Miniflux 2.3.5-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/miniflux:2.3.5-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/miniflux:2.3.5-CE-ubuntu24.04-r2
  • Index digestsha256:aa8a4df79330ef791b99ed5aadc413b04ef9e9e87236c18c252df419bb5c5350
  • linux/amd64 digestsha256:20a8a8a8ff669777be7ab21aefe78e7be3f0deb603c55c593ff32faf5f8bddf6
  • ArchiveReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 nowcd0c273fd31eb35278f234f6d2971c2c36f53f0bb1e36037f02af26bd6ee56ee
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-12T20:42:00Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.trail.json
ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.trail.jsonReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.trail.mdMiniflux product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductMiniflux (miniflux) [MANIFEST.json]
  • Release tag2.3.5-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/miniflux:2.3.5-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:aa8a4df79330ef791b99ed5aadc413b04ef9e9e87236c18c252df419bb5c5350 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:20a8a8a8ff669777be7ab21aefe78e7be3f0deb603c55c593ff32faf5f8bddf6 [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.tar.gz (bytes 455652089) [MANIFEST.json]
  • Archive sha256 at publishcd0c273fd31eb35278f234f6d2971c2c36f53f0bb1e36037f02af26bd6ee56ee [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/miniflux/v2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref2.3.5 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitfaecfa2fac61a91f4f69550bb1afd506c4b51749 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash0f56ee14b8860f3a29387d4aba9e2a3bc569f003173c77f7f8a352760ea5be21 (files 676) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:eb1150d20b115c944d163396acc01fb35b01ab7d7e2054688e31d8687d80098c [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794448229 (utc 2026-11-12T01:50:29Z) [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.11-bookworm@sha256:dc40a13b61304647ed7e5d581d246b86413dfc29d63c6d018310feb93cd98fc0 · platform digest sha256:79ecd0a7157c7a4cf3b281ced8465350591bf54fedab540e75374a003e1fde7e
    • ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
    [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit 1d3c43d9db86693d3b22280581f5473f4d3bdb92 · dirty yes · first drive 4457
    • commit d6d7f1aa091cf0be154f9c62ac83dffb55f782cb · dirty yes · first drive 4462
    • commit 89246b3fdf7ea046df3d0e48f836a371a0c3bdf9 · dirty yes · first drive 4468
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain1034 (created 2026-11-12T18:16:16Z · trigger customer_request · upstream version 2.3.5) [chains, chains #1034]
  • Requestbuild request #702 (rebuild) (requested at 2026-11-12T01:50:31Z · requested by kitforge-agent · version 2.3.5) [build_requests, build_requests #702]
  • Reasonrevision 2.3.5-CE-ubuntu24.04-r2: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #702 request_reason]
  • Supersedesreadystack/miniflux:2.3.5-CE-ubuntu24.04-r1 (chain 825) [chains, chains #825]

The path through the harness

Fully recorded

1 chain · 3 drives · 18 stages · 2 rewinds

Chain 1034 release · ready_to_ship

Created 2026-11-12T18:16:16Z, upstream 2.3.5, build request 702 [chains, chains #1034]

DriveStartedMinutesBuild hostHow it stopped
44572026-11-12T18:16:38Z26.3build host 5 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4457]
44622026-11-12T19:53:04Z2.8build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4462]
44682026-11-12T20:37:57Z—build host 5 publish-held not recorded [drive_runs, drive_runs #4468]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-12T18:16:49Z2026-11-12T18:16:50Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 69c9caf1ac36…
acquire 2026-11-12T18:16:54Z2026-11-12T18:16:55Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree af131423f885…
license_file 0d542e0c8804…
custody_inputs c8589f4d4672…
source_tree_hash 65e2fbe7c858…
source_file_manifest 5ec9ee3c9352…
plan 2026-11-12T18:17:24Z2026-11-12T18:17:25Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 51800b819518…
input_pin_plan 5765ef171a2e…
toolchain_lock 4db7fe437f37…
assemble_kit 2026-11-12T18:19:50Z2026-11-12T18:19:51Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile fb19eb95dab7…
build_recipe ef2ecdf96552…
system_pinning aa8db05a9a8a…
build_offline_sh 6ab4f08a6ec7…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 985e3013d400…
verify_offline_sh 3e8184ea230c…
base_image_digests 71074f5aeb8b…
dockerfile_offline fb19eb95dab7…
first_build_digest 9f90c90feb55…
remediate 2026-11-12T18:20:18Z2026-11-12T18:20:19Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 09d01eea446b…
security_report 0836fc4c46a9…
build_kit 2026-11-12T18:23:52Z2026-11-12T18:23:53Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 383ddf80fd5e…
locked_digest aa4ff6a3daa0…
freeze_manifest 3ce176c55dde…
offline_rebuild_transcript 7e235d0d71f3…
verdict 2026-11-12T18:24:23Z2026-11-12T18:24:24Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 977856171be6…
publish_image 2026-11-12T18:25:01Z2026-11-12T18:25:02Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 79c2e99086c8…
promotion_record 890383adb0c6…
boot_instance 2026-11-12T18:25:21Z2026-11-12T18:25:27Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle db19a86020e7…
sbom 2026-11-12T18:25:36Z2026-11-12T18:25:37Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md f8ccd2bf995c…
sbom_json bed17811e72c…
schema_discovery 2026-11-12T18:25:39Z2026-11-12T18:25:40Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 7283d823815a…
dependency_tree 1767cc681505…
table_classification 0b2b4c7b9d07…
admin_handbook 2026-11-12T18:30:31Z2026-11-12T18:30:32Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 370132cc6d2c…
admin_handbook bfaf1fde2329…
db_handbook 2026-11-12T18:35:56Z2026-11-12T18:35:57Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook efb3c6f9e7cb…
seed_isolation cd95abca06c2…
seed_data 2026-11-12T18:36:12Z2026-11-12T18:36:13Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql df3393caf6cf…
seed_cases_json 7456ffd171e3…
seed_validate 2026-11-12T18:36:16Z2026-11-12T18:36:17Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 35a176bc440f…
usecase_validate 2026-11-12T18:36:44Z2026-11-12T18:36:44Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 6c9fb551edcb…
test_results e37a0ec1586e…
usecase_contract cf4dfbcd7e63…
finalize_docs 2026-11-12T18:36:51Z2026-11-12T18:36:52Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 1142bc8e4957…
release_notes e132d286fc24…
api_integration_guide 82ab5c247586…
package_archive invalidated 2026-11-12T20:37:27Z 2026-11-12T18:42:52Z2026-11-12T19:55:50Z2
37 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 unpack_files
  • G8 scout_grade_a
  • G8 script_copies
  • G8 upgrade_check
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 341e1244814a…
checksums ad3a92ca9c0a…
verify_md 0fef4fb10c20…
rebuild_md 8b8b9cfa455a…
manifest_txt 2baafdb4b893…
actions_jsonl 08e28c4045b3…
provenance_md 002829d2f154…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 1698cc8e4c2f…

[stage_runs]

Rewinds

  • 2026-11-12T19:05:01Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #34387]
  • 2026-11-12T20:37:27Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #34502]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-12T19:55:50Z.

59 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 07064 L-A183, L-A15
remediate2001 07020 L-A183, L-A15
admin_handbook22403 0114557 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook321003 4160854 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate1001 01894 L-A59

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $1.96 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-12T18:43:37Z 147 findings to repackage [held_rounds, held_rounds #1831] $1.14 3 rounds, $40.00 e6ab43fea3d7…
22026-11-12T19:56:10Z 007 clean to publish [held_rounds, held_rounds #1833] $0.82 3 rounds, $40.00 341e1244814a…

Defects

Fully recorded
  • Ledger entries19 [defects, defects where product_slug=miniflux and this tag or chain]
  • Disclosed in the archive19 [docs/defects/defects.json, entries]

19 ledger entries: by severity critical 1, high 4, low 14; by status fixed-before-release 19.

DefectSeverityStatusFound byFixed in
RSD-miniflux-ec3478348f
Admin handbook: The documented restore procedure, run on a database that has data, does not restore: it prints errors, keeps the changes made after the backup and leaves the sequences reset, so later writes fail. [defects, defects #272564]		criticalfixed-before-releaseheld review (review model)—
RSD-miniflux-dee460f108
Admin handbook: The claim that state reappears is true only for a restore into an empty database; the section never says the target must be empty or new. [defects, defects #272565]		highfixed-before-releaseheld review (review model)—
RSD-miniflux-f01f5fb37c
Database handbook: The example env file sets ADMIN_PASSWORD without CREATE_ADMIN and ADMIN_USERNAME, so no administrator is created and nobody can log in; it contradicts 'Creating the First Administrator' (three… [defects, defects #272566]		highfixed-before-releaseheld review (review model)—
RSD-miniflux-a51750599c
Admin handbook: False: the HEALTHCHECK is fixed to port 8080, so the documented LISTEN_ADDR=0.0.0.0:9000 example leaves a working service reported unhealthy. [defects, defects #272567]		highfixed-before-releaseheld review (review model)—
RSD-miniflux-5a3787ed0c
Admin handbook: The 9000 example uses a container port the image neither exposes nor probes (docs audit finding, confirmed). [defects, defects #272568]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-b91c0670b6
Admin handbook: Docs-audit finding: this section names only the numeric IDs, not the user 'miniflux'. [defects, defects #272569]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-5777b68730
Admin handbook: Contradicts the Operating facts ('read on every start'): the variables are not read only on first startup and are not removed automatically, so this sentence tells a customer who still has them that… [defects, defects #272570]		highfixed-before-releaseheld review (review model)—
RSD-miniflux-5e4f867060
Admin handbook: No named volume exists in the documented start command or the image; contradicts 'no volume' elsewhere. [defects, defects #272571]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-cccb6f8381
Admin handbook: The step's only command is `docker run --name miniflux`, which fails while the old container exists; the removal is mentioned only in the following paragraph. [defects, defects #272572]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-110c88f7ff
Database handbook: 'Restart' contradicts the same handbook (line 630: docker restart does not re-read the env file) and the command shown is a docker run that conflicts with the existing name. [defects, defects #272573]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-c6ca8e2f32
Database handbook: This DATABASE_URL has no sslmode=disable, so a stock PostgreSQL makes Miniflux exit with 'pq: SSL is not enabled on the server', contradicting the Operating facts env file. [defects, defects #272574]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-96f2ca4e1e
Admin handbook: Overstated: contradicts DB handbook line 567 (a TLS server uses sslmode=require) and line 497 (only on an unencrypted server). [defects, defects #272575]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-5bdef9b194
Admin handbook: The sentence says the label holds 2.3.5; the image's label holds the full tag. [defects, defects #273134]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-e687d8d18b
Database handbook: Contradicts line 700 of the same handbook (three variables). [defects, defects #273135]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-b767c3d1d5
Database handbook: Wrong cross-reference: Operating facts does not document LOG_LEVEL or the FETCHER_ variables. [defects, defects #273136]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-88d095d72f
Database handbook: Wrong cross-reference. [defects, defects #273137]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-7746b0b277
Admin handbook: Overstated: the first clause says the server must permit non-TLS connections, contradicting the next sentence and DB handbook line 569. [defects, defects #273138]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-cdaa56b724
Database handbook: 'then restart' after editing the env file would not apply the fix; contradicts line 632. [defects, defects #273139]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-5a52fa7c2c
Release notes: Refers to data volumes the image does not have; contradicts the handbooks. [defects, defects #273140]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:20a8a8a8ff669777be7ab21aefe78e7be3f0deb603c55c593ff32faf5f8bddf6 · published digest sha256:20a8a8a8ff669777be7ab21aefe78e7be3f0deb603c55c593ff32faf5f8bddf6 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 115) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T20:38:20Z · failing Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T20:38:07Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3839318878 · transparency-log entry · integrated 2026-11-12T20:40:54Z) [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:aa8a4df79330ef791b99ed5aadc413b04ef9e9e87236c18c252df419bb5c5350 · state attached · log index 3839320310 · transparency-log entry
    • kind sbom · digest sha256:aa8a4df79330ef791b99ed5aadc413b04ef9e9e87236c18c252df419bb5c5350 · state attached · log index 3839321565 · transparency-log entry
    • kind vsa · digest sha256:aa8a4df79330ef791b99ed5aadc413b04ef9e9e87236c18c252df419bb5c5350 · state attached · log index 3839323074 · transparency-log entry
    • kind provenance · digest sha256:20a8a8a8ff669777be7ab21aefe78e7be3f0deb603c55c593ff32faf5f8bddf6 · state attached · log index 3839324553 · transparency-log entry
    • kind sbom · digest sha256:20a8a8a8ff669777be7ab21aefe78e7be3f0deb603c55c593ff32faf5f8bddf6 · state attached · log index 3839325547 · transparency-log entry
    • kind vsa · digest sha256:20a8a8a8ff669777be7ab21aefe78e7be3f0deb603c55c593ff32faf5f8bddf6 · state attached · log index 3839326757 · transparency-log entry
    (at 2026-11-12T20:40:55Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/miniflux/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-12T18:43:42Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:20a8a8a8ff669777be7ab21aefe78e7be3f0deb603c55c593ff32faf5f8bddf6 [clean-room rebuild ledger, runs[802]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-12T18:25:02Z [stage_runs, stage_runs chain 1034 stage publish_image]
  • Archive manifests written2026-11-12T20:39:47Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 57 · probed 2026-11-12T18:21:39Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-12T20:42:00Z generated: by KitForge release/build_trail.py · generator commit 89246b3fdf7ea046df3d0e48f836a371a0c3bdf9
  • 2026-11-12T20:43:21Z publication: promoted at 2026-11-12T20:42:41Z · promoted digest sha256:aa8a4df79330ef791b99ed5aadc413b04ef9e9e87236c18c252df419bb5c5350 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 518 · checklist status complete · checklist at 2026-11-12T20:43:21Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/miniflux/2.3.5-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/miniflux/2.3.5-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/miniflux/2.3.5-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/miniflux/2.3.5-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/miniflux/2.3.5-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)702
chainssadb, ReadyStack's engine database (not published)1034
defectssadb, ReadyStack's engine database (not published)miniflux 2.3.5-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 1034
held_roundssadb, ReadyStack's engine database (not published)chain 1034
lesson_recallssadb, ReadyStack's engine database (not published)chain 1034
micro_step_runssadb, ReadyStack's engine database (not published)chain 1034
release_imagessadb, ReadyStack's engine database (not published)miniflux 2.3.5-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 1034
stage_runssadb, ReadyStack's engine database (not published)chain 1034
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—