Miniflux 2.3.5-CE-ubuntu24.04-r3 build trail

How ReadyStack built readystack/miniflux:2.3.5-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/miniflux:2.3.5-CE-ubuntu24.04-r3
  • Index digestsha256:42c33e19d9b400bf2029996037db52d861a0262f3cdbcbed6604596d1216dc6a
  • linux/amd64 digestsha256:46d8b08d0582b9a8b93001232f81eb63e32e42eb2a466fed1c00c1bb5ed69677
  • ArchiveReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.tar.gz
  • Archive SHA-256 nowd412d25b0de40a39f8b305517c2a37ed5a8f8c18b1e736f3438d221349f37d6b
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-13T17:24:19Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.trail.json
ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.trail.jsonReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.trail.json.sigstoreReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.trail.mdMiniflux product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductMiniflux (miniflux) [MANIFEST.json]
  • Release tag2.3.5-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Imagereadystack/miniflux:2.3.5-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Image index digestsha256:42c33e19d9b400bf2029996037db52d861a0262f3cdbcbed6604596d1216dc6a [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:46d8b08d0582b9a8b93001232f81eb63e32e42eb2a466fed1c00c1bb5ed69677 [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.tar.gz (bytes 455654655) [MANIFEST.json]
  • Archive sha256 at publishd412d25b0de40a39f8b305517c2a37ed5a8f8c18b1e736f3438d221349f37d6b [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/miniflux/v2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref2.3.5 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitfaecfa2fac61a91f4f69550bb1afd506c4b51749 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash0f56ee14b8860f3a29387d4aba9e2a3bc569f003173c77f7f8a352760ea5be21 (files 676) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:5559b6ded279ad35fb8f7824e3df6c37e5df94548c9cb886048a46764f1637f4 [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794578574 (utc 2026-11-13T14:02:54Z) [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.11-bookworm@sha256:dc40a13b61304647ed7e5d581d246b86413dfc29d63c6d018310feb93cd98fc0 · platform digest sha256:79ecd0a7157c7a4cf3b281ced8465350591bf54fedab540e75374a003e1fde7e
    • ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
    [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.rebuild.json, engine]
  • Engine commit(s)
    • commit 073535c62a45bea8f3f14b90d7062837d7d2da35 · dirty yes · first drive 4615
    • commit 1252a76ccb9fe0963d2efc0d07028de8176a15fe · dirty yes · first drive 4622
    • commit 1f57518c1e119546b8c0a074f3e484d7bf2f3b33 · dirty yes · first drive 4628
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain1089 (created 2026-11-13T16:12:36Z · trigger customer_request · upstream version 2.3.5) [chains, chains #1089]
  • Requestbuild request #764 (rebuild) (requested at 2026-11-13T14:02:56Z · requested by kitforge-agent · version 2.3.5) [build_requests, build_requests #764]
  • Reasonrerelease agenda REVISION -> 2.3.5-CE-ubuntu24.04-r3 (decay loop, IMP-08) [build_requests, build_requests #764 request_reason]
  • Supersedesreadystack/miniflux:2.3.5-CE-ubuntu24.04-r2 (chain 1034) [chains, chains #1034]

The path through the harness

Fully recorded

1 chain · 3 drives · 18 stages · 2 rewinds

Chain 1089 release · ready_to_ship

Created 2026-11-13T16:12:36Z, upstream 2.3.5, build request 764 [chains, chains #1089]

DriveStartedMinutesBuild hostHow it stopped
46152026-11-13T16:12:56Z20.3build host 3 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4615]
46222026-11-13T16:55:24Z2.5build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4622]
46282026-11-13T17:20:03Z—build host 3 publish-held not recorded [drive_runs, drive_runs #4628]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-13T16:13:07Z2026-11-13T16:13:08Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 1a5ab8687133…
acquire 2026-11-13T16:13:12Z2026-11-13T16:13:12Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree af131423f885…
license_file 0d542e0c8804…
custody_inputs c8589f4d4672…
source_tree_hash 65e2fbe7c858…
source_file_manifest 5ec9ee3c9352…
plan 2026-11-13T16:13:41Z2026-11-13T16:13:42Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report d9328d7e363d…
input_pin_plan 5f3cfa3ddbc2…
toolchain_lock b2f00cbc6173…
assemble_kit 2026-11-13T16:15:24Z2026-11-13T16:15:24Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile fd2aa748b28e…
build_recipe ffe7b6410c58…
system_pinning aa8db05a9a8a…
build_offline_sh 6ab4f08a6ec7…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 6c082bb61e66…
verify_offline_sh 3e8184ea230c…
base_image_digests 71074f5aeb8b…
dockerfile_offline fd2aa748b28e…
first_build_digest 10429df0893a…
remediate 2026-11-13T16:16:07Z2026-11-13T16:16:08Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log de26e31b3ea9…
security_report 7390b36028b0…
build_kit 2026-11-13T16:18:37Z2026-11-13T16:18:38Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 56d7db5696dc…
locked_digest 3d2db480fc1a…
freeze_manifest 3f49ec9e5112…
offline_rebuild_transcript a4366265e904…
verdict 2026-11-13T16:19:04Z2026-11-13T16:19:05Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict bbe6b980ec06…
publish_image 2026-11-13T16:19:34Z2026-11-13T16:19:35Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme f7d4613a1ea0…
promotion_record 84bfaa0fbd8b…
boot_instance 2026-11-13T16:19:52Z2026-11-13T16:19:58Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 7cea370f2cb6…
sbom 2026-11-13T16:20:05Z2026-11-13T16:20:05Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 22002a37d018…
sbom_json 0a73eab57493…
schema_discovery 2026-11-13T16:20:08Z2026-11-13T16:20:09Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 7283d823815a…
dependency_tree 1767cc681505…
table_classification 0b2b4c7b9d07…
admin_handbook 2026-11-13T16:24:47Z2026-11-13T16:24:48Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 370132cc6d2c…
admin_handbook ab8155385d92…
db_handbook 2026-11-13T16:28:23Z2026-11-13T16:28:23Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 2a6723567aab…
seed_isolation cd95abca06c2…
seed_data 2026-11-13T16:28:36Z2026-11-13T16:28:37Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql df3393caf6cf…
seed_cases_json 11e2a207a5bb…
seed_validate 2026-11-13T16:28:39Z2026-11-13T16:28:40Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 84f2bd04155e…
usecase_validate 2026-11-13T16:29:02Z2026-11-13T16:29:03Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 4c301029c058…
test_results c3a8c086da01…
usecase_contract c2b22b032f51…
finalize_docs 2026-11-13T16:29:08Z2026-11-13T16:29:09Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 0a53432d53f3…
release_notes 10ee44312e83…
api_integration_guide 0682f48b8307…
package_archive invalidated 2026-11-13T17:19:39Z 2026-11-13T16:33:11Z2026-11-13T16:57:54Z2
37 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 unpack_files
  • G8 scout_grade_a
  • G8 script_copies
  • G8 upgrade_check
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 98e21c3b46e1…
checksums 8b729d31c908…
verify_md 35ec389d8b01…
rebuild_md 157552ea376a…
manifest_txt 90bb72358791…
actions_jsonl bbd716f41ef4…
provenance_md ce1aebe8c117…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json aad4d965df97…

[stage_runs]

Rewinds

  • 2026-11-13T16:54:25Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36756]
  • 2026-11-13T17:19:39Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36830]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-13T16:57:54Z.

49 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 07171 —
remediate2001 011149 L-A08, L-038, L-036, L-034, L-032
admin_handbook24803 1110939 —
db_handbook20402 089058 —
usecase_validate1001 01805 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $2.00 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-13T16:33:48Z 037 findings to repackage [held_rounds, held_rounds #1899] $1.02 3 rounds, $40.00 67ee9ccc66df…
22026-11-13T16:58:26Z 004 clean to publish [held_rounds, held_rounds #1902] $0.98 3 rounds, $40.00 98e21c3b46e1…

Defects

Fully recorded
  • Ledger entries14 [defects, defects where product_slug=miniflux and this tag or chain]
  • Disclosed in the archive14 [docs/defects/defects.json, entries]

14 ledger entries: by severity high 3, low 11; by status fixed-before-release 14.

DefectSeverityStatusFound byFixed in
RSD-miniflux-bb2f1fb731
Database handbook: Following the example (LISTEN_ADDR=0.0.0.0:9000 with -p 9000:8080) leaves the service unreachable and the health check failing; the sentence also says the 8080 mapping keeps the health check… [defects, defects #286418]		highfixed-before-releaseheld review (review model)—
RSD-miniflux-6fe8fbc1a1
Admin handbook: Restore procedure as written creates the database owned by postgres and restores as miniflux; with a non-superuser miniflux role on PostgreSQL 15+ the restore fails with permission denied for schema… [defects, defects #286419]		highfixed-before-releaseheld review (review model)—
RSD-miniflux-1cffb9df25
Database handbook: Step does not say who owns the new database; if the restoring role is not the owner or a superuser, the restore fails on PostgreSQL 15+. [defects, defects #286420]		highfixed-before-releaseheld review (review model)—
RSD-miniflux-ccb2b22091
Database handbook: 'Start or restart' after changing DATABASE_URL does not apply the change (env is fixed at create); contradicts admin line 662 and DB line 443. [defects, defects #286421]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-c7e358fe40
Admin handbook: 'start or restart' is wrong for an env-file change, and the following docker run fails on an existing container name. [defects, defects #286422]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-666ba2a4d6
Admin handbook: States -version prints 2.3.4; the image prints 2.3.5. [defects, defects #286423]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-ba60d80df1
Admin handbook: Says to keep `-p 8080:8080` so the health check succeeds; the probe runs inside the container and is unaffected by -p; contradicts line 115. [defects, defects #286424]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-d4e1cb39ed
Database handbook: Primary restore command does not fit the backup procedure the handbook gives and contradicts line 474. [defects, defects #286425]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-5458b43357
Admin handbook: Unsupported version claim that conflicts with the DB handbook. [defects, defects #286426]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-3331ca1e27
Release notes: Refers to data volumes the image does not have (the same class as the prior-round finding). [defects, defects #286427]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-b067550a32
Admin handbook: The sentence says the API never returns anything but JSON; GET /v1/export returns XML. [defects, defects #286755]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-dec558e6c9
Database handbook: Same claim as the admin handbook: /v1/export is not JSON. [defects, defects #286756]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-0e8b2c1e4e
Database handbook: The restore command targets the same placeholder name as the backup, not the new database created in step 1. [defects, defects #286757]		lowfixed-before-releaseheld review (review model)—
RSD-miniflux-683534f334
Admin handbook: Tells the customer to restart, which is unnecessary and contradicts the preceding paragraph. [defects, defects #286758]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:46d8b08d0582b9a8b93001232f81eb63e32e42eb2a466fed1c00c1bb5ed69677 · published digest sha256:46d8b08d0582b9a8b93001232f81eb63e32e42eb2a466fed1c00c1bb5ed69677 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 72) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T17:20:23Z · failing Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T17:20:13Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3858788561 · transparency-log entry · integrated 2026-11-13T17:22:45Z) [ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:42c33e19d9b400bf2029996037db52d861a0262f3cdbcbed6604596d1216dc6a · state attached · log index 3858789339 · transparency-log entry
    • kind sbom · digest sha256:42c33e19d9b400bf2029996037db52d861a0262f3cdbcbed6604596d1216dc6a · state attached · log index 3858790595 · transparency-log entry
    • kind vsa · digest sha256:42c33e19d9b400bf2029996037db52d861a0262f3cdbcbed6604596d1216dc6a · state attached · log index 3858792924 · transparency-log entry
    • kind provenance · digest sha256:46d8b08d0582b9a8b93001232f81eb63e32e42eb2a466fed1c00c1bb5ed69677 · state attached · log index 3858795329 · transparency-log entry
    • kind sbom · digest sha256:46d8b08d0582b9a8b93001232f81eb63e32e42eb2a466fed1c00c1bb5ed69677 · state attached · log index 3858797379 · transparency-log entry
    • kind vsa · digest sha256:46d8b08d0582b9a8b93001232f81eb63e32e42eb2a466fed1c00c1bb5ed69677 · state attached · log index 3858798734 · transparency-log entry
    (at 2026-11-13T17:22:45Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/miniflux/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-13T16:33:52Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:46d8b08d0582b9a8b93001232f81eb63e32e42eb2a466fed1c00c1bb5ed69677 [clean-room rebuild ledger, runs[847]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-13T16:19:35Z [stage_runs, stage_runs chain 1089 stage publish_image]
  • Archive manifests written2026-11-13T17:21:40Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 57 · probed 2026-11-13T16:17:08Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-13T17:24:19Z generated: by KitForge release/build_trail.py · generator commit 1f57518c1e119546b8c0a074f3e484d7bf2f3b33
  • 2026-11-13T17:25:45Z publication: promoted at 2026-11-13T17:25:03Z · promoted digest sha256:42c33e19d9b400bf2029996037db52d861a0262f3cdbcbed6604596d1216dc6a · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 558 · checklist status complete · checklist at 2026-11-13T17:25:45Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/miniflux/2.3.5-CE-ubuntu24.04-r3/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/miniflux/2.3.5-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.rebuild.jsonbeside the archive (prodasset /data/production/miniflux/2.3.5-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-miniflux-2.3.5-CE-ubuntu24.04-r3.rebuild.json.sigstorebeside the archive (prodasset /data/production/miniflux/2.3.5-CE-ubuntu24.04-r3/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/miniflux/2.3.5-CE-ubuntu24.04-r3/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)764
chainssadb, ReadyStack's engine database (not published)1089
defectssadb, ReadyStack's engine database (not published)miniflux 2.3.5-CE-ubuntu24.04-r3
drive_runssadb, ReadyStack's engine database (not published)chain 1089
held_roundssadb, ReadyStack's engine database (not published)chain 1089
lesson_recallssadb, ReadyStack's engine database (not published)chain 1089
micro_step_runssadb, ReadyStack's engine database (not published)chain 1089
release_imagessadb, ReadyStack's engine database (not published)miniflux 2.3.5-CE-ubuntu24.04-r3
stage_eventssadb, ReadyStack's engine database (not published)chain 1089
stage_runssadb, ReadyStack's engine database (not published)chain 1089
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—