MariaDB 12.3.3-CE-ubuntu24.04-r8 build trail
How ReadyStack built readystack/mariadb:12.3.3-CE-ubuntu24.04-r8 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/mariadb:12.3.3-CE-ubuntu24.04-r8 - Index digestsha256:a29c6decef23df6107c09530157863e1cc9eb61a591200b9d9bac731bf57faca
- linux/amd64 digestsha256:3195cf923e32144f5e7499018c0257b0f4fcaa083bbd64b91268c3223f84f47c
- Archive
ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.tar.gz - Archive SHA-256 now52c9e513c83b4ca16984fb597254972f1a1f24d18271440f77d4ae791ac2aa13
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-13T13:15:24Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.trail.json.sigstore ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductMariaDB (mariadb) [MANIFEST.json]
- Release tag12.3.3-CE-ubuntu24.04-r8 [MANIFEST.json]
- Imagereadystack/mariadb:12.3.3-CE-ubuntu24.04-r8 [MANIFEST.json]
- Image index digestsha256:a29c6decef23df6107c09530157863e1cc9eb61a591200b9d9bac731bf57faca [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:3195cf923e32144f5e7499018c0257b0f4fcaa083bbd64b91268c3223f84f47c [ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.tar.gz (bytes 684244936) [MANIFEST.json]
- Archive sha256 at publish52c9e513c83b4ca16984fb597254972f1a1f24d18271440f77d4ae791ac2aa13 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/MariaDB/server [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refmariadb-12.3.3 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash596889517844b2c754de15fc2971efe9fc2dbaa1cd55ec90c049453e2f3351a1 (files 26928) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:2c3acd03b9f172276ec5c9b5d36a38a7b79aa9dc576c47bdc5423cc2e4632080 [ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794569004 (utc 2026-11-13T11:23:24Z) [ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.rebuild.json, engine]
- Engine commit(s)
- commit 195161eb676df9aaf61e9aaa551e579631ccd44f · dirty yes · first drive 4563
- commit a45425e339234f118fc0fbe99b7714973f9ef347 · dirty yes · first drive 4576
Why this release exists
Fully recorded- Chain1069 (created 2026-11-13T11:24:40Z · trigger customer_request · upstream version 12.3.3) [chains, chains #1069]
- Requestbuild request #746 (rebuild) (requested at 2026-11-13T11:23:26Z · requested by kitforge-agent · version 12.3.3) [build_requests, build_requests #746]
- Reasonrerelease agenda REVISION -> 12.3.3-CE-ubuntu24.04-r8 (decay loop, IMP-08) [build_requests, build_requests #746 request_reason]
- Supersedesreadystack/mariadb:12.3.3-CE-ubuntu24.04-r7 (chain 996) [chains, chains #996]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1069 release · ready_to_ship
Created 2026-11-13T11:24:40Z, upstream 12.3.3, build request 746 [chains, chains #1069]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4563 | 2026-11-13T11:25:16Z | 80.5 | build host 5 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4563] |
| 4576 | 2026-11-13T13:07:41Z | — | build host 5 publish-held | not recorded [drive_runs, drive_runs #4576] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-13T11:25:27Z | 2026-11-13T11:25:27Z | 1 | 4
|
order_json 090e1353facc… |
acquire |
2026-11-13T11:25:42Z | 2026-11-13T11:25:45Z | 1 | 12
|
source_tree 83874c89c137…license_file 240a15a1d0f3…custody_inputs 9c52e4312783…source_tree_hash 0c1402e355e4…source_file_manifest e2192bbacd64… |
plan |
2026-11-13T11:26:24Z | 2026-11-13T11:26:24Z | 1 | 10
|
recon_report a392a578dd42…input_pin_plan 17d30d468357…toolchain_lock 6143c1bf8f8a… |
assemble_kit |
2026-11-13T11:45:45Z | 2026-11-13T11:45:46Z | 1 | 27
|
dockerfile 35eef4c75529…build_recipe 9314de01072a…system_pinning aa8db05a9a8a…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health ddb2bd119dcf…verify_offline_sh 3e8184ea230c…base_image_digests f6646a1368d0…dockerfile_offline 35eef4c75529…first_build_digest d97d89730209… |
remediate |
2026-11-13T11:46:29Z | 2026-11-13T11:46:29Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log de68e6acee44…security_report 0b4fc0e2200f… |
build_kit |
2026-11-13T12:18:51Z | 2026-11-13T12:18:52Z | 1 | 9
|
cosign_stamp 4a7e5d40a85f…locked_digest e4eb18a90e6c…freeze_manifest 8062bde093ff…offline_rebuild_transcript c911ac9364ff… |
verdict |
2026-11-13T12:19:51Z | 2026-11-13T12:19:52Z | 1 | 8
|
scout_verdict 453631b8b1c2… |
publish_image |
2026-11-13T12:20:35Z | 2026-11-13T12:20:36Z | 1 | 7
|
hub_readme d3a02b18ede1…promotion_record ca4c0b69de18… |
boot_instance |
2026-11-13T12:21:01Z | 2026-11-13T12:21:05Z | 2 | 3
|
instance_handle 4b48cd16b71f… |
sbom |
2026-11-13T12:21:26Z | 2026-11-13T12:21:27Z | 1 | 5
|
sbom_md 9b607aba7339…sbom_json eb27e7fcdf8f… |
schema_discovery |
2026-11-13T12:21:29Z | 2026-11-13T12:21:30Z | 1 | 7
|
schema_hash 614b78a2b2e5…dependency_tree 7507c8ee93eb…table_classification 39289f654292… |
admin_handbook |
2026-11-13T12:21:42Z | 2026-11-13T12:21:43Z | 1 | 7
|
api_map aef45610634e…admin_handbook c5df0cbce7f2… |
db_handbook |
2026-11-13T12:21:59Z | 2026-11-13T12:22:00Z | 1 | 8
|
db_handbook 39e69d4dcd5a…seed_isolation c11f78a14018… |
seed_data |
2026-11-13T12:22:09Z | 2026-11-13T12:22:09Z | 1 | 6
|
seed_data_sql 42c2d001fbdc…seed_cases_json 8fadb9209e11… |
seed_validate |
2026-11-13T12:22:12Z | 2026-11-13T12:22:13Z | 1 | 3
|
seed_data_contract 358474d829cf… |
usecase_validate |
2026-11-13T12:22:50Z | 2026-11-13T12:22:51Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 82ac8a95019a…test_results 073921d6f1bc…usecase_contract e81fe754aa96… |
finalize_docs |
2026-11-13T12:22:57Z | 2026-11-13T12:22:58Z | 1 | 9
|
defects_json c864ed80d68a…release_notes d9f3838244ac…api_integration_guide 3a68560b23f9… |
package_archive invalidated 2026-11-13T13:07:15Z |
2026-11-13T12:45:43Z | 2026-11-13T12:45:45Z | 1 | 37 (final gate PASS)
|
sale_tar 643225f83b09…checksums eea441e10958…verify_md fc1acc05fcc1…rebuild_md c5106f603df0…manifest_txt ed2be922aca3…actions_jsonl aaa6c19763e4…provenance_md ff8048577196…assetchain_log_md e9eccaec0c0f…assetchain_log_json 7e8b2c4250ec… |
[stage_runs]
Rewinds
- 2026-11-13T13:07:15Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36066]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-13T12:45:45Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 9505 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 13119 | L-A08, L-038, L-036, L-034, L-032 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.29 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-13T12:46:44Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1874] | $0.29 | 3 rounds, $40.00 | 643225f83b09… |
Defects
Fully recorded- Ledger entries2 [defects, defects where product_slug=mariadb and this tag or chain]
- Disclosed in the archive2 [docs/defects/defects.json, entries]
2 ledger entries: by severity medium 2; by status open 2.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-mariadb-cbf6ae2d90The seed-data record says the product has no SQL database ('config/CRD-native product') [defects, defects #280429] | medium | open | engine review | — |
RSD-mariadb-cd4fb4c826MariaDB accepts an account host written in CIDR form (192.168.1.0/24) but it never matches [defects, defects #280430] | medium | open | build strategy record | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:3195cf923e32144f5e7499018c0257b0f4fcaa083bbd64b91268c3223f84f47c · published digest sha256:3195cf923e32144f5e7499018c0257b0f4fcaa083bbd64b91268c3223f84f47c · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 960) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T13:08:11Z · failing Docker Scout counts 20 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T13:07:51Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3853581709 · transparency-log entry
- log index 3853583382 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3854533543 · transparency-log entry · integrated 2026-11-13T13:13:22Z) [ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:a29c6decef23df6107c09530157863e1cc9eb61a591200b9d9bac731bf57faca · state attached · log index 3854539379 · transparency-log entry
- kind sbom · digest sha256:a29c6decef23df6107c09530157863e1cc9eb61a591200b9d9bac731bf57faca · state attached · log index 3854541755 · transparency-log entry
- kind vsa · digest sha256:a29c6decef23df6107c09530157863e1cc9eb61a591200b9d9bac731bf57faca · state attached · log index 3854545420 · transparency-log entry
- kind provenance · digest sha256:3195cf923e32144f5e7499018c0257b0f4fcaa083bbd64b91268c3223f84f47c · state attached · log index 3854548963 · transparency-log entry
- kind sbom · digest sha256:3195cf923e32144f5e7499018c0257b0f4fcaa083bbd64b91268c3223f84f47c · state attached · log index 3854551684 · transparency-log entry
- kind vsa · digest sha256:3195cf923e32144f5e7499018c0257b0f4fcaa083bbd64b91268c3223f84f47c · state attached · log index 3854554531 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/mariadb/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-13T12:46:49Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:3195cf923e32144f5e7499018c0257b0f4fcaa083bbd64b91268c3223f84f47c [clean-room rebuild ledger, runs[833]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-13T12:20:36Z [stage_runs, stage_runs chain 1069 stage publish_image]
- Archive manifests written2026-11-13T13:10:49Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 220 · probed 2026-11-13T12:02:32Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-13T13:15:24Z generated: by KitForge release/build_trail.py · generator commit a45425e339234f118fc0fbe99b7714973f9ef347
- 2026-11-13T13:17:25Z publication: promoted at 2026-11-13T13:16:12Z · promoted digest sha256:a29c6decef23df6107c09530157863e1cc9eb61a591200b9d9bac731bf57faca · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 541 · checklist status complete · checklist at 2026-11-13T13:17:25Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/mariadb/12.3.3-CE-ubuntu24.04-r8/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/mariadb/12.3.3-CE-ubuntu24.04-r8/), as staged for publishing | — |
ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.rebuild.json | beside the archive (prodasset /data/production/mariadb/12.3.3-CE-ubuntu24.04-r8/), as staged for publishing | — |
ReadyStack-mariadb-12.3.3-CE-ubuntu24.04-r8.rebuild.json.sigstore | beside the archive (prodasset /data/production/mariadb/12.3.3-CE-ubuntu24.04-r8/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/mariadb/12.3.3-CE-ubuntu24.04-r8/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 746 |
chains | sadb, ReadyStack's engine database (not published) | 1069 |
defects | sadb, ReadyStack's engine database (not published) | mariadb 12.3.3-CE-ubuntu24.04-r8 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1069 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1069 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1069 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1069 |
release_images | sadb, ReadyStack's engine database (not published) | mariadb 12.3.3-CE-ubuntu24.04-r8 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1069 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1069 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |