MariaDB 12.3.3-CE-ubuntu24.04-r7 build trail
How ReadyStack built readystack/mariadb:12.3.3-CE-ubuntu24.04-r7 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/mariadb:12.3.3-CE-ubuntu24.04-r7 - Index digestsha256:aec9313bce60e3cbd9983ccce73c6b5b0efc0f43f839dc985d5200161eeb9e49
- linux/amd64 digestsha256:3b436c3213a35bcbe9485f11d81e2350ea07ecd901c8f81203a09330db782a83
- Archive
ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.tar.gz - Archive SHA-256 now62bc5cf83e5f20f1adbc16c0756f9c91ff67ea4bb72a0a7694f2cbbad6dafbfc
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-12T04:37:18Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.trail.json.sigstore ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductMariaDB (mariadb) [MANIFEST.json]
- Release tag12.3.3-CE-ubuntu24.04-r7 [MANIFEST.json]
- Imagereadystack/mariadb:12.3.3-CE-ubuntu24.04-r7 [MANIFEST.json]
- Image index digestsha256:aec9313bce60e3cbd9983ccce73c6b5b0efc0f43f839dc985d5200161eeb9e49 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:3b436c3213a35bcbe9485f11d81e2350ea07ecd901c8f81203a09330db782a83 [ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.tar.gz (bytes 680329171) [MANIFEST.json]
- Archive sha256 at publish62bc5cf83e5f20f1adbc16c0756f9c91ff67ea4bb72a0a7694f2cbbad6dafbfc [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/MariaDB/server [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refmariadb-12.3.3 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash596889517844b2c754de15fc2971efe9fc2dbaa1cd55ec90c049453e2f3351a1 (files 26928) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:74efebc884cc08dcb02b803be59bbd3a422c88af99d7edf3e956b539713fdd52 [ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794448208 (utc 2026-11-12T01:50:08Z) [ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.rebuild.json, engine]
- Engine commit(s)
- commit d6acf665ef6d5a2226ab69008894a83a57e0fc08 · dirty yes · first drive 4338
- commit e0974ec82ecfffcefbdb59b1a18ab06c2b245238 · dirty yes · first drive 4345
Why this release exists
Fully recorded- Chain996 (created 2026-11-12T02:27:35Z · trigger customer_request · upstream version 12.3.3) [chains, chains #996]
- Requestbuild request #698 (rebuild) (requested at 2026-11-12T01:50:09Z · requested by kitforge-agent · version 12.3.3) [build_requests, build_requests #698]
- Reasonrevision 12.3.3-CE-ubuntu24.04-r7: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #698 request_reason]
- Supersedesreadystack/mariadb:12.3.3-CE-ubuntu24.04-r6 (chain 939) [chains, chains #939]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 996 release · ready_to_ship
Created 2026-11-12T02:27:35Z, upstream 12.3.3, build request 698 [chains, chains #996]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4338 | 2026-11-12T02:28:03Z | 54.4 | build host 3 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4338] |
| 4345 | 2026-11-12T04:30:25Z | — | build host 3 publish-held | not recorded [drive_runs, drive_runs #4345] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-12T02:28:14Z | 2026-11-12T02:28:15Z | 1 | 4
|
order_json bd699288ef13… |
acquire |
2026-11-12T02:28:29Z | 2026-11-12T02:28:32Z | 1 | 12
|
source_tree 83874c89c137…license_file 240a15a1d0f3…custody_inputs 9c52e4312783…source_tree_hash 0c1402e355e4…source_file_manifest e2192bbacd64… |
plan |
2026-11-12T02:29:06Z | 2026-11-12T02:29:07Z | 1 | 10
|
recon_report f423d5a95d74…input_pin_plan e9b1406aad3b…toolchain_lock 4f323262b78a… |
assemble_kit |
2026-11-12T02:40:55Z | 2026-11-12T02:40:55Z | 1 | 27
|
dockerfile 47e905485081…build_recipe 97ddc09d9883…system_pinning aa8db05a9a8a…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health 8cef05b5e943…verify_offline_sh 3e8184ea230c…base_image_digests f6646a1368d0…dockerfile_offline 47e905485081…first_build_digest 830575d0e679… |
remediate |
2026-11-12T02:41:27Z | 2026-11-12T02:41:27Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 0b66310f020c…security_report 0871a8a3544b… |
build_kit |
2026-11-12T03:03:16Z | 2026-11-12T03:03:17Z | 1 | 9
|
cosign_stamp e49e7d01c161…locked_digest 58c635d9d41e…freeze_manifest d170b97ccace…offline_rebuild_transcript 9063ef8ca9c9… |
verdict |
2026-11-12T03:04:02Z | 2026-11-12T03:04:03Z | 1 | 8
|
scout_verdict 94b5addf75b2… |
publish_image |
2026-11-12T03:04:38Z | 2026-11-12T03:04:39Z | 1 | 7
|
hub_readme d7763b0874ea…promotion_record f90dbc410f6a… |
boot_instance |
2026-11-12T03:04:50Z | 2026-11-12T03:04:53Z | 2 | 3
|
instance_handle 855846d516a8… |
sbom |
2026-11-12T03:05:05Z | 2026-11-12T03:05:06Z | 1 | 5
|
sbom_md 1f04dd602391…sbom_json df8ea0b3b35f… |
schema_discovery |
2026-11-12T03:05:08Z | 2026-11-12T03:05:09Z | 1 | 7
|
schema_hash 614b78a2b2e5…dependency_tree 7507c8ee93eb…table_classification 39289f654292… |
admin_handbook |
2026-11-12T03:05:21Z | 2026-11-12T03:05:22Z | 1 | 7
|
api_map aef45610634e…admin_handbook c0d83e4f7b5f… |
db_handbook |
2026-11-12T03:05:35Z | 2026-11-12T03:05:36Z | 1 | 8
|
db_handbook d3e00d5d8b11…seed_isolation c11f78a14018… |
seed_data |
2026-11-12T03:05:43Z | 2026-11-12T03:05:44Z | 1 | 6
|
seed_data_sql 42c2d001fbdc…seed_cases_json f7aa5c37a208… |
seed_validate |
2026-11-12T03:05:46Z | 2026-11-12T03:05:47Z | 1 | 3
|
seed_data_contract f254978f8769… |
usecase_validate |
2026-11-12T03:06:17Z | 2026-11-12T03:06:18Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 82ac8a95019a…test_results 073921d6f1bc…usecase_contract eb829eb76afe… |
finalize_docs |
2026-11-12T03:06:24Z | 2026-11-12T03:06:25Z | 1 | 9
|
defects_json c71962f8f034…release_notes bd97e2cb0606…api_integration_guide e0556a4195c7… |
package_archive invalidated 2026-11-12T04:29:40Z |
2026-11-12T03:22:22Z | 2026-11-12T03:22:24Z | 1 | 36 (final gate PASS)
|
sale_tar d188cb84b306…checksums 574c89626eb3…verify_md d17e850c3d68…rebuild_md 8def3c18cd84…manifest_txt 70827ed15da0…actions_jsonl fc01e4bf3458…provenance_md fd91166fbc44…assetchain_log_md e9eccaec0c0f…assetchain_log_json 42f992625e5a… |
[stage_runs]
Rewinds
- 2026-11-12T04:29:40Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #32787]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-12T03:22:24Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 8700 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 8718 | L-A183, L-A15 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.33 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-12T03:23:11Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1774] | $0.33 | 3 rounds, $40.00 | d188cb84b306… |
Defects
Fully recorded- Ledger entries2 [defects, defects where product_slug=mariadb and this tag or chain]
- Disclosed in the archive2 [docs/defects/defects.json, entries]
2 ledger entries: by severity medium 2; by status open 2.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-mariadb-48b399f6abThe seed-data record says the product has no SQL database ('config/CRD-native product') [defects, defects #256696] | medium | open | engine review | — |
RSD-mariadb-06253f377cMariaDB accepts an account host written in CIDR form (192.168.1.0/24) but it never matches [defects, defects #256697] | medium | open | build strategy record | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:3b436c3213a35bcbe9485f11d81e2350ea07ecd901c8f81203a09330db782a83 · published digest sha256:3b436c3213a35bcbe9485f11d81e2350ea07ecd901c8f81203a09330db782a83 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 645) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T04:30:51Z · failing Docker Scout counts 20 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T04:30:35Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3823153990 · transparency-log entry
- log index 3823154196 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3824754820 · transparency-log entry · integrated 2026-11-12T04:35:42Z) [ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:aec9313bce60e3cbd9983ccce73c6b5b0efc0f43f839dc985d5200161eeb9e49 · state attached · log index 3824758780 · transparency-log entry
- kind sbom · digest sha256:aec9313bce60e3cbd9983ccce73c6b5b0efc0f43f839dc985d5200161eeb9e49 · state attached · log index 3824760555 · transparency-log entry
- kind vsa · digest sha256:aec9313bce60e3cbd9983ccce73c6b5b0efc0f43f839dc985d5200161eeb9e49 · state attached · log index 3824762948 · transparency-log entry
- kind provenance · digest sha256:3b436c3213a35bcbe9485f11d81e2350ea07ecd901c8f81203a09330db782a83 · state attached · log index 3824764857 · transparency-log entry
- kind sbom · digest sha256:3b436c3213a35bcbe9485f11d81e2350ea07ecd901c8f81203a09330db782a83 · state attached · log index 3824766323 · transparency-log entry
- kind vsa · digest sha256:3b436c3213a35bcbe9485f11d81e2350ea07ecd901c8f81203a09330db782a83 · state attached · log index 3824768175 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/mariadb/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-12T03:23:18Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:3b436c3213a35bcbe9485f11d81e2350ea07ecd901c8f81203a09330db782a83 [clean-room rebuild ledger, runs[769]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-12T03:04:39Z [stage_runs, stage_runs chain 996 stage publish_image]
- Archive manifests written2026-11-12T04:33:12Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 220 · probed 2026-11-12T02:52:16Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-12T04:37:18Z generated: by KitForge release/build_trail.py · generator commit e0974ec82ecfffcefbdb59b1a18ab06c2b245238
- 2026-11-12T04:39:13Z publication: promoted at 2026-11-12T04:38:01Z · promoted digest sha256:aec9313bce60e3cbd9983ccce73c6b5b0efc0f43f839dc985d5200161eeb9e49 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 486 · checklist status complete · checklist at 2026-11-12T04:39:13Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/mariadb/12.3.3-CE-ubuntu24.04-r7/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/mariadb/12.3.3-CE-ubuntu24.04-r7/), as staged for publishing | — |
ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.rebuild.json | beside the archive (prodasset /data/production/mariadb/12.3.3-CE-ubuntu24.04-r7/), as staged for publishing | — |
ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r7.rebuild.json.sigstore | beside the archive (prodasset /data/production/mariadb/12.3.3-CE-ubuntu24.04-r7/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/mariadb/12.3.3-CE-ubuntu24.04-r7/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 698 |
chains | sadb, ReadyStack's engine database (not published) | 996 |
defects | sadb, ReadyStack's engine database (not published) | mariadb 12.3.3-CE-ubuntu24.04-r7 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 996 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 996 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 996 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 996 |
release_images | sadb, ReadyStack's engine database (not published) | mariadb 12.3.3-CE-ubuntu24.04-r7 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 996 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 996 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |