild ledger, runs[583]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-05T04:59:30Z [stage_runs, stage_runs chain 815 stage publish_image]
- Archive manifests written2026-11-05T05:33:29Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 788 · probed 2026-11-05T04:47:24Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-05T05:36:46Z generated: by KitForge release/build_trail.py · generator commit b1883889c688b471b91aac89c56c6d4da0ee25dc
- 2026-11-05T05:38:13Z publication: promoted at 2026-11-05T05:37:15Z · promoted digest sha256:46214d6c22dbd6c86c151f0a6aab629bd09857f4f5fac42c30084d6d562db1a6 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 314 · checklist status complete · checklist at 2026-11-05T05:38:13Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/mariadb/12.3.3-CE-ubuntu24.04-r4/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/mariadb/12.3.3-CE-ubuntu24.04-r4/), as staged for publishing | — |
ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.rebuild.json | beside the archive (prodasset /data/production/mariadb/12.3.3-CE-ubuntu24.04-r4/), as staged for publishing | — |
ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r4.rebuild.json.sigstore | beside the archive (prodasset /data/production/mariadb/12.3.3-CE-ubuntu24.04-r4/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/mariadb/12.3.3-CE-ubuntu24.04-r4/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 496 |
chains | sadb, ReadyStack's engine database (not published) | 815 |
defects | sadb, ReadyStack's engine database (not published) | mariadb 12.3.3-CE-ubuntu24.04-r4 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 815 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 815 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 815 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 815 |
release_images | sadb, ReadyStack's engine database (not published) | mariadb 12.3.3-CE-ubuntu24.04-r4 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 815 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 815 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |