Mastodon v4.7.5-CE-ubuntu24.04-r1 build trail
How ReadyStack built readystack/mastodon:v4.7.5-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/mastodon:v4.7.5-CE-ubuntu24.04-r1 - Index digestsha256:b6ebd6f09fa58acf7b17a803db0723aa1ae6b737011978b446c2b6df7110794a
- linux/amd64 digestsha256:7f8f090d64a8d4de29c70fa0a4b87b1714f900f3f67c8135201bb98931cbcd41
- Archive
ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.tar.gz - Archive SHA-256 nowb222780ff82985bf256e0cc35759b5b69a70451a407b5dd2ecccd168edd9ff79
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-08T22:07:00Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductMastodon (mastodon) [MANIFEST.json]
- Release tagv4.7.5-CE-ubuntu24.04-r1 [MANIFEST.json]
- Imagereadystack/mastodon:v4.7.5-CE-ubuntu24.04-r1 [MANIFEST.json]
- Image index digestsha256:b6ebd6f09fa58acf7b17a803db0723aa1ae6b737011978b446c2b6df7110794a [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:7f8f090d64a8d4de29c70fa0a4b87b1714f900f3f67c8135201bb98931cbcd41 [ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.tar.gz (bytes 664162356) [MANIFEST.json]
- Archive sha256 at publishb222780ff82985bf256e0cc35759b5b69a70451a407b5dd2ecccd168edd9ff79 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/mastodon/mastodon [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv4.7.5 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit24cd1c875a1ac393e587421726394d5692ff5496 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash66fa0a9ee21b341cf1bde47e22d905c3296233c69d950ee483bbcb7209929066 (files 9932) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:6978b060fd9119fb57990aa6a1713e4a88e3508850a4b44d794bcaf2d8acb88c [ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1793719481 (utc 2026-11-03T15:24:41Z) [ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.rebuild.json, engine]
- Engine commit(s)
- commit edd32e786d675d8f83a945524410699b1345c30c · dirty yes · first drive 3864
- commit f5a5de65751a9a2ee38814f31162a0654a970dee · dirty yes · first drive 3889
- commit 501735316ba87dabc6c51510f9354cb12ff7477f · dirty yes · first drive 3890
Why this release exists
Fully recorded- Chain896 (created 2026-11-08T18:51:36Z · trigger customer_request · upstream version v4.7.5) [chains, chains #896]
- Requestbuild request #571 (rebuild) (requested at 2026-11-08T07:25:43Z · requested by kitforge-agent · version v4.7.5) [build_requests, build_requests #571]
- Reasonrerelease agenda REVISION -> v4.7.4-CE-ubuntu24.04-r2 (decay loop, IMP-08) [build_requests, build_requests #571 request_reason]
- Supersedesreadystack/mastodon:v4.7.4-CE-ubuntu24.04-r1 (chain 806) [chains, chains #806]
The path through the harness
Fully recorded1 chain · 3 drives · 18 stages · 2 rewinds
Chain 896 release · ready_to_ship
Created 2026-11-08T18:51:36Z, upstream v4.7.5, build request 571 [chains, chains #896]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 3864 | 2026-11-08T18:52:07Z | 80.4 | build host 4 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3864] |
| 3889 | 2026-11-08T21:48:16Z | 7.2 | build host 4 withhold-publish | ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3889] |
| 3890 | 2026-11-08T21:58:11Z | — | build host 4 publish-held | not recorded [drive_runs, drive_runs #3890] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-08T18:52:19Z | 2026-11-08T18:52:20Z | 1 | 4
|
order_json f2ec725ca3af… |
acquire |
2026-11-08T18:52:28Z | 2026-11-08T18:52:30Z | 1 | 12
|
source_tree 1f5ecaa253d0…license_file 57c8ff33c9c0…custody_inputs 2ff15224a384…source_tree_hash b09cc8edbbc1…source_file_manifest ae1d85af5508… |
plan |
2026-11-08T18:53:10Z | 2026-11-08T18:53:11Z | 1 | 10
|
recon_report a9bfaf664903…input_pin_plan 8d77cb9b54cd…toolchain_lock 3c70c1fa317d… |
assemble_kit |
2026-11-08T19:18:21Z | 2026-11-08T19:18:22Z | 1 | 27
|
dockerfile 8ee4e4697097…build_recipe e2bd1e862457…system_pinning b15de43eae5a…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health 6ebab3bdf40a…verify_offline_sh 3e8184ea230c…base_image_digests 0cfd6c80e90e…dockerfile_offline 8ee4e4697097…first_build_digest e76abf039c79… |
remediate |
2026-11-08T19:18:58Z | 2026-11-08T19:18:58Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log c3cd39370998…security_report 84ac21c0120c… |
build_kit |
2026-11-08T19:46:22Z | 2026-11-08T19:46:23Z | 1 | 9
|
cosign_stamp abeb6d0b0def…locked_digest 5072089bc798…freeze_manifest 6607dafd637c…offline_rebuild_transcript 5fc5afc2bf69… |
verdict |
2026-11-08T19:48:27Z | 2026-11-08T19:48:27Z | 1 | 8
|
scout_verdict cfd696162bfa… |
publish_image |
2026-11-08T19:49:30Z | 2026-11-08T19:49:31Z | 1 | 7
|
hub_readme da2021569adc…promotion_record abfd02b002ff… |
boot_instance |
2026-11-08T19:50:16Z | 2026-11-08T19:50:19Z | 2 | 3
|
instance_handle 119051feca77… |
sbom |
2026-11-08T19:50:48Z | 2026-11-08T19:50:49Z | 1 | 5
|
sbom_md f9adf3220acb…sbom_json 512361dbde44… |
schema_discovery |
2026-11-08T19:50:52Z | 2026-11-08T19:50:52Z | 1 | 7
|
schema_hash 97be38c90291…dependency_tree 11d991c2107e…table_classification e517c4ee2100… |
admin_handbook |
2026-11-08T19:51:07Z | 2026-11-08T19:51:08Z | 1 | 7
|
api_map 9d8e86b6cacb…admin_handbook fe2331ebea78… |
db_handbook |
2026-11-08T19:51:26Z | 2026-11-08T19:51:27Z | 1 | 8
|
db_handbook 9b008e92c215…seed_isolation 7cb70bb06348… |
seed_data |
2026-11-08T19:51:58Z | 2026-11-08T19:51:59Z | 1 | 6
|
seed_data_sql 0156ce36d3d6…seed_cases_json 4ac115a7ea34… |
seed_validate |
2026-11-08T19:52:01Z | 2026-11-08T19:52:02Z | 1 | 3
|
seed_data_contract 45aba6ad95e1… |
usecase_validate |
2026-11-08T19:52:25Z | 2026-11-08T19:52:26Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 20a1b5e62bb3…test_results 89e426cc6388…usecase_contract dc36ddf20cde… |
finalize_docs |
2026-11-08T19:52:32Z | 2026-11-08T19:52:33Z | 1 | 9
|
defects_json 36b23477a77e…release_notes c9e956e20e99…api_integration_guide 38a4d2a9d14d… |
package_archive invalidated 2026-11-08T21:57:45Z |
2026-11-08T20:12:29Z | 2026-11-08T21:55:26Z | 2 | 34 (final gate PASS)
|
sale_tar 8d77cacf8964…checksums e95969d33654…verify_md 1cdc1ef9b8b9…rebuild_md 7d69e747f5d9…manifest_txt c96c1f682bb0…actions_jsonl 968cd868ddad…provenance_md 002e8f75ca2a…assetchain_log_md e9eccaec0c0f…assetchain_log_json 5d66a467c4b9… |
[stage_runs]
Rewinds
- 2026-11-08T20:41:38Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27323] - 2026-11-08T21:57:45Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27442]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-08T21:55:26Z.
5 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 11801 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 11873 | L-A183, L-A15 |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 2028 | L-A59 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
2 rounds, 2 counted, $0.76 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-08T20:13:24Z | 0 | 3 | 1 | findings to repackage [held_rounds, held_rounds #1537] | $0.45 | 3 rounds, $40.00 | dc21e4bb86be… |
| 2 | 2026-11-08T21:56:01Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1547] | $0.30 | 3 rounds, $40.00 | 8d77cacf8964… |
Defects
Fully recorded- Ledger entries5 [defects, defects where product_slug=mastodon and this tag or chain]
- Disclosed in the archive4 [docs/defects/defects.json, entries]
5 ledger entries: by severity high 3, low 2; by status fixed-before-release 4, fixed-in-release 1.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-mastodon-9d86631409Admin handbook: AGPL source link points to the wrong file name [defects, defects #183645] | high | fixed-before-release | held review (review model) | — |
RSD-mastodon-fc9c345660Admin handbook: AGPL patch link wrong file name [defects, defects #183646] | high | fixed-before-release | held review (review model) | — |
RSD-mastodon-d6cda97121Admin handbook: AGPL patch link wrong file name (the section customers use to meet AGPL obligations) [defects, defects #183647] | high | fixed-before-release | held review (review model) | — |
RSD-mastodon-87fa0707c1Admin handbook: The nginx example does not clear Forwarded, which the release notes tell customers to do for 4.7.5 (GHSA-qp4r-p842-mw5c); upstream v4.7.5 dist/nginx.conf lines 131 and 149 add it [defects, defects #183648] | low | fixed-before-release | held review (review model) | — |
RSD-mastodon-b821169fc1Admin handbook: The section says it compares the upstream image 'at this product's version' but names v4.7.3 and a read date for that tag; this product is v4.7.4 and ghcr.io/mastodon/mastodon:v4.7.4 is published. [defects, defects #186793] | low | fixed-in-release | held review (review model) | v4.7.5-CE-ubuntu24.04-r1 |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:7f8f090d64a8d4de29c70fa0a4b87b1714f900f3f67c8135201bb98931cbcd41 · published digest sha256:7f8f090d64a8d4de29c70fa0a4b87b1714f900f3f67c8135201bb98931cbcd41 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 783) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T21:59:00Z · failing Docker Scout counts 120 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 114 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: @mastodon/mastodon, @mastodon/streaming. · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T21:58:24Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3758876743 · transparency-log entry
- log index 3758877987 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3759220042 · transparency-log entry · integrated 2026-11-08T22:05:38Z) [ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:b6ebd6f09fa58acf7b17a803db0723aa1ae6b737011978b446c2b6df7110794a · state attached · log index 3759220389 · transparency-log entry
- kind sbom · digest sha256:b6ebd6f09fa58acf7b17a803db0723aa1ae6b737011978b446c2b6df7110794a · state attached · log index 3759221416 · transparency-log entry
- kind vsa · digest sha256:b6ebd6f09fa58acf7b17a803db0723aa1ae6b737011978b446c2b6df7110794a · state attached · log index 3759222647 · transparency-log entry
- kind provenance · digest sha256:7f8f090d64a8d4de29c70fa0a4b87b1714f900f3f67c8135201bb98931cbcd41 · state attached · log index 3759223526 · transparency-log entry
- kind sbom · digest sha256:7f8f090d64a8d4de29c70fa0a4b87b1714f900f3f67c8135201bb98931cbcd41 · state attached · log index 3759224153 · transparency-log entry
- kind vsa · digest sha256:7f8f090d64a8d4de29c70fa0a4b87b1714f900f3f67c8135201bb98931cbcd41 · state attached · log index 3759224561 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/mastodon/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-08T20:13:30Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:7f8f090d64a8d4de29c70fa0a4b87b1714f900f3f67c8135201bb98931cbcd41 [clean-room rebuild ledger, runs[666]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-08T19:49:31Z [stage_runs, stage_runs chain 896 stage publish_image]
- Archive manifests written2026-11-08T22:02:23Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 998 · probed 2026-11-08T19:33:03Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-08T22:07:00Z generated: by KitForge release/build_trail.py · generator commit 501735316ba87dabc6c51510f9354cb12ff7477f
- 2026-11-08T22:08:52Z publication: promoted at 2026-11-08T22:07:33Z · promoted digest sha256:b6ebd6f09fa58acf7b17a803db0723aa1ae6b737011978b446c2b6df7110794a · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 393 · checklist status complete · checklist at 2026-11-08T22:08:52Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/mastodon/v4.7.5-CE-ubuntu24.04-r1/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/mastodon/v4.7.5-CE-ubuntu24.04-r1/), as staged for publishing | — |
ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.rebuild.json | beside the archive (prodasset /data/production/mastodon/v4.7.5-CE-ubuntu24.04-r1/), as staged for publishing | — |
ReadyStack-mastodon-v4.7.5-CE-ubuntu24.04-r1.rebuild.json.sigstore | beside the archive (prodasset /data/production/mastodon/v4.7.5-CE-ubuntu24.04-r1/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/mastodon/v4.7.5-CE-ubuntu24.04-r1/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 571 |
chains | sadb, ReadyStack's engine database (not published) | 896 |
defects | sadb, ReadyStack's engine database (not published) | mastodon v4.7.5-CE-ubuntu24.04-r1 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 896 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 896 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 896 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 896 |
release_images | sadb, ReadyStack's engine database (not published) | mastodon v4.7.5-CE-ubuntu24.04-r1 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 896 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 896 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |