Miniflux 2.3.5-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/miniflux:2.3.5-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/miniflux:2.3.5-CE-ubuntu24.04-r1
  • Index digestsha256:fa49fe81ae999d30487ae0856aaff686966413747e4e11c0fb10edbed33387e7
  • linux/amd64 digestsha256:ea02383e5c19097b34792bc536b968659af01154077c9492183aec567fe4cfb3
  • ArchiveReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 nowfb2a834d106316c22ae582d4a510025057bef7c4345ff86aea1248da50612a97
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-08T09:24:55Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.trail.json
ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.trail.jsonReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.trail.mdMiniflux product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductMiniflux (miniflux) [MANIFEST.json]
  • Release tag2.3.5-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/miniflux:2.3.5-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:fa49fe81ae999d30487ae0856aaff686966413747e4e11c0fb10edbed33387e7 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:ea02383e5c19097b34792bc536b968659af01154077c9492183aec567fe4cfb3 [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.tar.gz (bytes 455446768) [MANIFEST.json]
  • Archive sha256 at publishfb2a834d106316c22ae582d4a510025057bef7c4345ff86aea1248da50612a97 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/miniflux/v2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref2.3.5 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitfaecfa2fac61a91f4f69550bb1afd506c4b51749 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash0f56ee14b8860f3a29387d4aba9e2a3bc569f003173c77f7f8a352760ea5be21 (files 676) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:bad38b9c5ff5772b7c27c3d90387636d3d9137b0e1db428ec8bade5b636d87b6 [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793505308 (utc 2026-11-01T03:55:08Z) [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit 90d1190e36d2953ca89c72198cc95ee12f35e803 · dirty yes · first drive 3541
    • commit 07abd1e1c1197982ae81cf5d46861dd8f90c3cf6 · dirty yes · first drive 3551
    • commit 2488ac8956ee2098ba13f3ff11fe53d8cbec9ffb · dirty yes · first drive 3590
    • commit faa2f5b57c5449de26e6fdd34626d1f8d9e472a6 · dirty yes · first drive 3600
    • commit 120579f1916582dbd0a42b015d97b8dd63740a06 · dirty yes · first drive 3630
    • commit c5454541988413acee973d174dd436e17d7a9974 · dirty yes · first drive 3682
    • commit 92dcb99fd5af2466b8a040e9b12f1cd9afdd07b3 · dirty yes · first drive 3688
    • commit 1d24a22962e9de18cdeec385796ad8804bed7d3c · dirty yes · first drive 3713
    • commit 652df6e0e6aa50b44c0f12948b3d5baab047fc1f · dirty yes · first drive 3743
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain825 (created 2026-11-07T02:17:47Z · trigger customer_request · upstream version 2.3.5) [chains, chains #825]
  • Requestbuild request #505 (rebuild) (requested at 2026-11-07T02:00:15Z · requested by kitforge-agent · version 2.3.5) [build_requests, build_requests #505]
  • Reasonretarget to 2.3.5: a newer upstream release (rule 1) [build_requests, build_requests #505 request_reason]
  • Supersedesreadystack/miniflux:2.3.4-CE-ubuntu24.04-r3 (chain 721) [chains, chains #721]

The path through the harness

Fully recorded

1 chain · 9 drives · 18 stages · 4 rewinds

Chain 825 release · ready_to_ship

Created 2026-11-07T02:17:47Z, upstream 2.3.5, build request 505 [chains, chains #825]

DriveStartedMinutesBuild hostHow it stopped
35412026-11-07T02:18:08Z25.2build host 3 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3541]
35512026-11-07T03:17:15Z2.7build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3551]
35902026-11-07T06:14:24Z2.9build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3590]
36002026-11-07T07:05:06Z1.6build host 3 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3600]
36302026-11-07T09:24:23Z1.3build host 3 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3630]
36822026-11-08T04:09:50Z1.1build host 3 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3682]
36882026-11-08T04:28:42Z0.8build host 3 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3688]
37132026-11-08T06:06:18Z3.7build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3713]
37432026-11-08T09:20:55Z—build host 3 publish-held not recorded [drive_runs, drive_runs #3743]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-07T02:18:19Z2026-11-07T02:18:19Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 7186e4d605d6…
acquire 2026-11-07T02:18:24Z2026-11-07T02:18:24Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree af131423f885…
license_file 0d542e0c8804…
custody_inputs c8589f4d4672…
source_tree_hash 65e2fbe7c858…
source_file_manifest 5ec9ee3c9352…
plan 2026-11-07T02:18:57Z2026-11-07T02:18:57Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report f7deaee1b0a0…
input_pin_plan fc00722d2bf3…
toolchain_lock 14ed3f88c016…
assemble_kit 2026-11-07T02:20:41Z2026-11-07T02:20:42Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 4602391adabe…
build_recipe f6bdf8ac0d76…
system_pinning fa091140511e…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 0ae7dd7449cf…
verify_offline_sh 3e8184ea230c…
base_image_digests c7a5b4098088…
dockerfile_offline 4602391adabe…
first_build_digest 1a6cefd4592a…
remediate 2026-11-07T02:21:15Z2026-11-07T02:21:16Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 03873503caf0…
security_report 9bc73e710525…
build_kit 2026-11-07T02:23:51Z2026-11-07T02:23:51Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp cfa44c9ef4d3…
locked_digest d10a62ad139a…
freeze_manifest f782faa2ba19…
offline_rebuild_transcript 29a584738b85…
verdict 2026-11-07T02:24:18Z2026-11-07T02:24:19Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 07769cdc7037…
publish_image 2026-11-07T02:24:47Z2026-11-07T02:24:48Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 04d5945c4c25…
promotion_record a4cd6623aca3…
boot_instance 2026-11-07T02:25:06Z2026-11-07T02:25:11Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle befa9f2f56fb…
sbom 2026-11-07T02:25:19Z2026-11-07T02:25:19Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md e52b8d00c5b2…
sbom_json 97448e51e5f1…
schema_discovery 2026-11-07T02:25:22Z2026-11-07T02:25:23Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 7283d823815a…
dependency_tree 1767cc681505…
table_classification 0b2b4c7b9d07…
admin_handbook 2026-11-07T02:28:32Z2026-11-07T02:28:32Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 370132cc6d2c…
admin_handbook f7c20a190f4f…
db_handbook 2026-11-07T02:32:20Z2026-11-07T02:32:21Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook b3eaecf908b7…
seed_isolation cd95abca06c2…
seed_data 2026-11-07T02:32:35Z2026-11-07T02:32:36Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql df3393caf6cf…
seed_cases_json 7e8e4693b0b3…
seed_validate 2026-11-07T02:32:38Z2026-11-07T02:32:39Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 843d802dc6f6…
usecase_validate 2026-11-07T02:33:04Z2026-11-07T02:33:05Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests e5dff2a34e32…
test_results 4ecd09503dcc…
usecase_contract 07af70f34a88…
finalize_docs 2026-11-07T02:38:28Z2026-11-07T02:38:29Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 40eb6165e9cb…
release_notes 17b6c1cfed0b…
api_integration_guide 9f33f24520c5…
package_archive invalidated 2026-11-08T09:20:31Z 2026-11-07T02:43:16Z2026-11-08T06:09:57Z8
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar fb30fa9cfb1b…
checksums f08389b4202c…
verify_md d5f96db4f22d…
rebuild_md 0b4bae378223…
manifest_txt 47403fdb09fb…
actions_jsonl bcf4dda2fb79…
provenance_md 51291a4462e2…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json c2603b5c7390…

[stage_runs]

Rewinds

  • 2026-11-07T03:04:03Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #23384]
  • 2026-11-07T03:39:18Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #23564]
  • 2026-11-07T06:42:25Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24140]
  • 2026-11-08T09:20:31Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #25705]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-08T06:09:57Z.

121 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 07186 —
remediate2001 010463 L-A08, L-038, L-036, L-034, L-032
admin_handbook19402 066051 —
db_handbook24703 193598 —
usecase_validate1001 01835 —
finalize_docs733503 13316715 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

4 rounds, 4 counted, $5.03 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-07T02:43:50Z 0411 findings to repackage [held_rounds, held_rounds #1419] $1.24 3 rounds, $40.00 889892196ac9…
22026-11-07T03:20:25Z 008 clean to repackage [held_rounds, held_rounds #1422] $1.13 3 rounds, $40.00 1008bd082945…
32026-11-07T06:17:44Z 006 clean to repackage [held_rounds, held_rounds #1442] $1.31 3 rounds, $40.00 512cf532015b…
42026-11-08T06:10:36Z 001 clean to publish [held_rounds, held_rounds #1480] $1.34 3 rounds, $40.00 fb30fa9cfb1b…

Defects

Fully recorded
  • Ledger entries30 [defects, defects where product_slug=miniflux and this tag or chain]
  • Disclosed in the archive29 [docs/defects/defects.json, entries]

30 ledger entries: by severity critical 1, high 4, low 25; by status fixed-in-release 1, fixed-before-release 29.

DefectSeverityStatusFound byFixed in
RSD-miniflux-f15704fa5b
CVE-2026-111497 in github.com/andybalholm/brotli v1.2.6 is on CISA's Known Exploited Vulnerabilities list [defects, defects #158038]		criticalfixed-in-releaseimage scan2.3.5-CE-ubuntu24.04-r1
RSD-miniflux-69e99624a6
Admin handbook: The example passes 'miniflux' as an argument to an entrypoint that is already miniflux; it starts the daemon instead of printing the version. [defects, defects #158193]		highfixed-before-releaseheld review (review model)—
RSD-miniflux-c6bcdd56ec
Database handbook: The documented one-off command has no --env-file, so Miniflux dials localhost:5432 and exits with connection refused; the administrator is never created. [defects, defects #158194]		highfixed-before-releaseheld review (review model)—
RSD-miniflux-9e36ea7a47
Admin handbook: Says both variables must be set; FETCHER_ALLOW_PRIVATE_FEED_PROXY=1 alone is sufficient. [defects, defects #158195]		highfixed-before-releaseheld review (review model)—
RSD-miniflux-9d5fa7a759
Admin handbook: False statement of behaviour and contradicts :94, :497 and the API guide. [defects, defects #158196]		highfixed-before-releaseheld review (review model)—
RSD-miniflux-e56b8b52ad
Admin handbook: 224.0.0.0/4 is the multicast range, not 'the local network'. [defects, defects #158197]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-4060e0a1e4
Admin handbook: Previous-round minor, still not fixed: the table at lines 148-149 shows Entrypoint none / CMD /usr/bin/miniflux versus this image's entrypoint `miniflux`, but the change list (lines 153-165: volume… [defects, defects #158198]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-ab153c6bf2
Admin handbook: 'restart' does not reload the env file; contradicts :285. [defects, defects #158199]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-ba1109290c
Database handbook: Claims either flag unblocks feeds on private addresses; the proxy flag does not. [defects, defects #158200]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-c61b4acae6
Database handbook: Omits the proxy-only flag the same handbook documents at :371. [defects, defects #158201]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-a72f38a710
Database handbook: 'Runs with no authentication' can be read as open access; the instance is closed. [defects, defects #158202]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-b5b19ee032
Database handbook: Paragraph describes a 503 from a running daemon but its sslmode advice describes a start-time exit; the two outcomes are mixed. [defects, defects #158203]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-c73ca438a0
API guide: States the parameter as mandatory; it is only needed to turn TLS off. [defects, defects #158204]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-e6e76df529
API guide: Contradicts the table row above it. [defects, defects #158205]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-0e6264e1c3
API guide: API keys are created by the user who owns them. [defects, defects #158206]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-c975b8c3d7
API guide: A running container's environment cannot be changed; the variable takes effect at the next start. [defects, defects #158207]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-ec09cd76f9
API guide: Ran the image with --env-file plus -e 'ADMIN_USERNAME=John Smith': it logged the migrations, printed 'Invalid username. [defects, defects #158771]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-4cf3949fba
API guide: Live: GET /v1/categories returned [{"id":1,"title":"All","user_id":1,"hide_globally":false}] (200); with ?counts=true it added "feed_count":0,"total_unread":0. [defects, defects #158772]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-e393085b3a
API guide: Live: stopped the postgres container under a running miniflux: /healthcheck 503 'Database Connection Error: ...', health unhealthy; after restarting postgres it returned 200 OK without restarting… [defects, defects #158773]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-4231b94214
API guide: The records do not show the web UI calling /v1 (unsupported); the table that follows lists /healthcheck, which is not under /v1 and needs no authentication (ADMIN_HANDBOOK.md:273). [defects, defects #158774]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-e2bd19f6ef
API guide: Contradicts API_INTEGRATION_GUIDE.md:523 ('not accessible through Docker's port mapping or from other containers') and DB_HANDBOOK.md:443 ('only --network host will reach it'); with --network host… [defects, defects #158775]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-31a316ab12
Database handbook: Ran -e RUN_MIGRATIONS=0 -e DATABASE_URL=postgres://u:p@nohost:5432/x?sslmode=disable: exited with 'dial tcp: lookup nohost ... [defects, defects #158776]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-009470822b
Admin handbook: Live: a non-admin-created second user 'bob' (created with -create-admin) returned 200 on GET /v1/me with -u bob:abcdef; API_INTEGRATION_GUIDE.md:87 says 'a username and account password'. [defects, defects #158777]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-fb44ff4809
API guide: Contradicts ADMIN_HANDBOOK.md:217: not every /v1 endpoint returns JSON. [defects, defects #164107]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-9cc4a45ddd
API guide: Same paraphrase of the round-2 finding at a second location. [defects, defects #164108]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-958b63f782
API guide: Cross-section contradiction on loopback reachability. [defects, defects #164109]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-97182ed7a9
API guide: Over-general error claim: only a space yields invalid userinfo. [defects, defects #164110]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-2fc98aa45c
Database handbook: The sentence promises a docker run example and gives a docker exec one. [defects, defects #164111]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-202590285c
Admin handbook: Migration list omits the entrypoint/CMD change. [defects, defects #164112]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-105f259468
API guide: Content-type statement without the /v1/export exception contradicts the other sections. [defects, defects #170923]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:ea02383e5c19097b34792bc536b968659af01154077c9492183aec567fe4cfb3 · published digest sha256:ea02383e5c19097b34792bc536b968659af01154077c9492183aec567fe4cfb3 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 72) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T09:21:17Z · failing Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T09:21:08Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3753184545 · transparency-log entry · integrated 2026-11-08T09:23:49Z) [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:fa49fe81ae999d30487ae0856aaff686966413747e4e11c0fb10edbed33387e7 · state attached · log index 3753185982 · transparency-log entry
    • kind sbom · digest sha256:fa49fe81ae999d30487ae0856aaff686966413747e4e11c0fb10edbed33387e7 · state attached · log index 3753187527 · transparency-log entry
    • kind vsa · digest sha256:fa49fe81ae999d30487ae0856aaff686966413747e4e11c0fb10edbed33387e7 · state attached · log index 3753188909 · transparency-log entry
    • kind provenance · digest sha256:ea02383e5c19097b34792bc536b968659af01154077c9492183aec567fe4cfb3 · state attached · log index 3753190255 · transparency-log entry
    • kind sbom · digest sha256:ea02383e5c19097b34792bc536b968659af01154077c9492183aec567fe4cfb3 · state attached · log index 3753191479 · transparency-log entry
    • kind vsa · digest sha256:ea02383e5c19097b34792bc536b968659af01154077c9492183aec567fe4cfb3 · state attached · log index 3753193157 · transparency-log entry
    (at 2026-11-08T09:23:49Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/miniflux/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-07T02:43:54Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:ea02383e5c19097b34792bc536b968659af01154077c9492183aec567fe4cfb3 [clean-room rebuild ledger, runs[595]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-07T02:24:48Z [stage_runs, stage_runs chain 825 stage publish_image]
  • Archive manifests written2026-11-08T09:22:41Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 57 · probed 2026-11-07T02:22:20Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-08T09:24:55Z generated: by KitForge release/build_trail.py · generator commit 652df6e0e6aa50b44c0f12948b3d5baab047fc1f
  • 2026-11-08T09:26:11Z publication: promoted at 2026-11-08T09:25:29Z · promoted digest sha256:fa49fe81ae999d30487ae0856aaff686966413747e4e11c0fb10edbed33387e7 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 358 · checklist status complete · checklist at 2026-11-08T09:26:11Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/miniflux/2.3.5-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/miniflux/2.3.5-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/miniflux/2.3.5-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/miniflux/2.3.5-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/miniflux/2.3.5-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)505
chainssadb, ReadyStack's engine database (not published)825
defectssadb, ReadyStack's engine database (not published)miniflux 2.3.5-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 825
held_roundssadb, ReadyStack's engine database (not published)chain 825
lesson_recallssadb, ReadyStack's engine database (not published)chain 825
micro_step_runssadb, ReadyStack's engine database (not published)chain 825
release_imagessadb, ReadyStack's engine database (not published)miniflux 2.3.5-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 825
stage_runssadb, ReadyStack's engine database (not published)chain 825
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—