Moodle v5.3.0-CE-ubuntu24.04-r5 build trail
How ReadyStack built readystack/moodle:v5.3.0-CE-ubuntu24.04-r5 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/moodle:v5.3.0-CE-ubuntu24.04-r5 - Index digestsha256:bcde713ae9a865e5c3972aefc5f4f0cea2ad942417c1e35f57b8aa1d5a32c047
- linux/amd64 digestsha256:f70508b9e71ea05a65d01cc8846dc68c99ff9040197fadd061f3b094e8de2ad9
- Archive
ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.tar.gz - Archive SHA-256 now65225dc91b3dee6f8ef56a07eac388955c4472cf00bc4669f8338fcb3d89e3a8
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-07T08:24:11Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.trail.json.sigstore ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductMoodle (moodle) [MANIFEST.json]
- Release tagv5.3.0-CE-ubuntu24.04-r5 [MANIFEST.json]
- Imagereadystack/moodle:v5.3.0-CE-ubuntu24.04-r5 [MANIFEST.json]
- Image index digestsha256:bcde713ae9a865e5c3972aefc5f4f0cea2ad942417c1e35f57b8aa1d5a32c047 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:f70508b9e71ea05a65d01cc8846dc68c99ff9040197fadd061f3b094e8de2ad9 [ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.tar.gz (bytes 385601524) [MANIFEST.json]
- Archive sha256 at publish65225dc91b3dee6f8ef56a07eac388955c4472cf00bc4669f8338fcb3d89e3a8 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/moodle/moodle [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv5.3.0 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit42622298fe06f9626d988d60b2bf589bd8f850e8 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash096a48537238e07dd94531ff70477bcaca97e3f58f53ae8baf8ad50c8a5c708f (files 67589) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:89eb038422918667f17899af78abda3caefda1557b7fbc114d0df9f08a71755c [ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1791020085 (utc 2026-10-03T09:34:45Z) [ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.rebuild.json, engine]
- Engine commit(s)
- commit a40e4d9d4d44a5f8647c6bf01ffdee4ed8801afd · dirty yes · first drive 3579
- commit 2488ac8956ee2098ba13f3ff11fe53d8cbec9ffb · dirty yes · first drive 3592
- commit 0b84905088b3228fdf50e0647d1f5a7d7d60df02 · dirty yes · first drive 3607
- commit bd381ae76aa7f67e8731266b0aeeeea5815cd5cc · dirty yes · first drive 3614
Why this release exists
Fully recorded- Chain848 (created 2026-11-07T05:17:36Z · trigger customer_request · upstream version v5.3.0) [chains, chains #848]
- Requestbuild request #514 (rebuild) (requested at 2026-11-07T02:01:26Z · requested by kitforge-agent · version v5.3.0) [build_requests, build_requests #514]
- Reasonrerelease agenda REVISION -> v5.3.0-CE-ubuntu24.04-r5 (decay loop, IMP-08) [build_requests, build_requests #514 request_reason]
- Supersedesreadystack/moodle:v5.3.0-CE-ubuntu24.04-r4 (chain 668) [chains, chains #668]
The path through the harness
Fully recorded1 chain · 5 drives · 18 stages · 2 rewinds
Chain 848 release · ready_to_ship
Created 2026-11-07T05:17:36Z, upstream v5.3.0, build request 514 [chains, chains #848]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 3579 | 2026-11-07T05:18:22Z | 39.9 | build host 2 withhold-publish | infra_hub_rate_limit at package_archive; 18 ticks [drive_runs, drive_runs #3579] |
| 3592 | 2026-11-07T06:17:34Z | 11.2 | build host 2 withhold-publish | ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3592] |
| 3607 | 2026-11-07T07:24:12Z | 12 | build host 2 withhold-publish | infra_hub_rate_limit at package_archive; 1 tick [drive_runs, drive_runs #3607] |
| 3614 | 2026-11-07T07:56:04Z | 10.8 | build host 2 withhold-publish | ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3614] |
| 3618 | 2026-11-07T08:09:48Z | — | build host 2 publish-held | not recorded [drive_runs, drive_runs #3618] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-07T05:18:32Z | 2026-11-07T05:18:33Z | 1 | 4
|
order_json 97c12d04619d… |
acquire |
2026-11-07T05:18:52Z | 2026-11-07T05:18:58Z | 1 | 12
|
source_tree 8fad032e5855…license_file 8ceb4b9ee5ad…custody_inputs a40e71e7c531…source_tree_hash 4f285eb6700d…source_file_manifest 85454735b647… |
plan |
2026-11-07T05:19:27Z | 2026-11-07T05:19:28Z | 1 | 10
|
recon_report 7035402bf170…input_pin_plan 6736a72d7b4f…toolchain_lock ac448f14734b… |
assemble_kit |
2026-11-07T05:28:11Z | 2026-11-07T05:28:12Z | 1 | 27
|
dockerfile 49e88ca95c65…build_recipe 528f37de5cae…system_pinning 44667b599064…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health c5240b48d2d8…verify_offline_sh 3e8184ea230c…base_image_digests 633f640a38b5…dockerfile_offline 49e88ca95c65…first_build_digest c0039c82bacf… |
remediate |
2026-11-07T05:28:38Z | 2026-11-07T05:28:38Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log a1d1a3d95420…security_report 5bc0e369c3bf… |
build_kit |
2026-11-07T05:35:23Z | 2026-11-07T05:35:23Z | 1 | 9
|
cosign_stamp 1fd101a6e037…locked_digest 7c3ae1f96b08…freeze_manifest 462348fbcaa4…offline_rebuild_transcript 32107536ceb5… |
verdict |
2026-11-07T05:37:05Z | 2026-11-07T05:37:05Z | 1 | 8
|
scout_verdict 1e313927bde0… |
publish_image |
2026-11-07T05:38:00Z | 2026-11-07T05:38:01Z | 1 | 7
|
hub_readme 28c42a6509c6…promotion_record 7bfeccab9c69… |
boot_instance |
2026-11-07T05:40:47Z | 2026-11-07T05:40:50Z | 2 | 3
|
instance_handle fec3675d3682… |
sbom |
2026-11-07T05:41:15Z | 2026-11-07T05:41:16Z | 1 | 5
|
sbom_md 381be679ea4e…sbom_json d08c32b1499a… |
schema_discovery |
2026-11-07T05:41:18Z | 2026-11-07T05:41:19Z | 1 | 7
|
schema_hash d240e6b200e9…dependency_tree cadfeba7041d…table_classification 6cd367dd6535… |
admin_handbook |
2026-11-07T05:41:26Z | 2026-11-07T05:41:27Z | 1 | 7
|
api_map 7fe8664a8f6c…admin_handbook 6702f81f52ee… |
db_handbook |
2026-11-07T05:41:37Z | 2026-11-07T05:41:38Z | 1 | 8
|
db_handbook 221836c42248…seed_isolation e6116c678b9c… |
seed_data |
2026-11-07T05:41:42Z | 2026-11-07T05:41:43Z | 1 | 6
|
seed_data_sql d62e7a0800a0…seed_cases_json f98a30356045… |
seed_validate |
2026-11-07T05:41:46Z | 2026-11-07T05:41:47Z | 1 | 3
|
seed_data_contract dd80da520409… |
usecase_validate |
2026-11-07T05:42:03Z | 2026-11-07T05:42:04Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests aa4e65507c07…test_results 936034927619…usecase_contract a0a07cd51a10… |
finalize_docs |
2026-11-07T05:42:10Z | 2026-11-07T05:42:10Z | 1 | 9
|
defects_json f1031546440e…release_notes 64edee597d2d…api_integration_guide 85414fceaaba… |
package_archive invalidated 2026-11-07T08:09:24Z |
2026-11-07T06:28:46Z | 2026-11-07T08:06:49Z | 2 | 34 (final gate PASS)
|
sale_tar fe6c8168335b…checksums 9e75362f8618…verify_md 3996a5b8e86c…rebuild_md bd000c9ece3b…manifest_txt db9bb3ad6b33…actions_jsonl e225962d4d38…provenance_md 8f23e66da6ff…assetchain_log_md e9eccaec0c0f…assetchain_log_json 3b11d0a666e9… |
[stage_runs]
Rewinds
- 2026-11-07T06:50:02Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24147] - 2026-11-07T08:09:24Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24276]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-07T08:06:49Z.
5 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 7038 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 7412 | L-A183, L-A15 |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 1632 | L-A59 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
2 rounds, 2 counted, $0.71 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-07T06:29:20Z | 0 | 2 | 0 | findings to repackage [held_rounds, held_rounds #1443] | $0.46 | 3 rounds, $40.00 | cc7998265593… |
| 2 | 2026-11-07T08:07:21Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1449] | $0.25 | 3 rounds, $40.00 | fe6c8168335b… |
Defects
Fully recorded- Ledger entries5 [defects, defects where product_slug=moodle and this tag or chain]
- Disclosed in the archive2 [docs/defects/defects.json, entries]
5 ledger entries: by severity high 2, low 3; by status fixed-before-release 2, fixed-in-release 3.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-moodle-97dc74d7d7Admin handbook: Stale superseded release tag r4 in the r5 handbook [defects, defects #164782] | high | fixed-before-release | held review (review model) | — |
RSD-moodle-035f7fc160Admin handbook: Stale superseded release tag r4 in the r5 handbook [defects, defects #164783] | high | fixed-before-release | held review (review model) | — |
RSD-moodle-e26edc4006Database handbook: False sentence that contradicts the surrounding text and the measured behaviour. [defects, defects #166386] | low | fixed-in-release | held review (review model) | v5.3.0-CE-ubuntu24.04-r5 |
RSD-moodle-24dff41982Database handbook: Cross-section contradiction about whether DB_PASS stays in moodle.env. [defects, defects #166387] | low | fixed-in-release | held review (review model) | v5.3.0-CE-ubuntu24.04-r5 |
RSD-moodle-ff6873f901API guide: 'inline variables' implies -e passing, which the guide forbids elsewhere. [defects, defects #166388] | low | fixed-in-release | held review (review model) | v5.3.0-CE-ubuntu24.04-r5 |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:f70508b9e71ea05a65d01cc8846dc68c99ff9040197fadd061f3b094e8de2ad9 · published digest sha256:f70508b9e71ea05a65d01cc8846dc68c99ff9040197fadd061f3b094e8de2ad9 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 152) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-07T08:10:43Z · failing Docker Scout counts 134 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-07T08:09:58Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3730496194 · transparency-log entry
- log index 3730497432 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3733420848 · transparency-log entry · integrated 2026-11-07T08:22:20Z) [ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:bcde713ae9a865e5c3972aefc5f4f0cea2ad942417c1e35f57b8aa1d5a32c047 · state attached · log index 3733432100 · transparency-log entry
- kind sbom · digest sha256:bcde713ae9a865e5c3972aefc5f4f0cea2ad942417c1e35f57b8aa1d5a32c047 · state attached · log index 3733434807 · transparency-log entry
- kind vsa · digest sha256:bcde713ae9a865e5c3972aefc5f4f0cea2ad942417c1e35f57b8aa1d5a32c047 · state attached · log index 3733438304 · transparency-log entry
- kind provenance · digest sha256:f70508b9e71ea05a65d01cc8846dc68c99ff9040197fadd061f3b094e8de2ad9 · state attached · log index 3733442619 · transparency-log entry
- kind sbom · digest sha256:f70508b9e71ea05a65d01cc8846dc68c99ff9040197fadd061f3b094e8de2ad9 · state attached · log index 3733445339 · transparency-log entry
- kind vsa · digest sha256:f70508b9e71ea05a65d01cc8846dc68c99ff9040197fadd061f3b094e8de2ad9 · state attached · log index 3733448029 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/moodle/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-07T06:29:24Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:f70508b9e71ea05a65d01cc8846dc68c99ff9040197fadd061f3b094e8de2ad9 [clean-room rebuild ledger, runs[612]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-07T05:38:01Z [stage_runs, stage_runs chain 848 stage publish_image]
- Archive manifests written2026-11-07T08:18:08Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 1017 · probed 2026-11-07T05:32:37Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-07T08:24:11Z generated: by KitForge release/build_trail.py · generator commit 0185b65902e7de72275f275e796ced5f2061c824
- 2026-11-07T08:26:22Z publication: promoted at 2026-11-07T08:24:41Z · promoted digest sha256:bcde713ae9a865e5c3972aefc5f4f0cea2ad942417c1e35f57b8aa1d5a32c047 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 340 · checklist status complete · checklist at 2026-11-07T08:26:22Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/moodle/v5.3.0-CE-ubuntu24.04-r5/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/moodle/v5.3.0-CE-ubuntu24.04-r5/), as staged for publishing | — |
ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.rebuild.json | beside the archive (prodasset /data/production/moodle/v5.3.0-CE-ubuntu24.04-r5/), as staged for publishing | — |
ReadyStack-moodle-v5.3.0-CE-ubuntu24.04-r5.rebuild.json.sigstore | beside the archive (prodasset /data/production/moodle/v5.3.0-CE-ubuntu24.04-r5/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/moodle/v5.3.0-CE-ubuntu24.04-r5/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 514 |
chains | sadb, ReadyStack's engine database (not published) | 848 |
defects | sadb, ReadyStack's engine database (not published) | moodle v5.3.0-CE-ubuntu24.04-r5 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 848 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 848 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 848 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 848 |
release_images | sadb, ReadyStack's engine database (not published) | moodle v5.3.0-CE-ubuntu24.04-r5 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 848 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 848 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |