MinIO RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10 build trail
How ReadyStack built readystack/minio:RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/minio:RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10 - Index digestsha256:1a7336d989e14a5c7fd4be67c96e4eb4c5756821ba44f33c507ef325bbc6ae66
- linux/amd64 digestsha256:b5a072d9c16b2060f4fc6bd2afed1632769df1f5e179992af2525515e0d3dde4
- Archive
ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.tar.gz - Archive SHA-256 now11f42d89761e91172ebb9707ab9ac7f2223751045abed4dd1c4ed5d2e30a3f31
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-11T07:36:27Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.trail.json.sigstore ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductMinIO (minio) [MANIFEST.json]
- Release tagRELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10 [MANIFEST.json]
- Imagereadystack/minio:RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10 [MANIFEST.json]
- Image index digestsha256:1a7336d989e14a5c7fd4be67c96e4eb4c5756821ba44f33c507ef325bbc6ae66 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:b5a072d9c16b2060f4fc6bd2afed1632769df1f5e179992af2525515e0d3dde4 [ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.tar.gz (bytes 520096515) [MANIFEST.json]
- Archive sha256 at publish81bf9382d2e1bb39a80daa06ee3c7e5ce5cb9d22ae20e4cf9bff0aaafb04e655 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/minio/minio [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refRELEASE.2025-10-15T17-29-55Z [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit9e49d5e7a648f00e26f2246f4dc28e6b07f8c84a [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash2349200805cf08e1931ad35d051a378bf2839a098d6e0616ec72c6e85c0e6fb2 (files 1363) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:6e636e97e27b83916c12b971f93f4cfd28b4bdba8121bd983d4ac79eaeb35e97 [ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794380457 (utc 2026-11-11T07:00:57Z) [ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.26.11-bookworm@sha256:dc40a13b61304647ed7e5d581d246b86413dfc29d63c6d018310feb93cd98fc0 · platform digest sha256:79ecd0a7157c7a4cf3b281ced8465350591bf54fedab540e75374a003e1fde7e
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.rebuild.json, engine]
- Engine commit(s)
- commit 8ff362fa42dca5575ef92fdd7601d43149a85f02 · dirty yes · first drive 4266
- commit 8da9c1234554adcb34433e0e7148a38e010242cb · dirty yes · first drive 4270
Why this release exists
Fully recorded- Chain963 (created 2026-11-11T07:02:49Z · trigger customer_request · upstream version RELEASE.2025-10-15T17-29-55Z) [chains, chains #963]
- Requestbuild request #642 (rebuild) (requested at 2026-11-11T07:00:59Z · requested by kitforge-agent · version RELEASE.2025-10-15T17-29-55Z) [build_requests, build_requests #642]
- Reasonrerelease agenda REVISION -> RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10 (decay loop, IMP-08) [build_requests, build_requests #642 request_reason]
- Supersedesreadystack/minio:RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r9 (chain 942) [chains, chains #942]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 963 release · ready_to_ship
Created 2026-11-11T07:02:49Z, upstream RELEASE.2025-10-15T17-29-55Z, build request 642 [chains, chains #963]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4266 | 2026-11-11T07:03:22Z | 21.1 | build host 1 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4266] |
| 4270 | 2026-11-11T07:31:32Z | — | build host 1 publish-held | not recorded [drive_runs, drive_runs #4270] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-11T07:03:32Z | 2026-11-11T07:03:33Z | 1 | 4
|
order_json 2a1139e33014… |
acquire |
2026-11-11T07:03:39Z | 2026-11-11T07:03:40Z | 1 | 12
|
source_tree 50b48a4c2837…license_file 0d96a4ff68ad…custody_inputs 4f958ebdf1da…source_tree_hash 2fa8885faebb…source_file_manifest 8753829ade03… |
plan |
2026-11-11T07:04:33Z | 2026-11-11T07:04:34Z | 1 | 10
|
recon_report fd34051e9146…input_pin_plan ca7e9194d075…toolchain_lock fd41057f2af6… |
assemble_kit |
2026-11-11T07:08:39Z | 2026-11-11T07:08:40Z | 1 | 27
|
dockerfile 46c36a308f29…build_recipe d2146042c083…system_pinning fa091140511e…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health a15892044c04…verify_offline_sh 3e8184ea230c…base_image_digests 478b5ccf1952…dockerfile_offline 46c36a308f29…first_build_digest 713e43666f78… |
remediate |
2026-11-11T07:09:48Z | 2026-11-11T07:09:49Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log bcdb6cedc5f9…security_report 045843312958… |
build_kit |
2026-11-11T07:15:18Z | 2026-11-11T07:15:18Z | 1 | 9
|
cosign_stamp 7e3238977576…locked_digest a7cc6735665a…freeze_manifest 35890f3ed067…offline_rebuild_transcript 7b340c67df84… |
verdict |
2026-11-11T07:16:08Z | 2026-11-11T07:16:09Z | 1 | 8
|
scout_verdict a00910d8f21d… |
publish_image |
2026-11-11T07:16:47Z | 2026-11-11T07:16:48Z | 1 | 7
|
hub_readme 284f98178003…promotion_record ea02e9b098f1… |
boot_instance |
2026-11-11T07:16:53Z | 2026-11-11T07:16:57Z | 2 | 3
|
instance_handle 08a401aa67f4… |
sbom |
2026-11-11T07:17:09Z | 2026-11-11T07:17:10Z | 1 | 5
|
sbom_md 755f199615ba…sbom_json cba19b2b4309… |
schema_discovery |
2026-11-11T07:17:12Z | 2026-11-11T07:17:13Z | 1 | 7
|
schema_hash 403a29f8b351…dependency_tree ac94b5d7b11d…table_classification ecf77f57880e… |
admin_handbook |
2026-11-11T07:17:22Z | 2026-11-11T07:17:23Z | 1 | 7
|
api_map 237c098db4a5…admin_handbook 942b6226041f… |
db_handbook |
2026-11-11T07:17:34Z | 2026-11-11T07:17:35Z | 1 | 8
|
db_handbook 3447d2b9a9ac…seed_isolation 2576a27b393e… |
seed_data |
2026-11-11T07:17:43Z | 2026-11-11T07:17:44Z | 1 | 6
|
seed_data_sql 630ddd7d22a2…seed_cases_json 4c952ac88b9e… |
seed_validate |
2026-11-11T07:17:47Z | 2026-11-11T07:17:48Z | 1 | 3
|
seed_data_contract 1051f9fe88f0… |
usecase_validate |
2026-11-11T07:18:12Z | 2026-11-11T07:18:12Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 34bd5746841d…test_results 96026f2d5d2b…usecase_contract 6abdc0056787… |
finalize_docs |
2026-11-11T07:18:19Z | 2026-11-11T07:18:19Z | 1 | 9
|
defects_json db7c98107025…release_notes b307ed7eebff…api_integration_guide 6c5b604fac0b… |
package_archive invalidated 2026-11-11T07:31:01Z |
2026-11-11T07:24:23Z | 2026-11-11T07:24:25Z | 1 | 35 (final gate PASS)
|
sale_tar c90eb4e213c6…checksums 3eb59dcc74e3…verify_md 677f9aa163ae…rebuild_md 0117138e5233…manifest_txt 8c7340c56c93…actions_jsonl 63520fbd939e…provenance_md fc426e395c8d…assetchain_log_md e9eccaec0c0f…assetchain_log_json 6a0db51501d4… |
[stage_runs]
Rewinds
- 2026-11-11T07:31:01Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #31346]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-11T07:24:25Z.
5 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 14232 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 17981 | L-A08, L-038, L-036, L-034, L-032 |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 2068 | — |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.31 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-11T07:24:54Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1739] | $0.31 | 3 rounds, $40.00 | c90eb4e213c6… |
Defects
Fully recorded- Ledger entries0 [defects, defects where product_slug=minio and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
0 ledger entries.
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:b5a072d9c16b2060f4fc6bd2afed1632769df1f5e179992af2525515e0d3dde4 · published digest sha256:b5a072d9c16b2060f4fc6bd2afed1632769df1f5e179992af2525515e0d3dde4 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 142) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-11T07:31:57Z · failing Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-11T07:31:45Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3805167150 · transparency-log entry
- log index 3805167924 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3805459467 · transparency-log entry · integrated 2026-11-11T07:35:11Z) [ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:1a7336d989e14a5c7fd4be67c96e4eb4c5756821ba44f33c507ef325bbc6ae66 · state attached · log index 3805460250 · transparency-log entry
- kind sbom · digest sha256:1a7336d989e14a5c7fd4be67c96e4eb4c5756821ba44f33c507ef325bbc6ae66 · state attached · log index 3805460658 · transparency-log entry
- kind vsa · digest sha256:1a7336d989e14a5c7fd4be67c96e4eb4c5756821ba44f33c507ef325bbc6ae66 · state attached · log index 3805461017 · transparency-log entry
- kind provenance · digest sha256:b5a072d9c16b2060f4fc6bd2afed1632769df1f5e179992af2525515e0d3dde4 · state attached · log index 3805462027 · transparency-log entry
- kind sbom · digest sha256:b5a072d9c16b2060f4fc6bd2afed1632769df1f5e179992af2525515e0d3dde4 · state attached · log index 3805462762 · transparency-log entry
- kind vsa · digest sha256:b5a072d9c16b2060f4fc6bd2afed1632769df1f5e179992af2525515e0d3dde4 · state attached · log index 3805464970 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/minio/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-11T07:24:58Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:b5a072d9c16b2060f4fc6bd2afed1632769df1f5e179992af2525515e0d3dde4 [clean-room rebuild ledger, runs[744]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-11T07:16:48Z [stage_runs, stage_runs chain 963 stage publish_image]
- Archive manifests written2026-11-11T07:33:36Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 743 · probed 2026-11-11T07:12:36Z · source build_kit) [release_images, isa_level_hard]
History
3 events- 2026-11-11T07:36:27Z generated: by KitForge release/build_trail.py · generator commit 8da9c1234554adcb34433e0e7148a38e010242cb
- 2026-11-11T07:37:53Z publication: promoted at 2026-11-11T07:37:02Z · promoted digest sha256:1a7336d989e14a5c7fd4be67c96e4eb4c5756821ba44f33c507ef325bbc6ae66 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 468 · checklist status complete · checklist at 2026-11-11T07:37:53Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
- 2026-11-12T02:48:04Z repack: previous sha256 81bf9382d2e1bb39a80daa06ee3c7e5ce5cb9d22ae20e4cf9bff0aaafb04e655 · sha256 11f42d89761e91172ebb9707ab9ac7f2223751045abed4dd1c4ed5d2e30a3f31 · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); README.md and FILE_MODES.tsv at the archive root (release/kit_unpack.py), BUILD_OFFLINE.sh putting back the packed file modes, REBUILD.md unpacking with -p and keeping the key and signature outside the kit, and the verifier naming what differs; not image inputs; image and every build input unchanged · label kitfix · replaced BUILD_OFFLINE.sh, docs/REBUILD.md, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, docs/rebuild-bundle/rebuild_bundle.py · added FILE_MODES.tsv, README.md · record MANIFEST.json repack_history
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/minio/RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/minio/RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10/), as staged for publishing | — |
ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.rebuild.json | beside the archive (prodasset /data/production/minio/RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10/), as staged for publishing | — |
ReadyStack-minio-RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10.rebuild.json.sigstore | beside the archive (prodasset /data/production/minio/RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/minio/RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 642 |
chains | sadb, ReadyStack's engine database (not published) | 963 |
defects | sadb, ReadyStack's engine database (not published) | minio RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 963 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 963 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 963 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 963 |
release_images | sadb, ReadyStack's engine database (not published) | minio RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r10 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 963 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 963 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |