Multus CNI v4.3.2-CE-ubuntu24.04-r1 build trail
How ReadyStack built readystack/multuscni:v4.3.2-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/multuscni:v4.3.2-CE-ubuntu24.04-r1 - Index digestsha256:f1f72c27748bae8c5b0e7ac74831255df2bd01f96db506e22d857004a16e004d
- linux/amd64 digestsha256:4f83336538e07ecb26828be35bc7cbd644c3f8d6ca539eaa11ff5ebcb018fc6f
- Archive
ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.tar.gz - Archive SHA-256 nowb6c808f1790ea9a35167b4a46de3912a39f50652a84b9bccd0f1128b4d9118dc
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-08T15:12:31Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductMultus CNI (multuscni) [MANIFEST.json]
- Release tagv4.3.2-CE-ubuntu24.04-r1 [MANIFEST.json]
- Imagereadystack/multuscni:v4.3.2-CE-ubuntu24.04-r1 [MANIFEST.json]
- Image index digestsha256:f1f72c27748bae8c5b0e7ac74831255df2bd01f96db506e22d857004a16e004d [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:4f83336538e07ecb26828be35bc7cbd644c3f8d6ca539eaa11ff5ebcb018fc6f [ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.tar.gz (bytes 458623777) [MANIFEST.json]
- Archive sha256 at publishb6c808f1790ea9a35167b4a46de3912a39f50652a84b9bccd0f1128b4d9118dc [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/k8snetworkplumbingwg/multus-cni [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv4.3.2 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit1d81062afcb32eb7290fa28bcbc482c3d0c5cae9 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashe0f3ab4e4ec869c7bcc00c31d2acf5a075aee8ef7e25ee5783bc99b188105722 (files 159) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:f89cbdffdeed7cc30347b690c25a5995fce19ccffdebc04496354f3a79856d0b [ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1792566118 (utc 2026-10-21T07:01:58Z) [ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.rebuild.json, engine]
- Engine commit(s)
- commit 6a0c6c5f7eda9bf939476cbe90b2b4c99cba667b · dirty yes · first drive 3801
- commit 21e2c6702a4d838f43dd7fa67a5efb86680ec1df · dirty yes · first drive 3819
- commit 678cbcb0bbd61a6d885eab3d9776ddcdf7ce640d · dirty yes · first drive 3824
Why this release exists
Fully recorded- Chain885 (created 2026-11-08T12:37:03Z · trigger customer_request · upstream version v4.3.2) [chains, chains #885]
- Requestbuild request #566 (rebuild) (requested at 2026-11-08T07:25:20Z · requested by kitforge-agent · version v4.3.1) [build_requests, build_requests #566]
- Reasonrerelease agenda REVISION -> v4.3.1-CE-ubuntu24.04-r2 (decay loop, IMP-08) [build_requests, build_requests #566 request_reason]
- Supersedesreadystack/multuscni:v4.3.1-CE-ubuntu24.04-r1 (chain 785) [chains, chains #785]
The path through the harness
Fully recorded1 chain · 3 drives · 18 stages · 2 rewinds
Chain 885 release · ready_to_ship
Created 2026-11-08T12:37:03Z, upstream v4.3.2, build request 566 [chains, chains #885]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 3801 | 2026-11-08T12:37:23Z | 22.8 | build host 3 withhold-publish | stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3801] |
| 3819 | 2026-11-08T14:19:00Z | 28.1 | build host 3 withhold-publish | ready_to_ship at package_archive; 18 ticks [drive_runs, drive_runs #3819] |
| 3824 | 2026-11-08T15:07:43Z | — | build host 3 publish-held | not recorded [drive_runs, drive_runs #3824] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-08T12:37:34Z | 2026-11-08T12:37:35Z | 1 | 4
|
order_json 952d993f9d0d… |
acquire |
2026-11-08T12:37:38Z | 2026-11-08T14:19:17Z | 2 | 12
|
source_tree 7fad03a5829b…license_file c6596eb7be85…custody_inputs 7405bcbec249…source_tree_hash df6f287725ca…source_file_manifest 57cf842d4ae2… |
plan |
2026-11-08T12:38:15Z | 2026-11-08T14:19:21Z | 2 | 10
|
recon_report b9e88f026927…input_pin_plan 8ece0153c4fc…toolchain_lock d3458a822f9e… |
assemble_kit |
2026-11-08T12:44:16Z | 2026-11-08T14:24:31Z | 2 | 27
|
dockerfile a4da406051c0…build_recipe 06e87a6b9b85…system_pinning aa8db05a9a8a…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health 974e783d7fec…verify_offline_sh 3e8184ea230c…base_image_digests 4b83b418bfea…dockerfile_offline a4da406051c0…first_build_digest 8dac0abcc21f… |
remediate |
2026-11-08T12:45:08Z | 2026-11-08T14:24:36Z | 2 | 8
|
vendored_apt e3b0c44298fc…remediation_log ba0f2b151890…security_report 09caf369dd63… |
build_kit |
2026-11-08T12:57:04Z | 2026-11-08T14:35:46Z | 2 | 9
|
cosign_stamp bf1ef6634727…locked_digest cabc501e1093…freeze_manifest 5a6c90316eaf…offline_rebuild_transcript 5753cf1ec730… |
verdict |
2026-11-08T12:58:20Z | 2026-11-08T14:36:55Z | 2 | 8
|
scout_verdict 5c2ead0d5fa8… |
publish_image |
2026-11-08T12:59:08Z | 2026-11-08T14:37:39Z | 2 | 7
|
hub_readme fb3e23b3742c…promotion_record f3f0cf928a65… |
boot_instance |
2026-11-08T12:59:12Z | 2026-11-08T14:37:43Z | 2 | 3
|
instance_handle f8681121cbe4… |
sbom |
2026-11-08T12:59:33Z | 2026-11-08T14:38:04Z | 2 | 5
|
sbom_md f36d7349c783…sbom_json eaeefca1f28e… |
schema_discovery |
2026-11-08T12:59:37Z | 2026-11-08T14:38:08Z | 2 | 7
|
schema_hash 70067650c662…dependency_tree 983147341fa9…table_classification 67a43e6532b9… |
admin_handbook |
2026-11-08T12:59:40Z | 2026-11-08T14:38:11Z | 2 | 7
|
api_map 42d7b7e5dc02…admin_handbook 52e0abd4b183… |
db_handbook |
2026-11-08T12:59:43Z | 2026-11-08T14:38:14Z | 2 | 8
|
db_handbook b7a9d7338bc6…seed_isolation a3505816c32f… |
seed_data |
2026-11-08T12:59:47Z | 2026-11-08T14:38:17Z | 2 | 6
|
seed_data_sql 1d9ae64332cb…seed_cases_json 31feab0f93c3… |
seed_validate |
2026-11-08T12:59:50Z | 2026-11-08T14:38:20Z | 2 | 3
|
seed_data_contract c1ffef37fb99… |
usecase_validate |
2026-11-08T12:59:54Z | 2026-11-08T14:38:23Z | 2 | 10
|
failed_tests 30cfa6bdfb6a…passed_tests 918208c0fbb0…test_results 5eaeb6dae9b4…usecase_contract 027017e56399… |
finalize_docs |
2026-11-08T12:59:58Z | 2026-11-08T14:38:28Z | 2 | 9
|
defects_json 87581c70844d…release_notes ee3b0f928640…api_integration_guide 7aa72716e600… |
package_archive invalidated 2026-11-08T15:07:19Z |
2026-11-08T13:00:13Z | 2026-11-08T14:47:03Z | 2 | 34 (final gate PASS)
|
sale_tar 7308d2cbb0aa…checksums 9b627208103c…verify_md 9ae05b5a00e3…rebuild_md 15f9c60508e5…manifest_txt aed135f1b4e5…actions_jsonl 4b35d0374767…provenance_md e658e2c2f5da…assetchain_log_md e9eccaec0c0f…assetchain_log_json 772724d55e71… |
[stage_runs]
Rewinds
- 2026-11-08T14:19:03Z:
package_archivetoacquireon source_changed (source changed: the acquired source is v4.3.1 (commit d61706810cc8) but the strategy builds v4.3.2: acquire runs again so the source tree, its hash, the custody record and the acquisition copy describe what is built) [stage_events, stage_events #26525] - 2026-11-08T15:07:19Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26605]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-08T14:47:03Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 13419 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 18962 | L-A08, L-038, L-036, L-034, L-032 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.28 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-08T14:48:25Z | 0 | 0 | 1 | clean to publish [held_rounds, held_rounds #1520] | $0.28 | 3 rounds, $40.00 | 7308d2cbb0aa… |
Defects
Fully recorded- Ledger entries1 [defects, defects where product_slug=multuscni and this tag or chain]
- Disclosed in the archive1 [docs/defects/defects.json, entries]
1 ledger entry: by severity low 1; by status open 1.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-multuscni-a5109c973eAdmin handbook: Parenthetical names the v4.3.1 tag as the name images.tsv gives 'it' (this v4.3.2 image). [defects, defects #178945] | low | open | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:4f83336538e07ecb26828be35bc7cbd644c3f8d6ca539eaa11ff5ebcb018fc6f · published digest sha256:4f83336538e07ecb26828be35bc7cbd644c3f8d6ca539eaa11ff5ebcb018fc6f · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 313) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T15:08:13Z · failing Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T15:07:54Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3756118712 · transparency-log entry
- log index 3756119505 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3756446068 · transparency-log entry · integrated 2026-11-08T15:11:25Z) [ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:f1f72c27748bae8c5b0e7ac74831255df2bd01f96db506e22d857004a16e004d · state attached · log index 3756446460 · transparency-log entry
- kind sbom · digest sha256:f1f72c27748bae8c5b0e7ac74831255df2bd01f96db506e22d857004a16e004d · state attached · log index 3756446790 · transparency-log entry
- kind vsa · digest sha256:f1f72c27748bae8c5b0e7ac74831255df2bd01f96db506e22d857004a16e004d · state attached · log index 3756447112 · transparency-log entry
- kind provenance · digest sha256:4f83336538e07ecb26828be35bc7cbd644c3f8d6ca539eaa11ff5ebcb018fc6f · state attached · log index 3756447404 · transparency-log entry
- kind sbom · digest sha256:4f83336538e07ecb26828be35bc7cbd644c3f8d6ca539eaa11ff5ebcb018fc6f · state attached · log index 3756447494 · transparency-log entry
- kind vsa · digest sha256:4f83336538e07ecb26828be35bc7cbd644c3f8d6ca539eaa11ff5ebcb018fc6f · state attached · log index 3756447678 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/multuscni/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-08T14:48:29Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:4f83336538e07ecb26828be35bc7cbd644c3f8d6ca539eaa11ff5ebcb018fc6f [clean-room rebuild ledger, runs[656]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-08T14:37:39Z [stage_runs, stage_runs chain 885 stage publish_image]
- Archive manifests written2026-11-08T15:09:32Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 68 · probed 2026-11-08T14:30:15Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-08T15:12:31Z generated: by KitForge release/build_trail.py · generator commit fb3d89dbdf1a4d4d5e6b01f0cfad0b5ef4a697f2
- 2026-11-08T15:13:57Z publication: promoted at 2026-11-08T15:13:02Z · promoted digest sha256:f1f72c27748bae8c5b0e7ac74831255df2bd01f96db506e22d857004a16e004d · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 378 · checklist status complete · checklist at 2026-11-08T15:13:57Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/multuscni/v4.3.2-CE-ubuntu24.04-r1/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/multuscni/v4.3.2-CE-ubuntu24.04-r1/), as staged for publishing | — |
ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.rebuild.json | beside the archive (prodasset /data/production/multuscni/v4.3.2-CE-ubuntu24.04-r1/), as staged for publishing | — |
ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r1.rebuild.json.sigstore | beside the archive (prodasset /data/production/multuscni/v4.3.2-CE-ubuntu24.04-r1/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/multuscni/v4.3.2-CE-ubuntu24.04-r1/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 566 |
chains | sadb, ReadyStack's engine database (not published) | 885 |
defects | sadb, ReadyStack's engine database (not published) | multuscni v4.3.2-CE-ubuntu24.04-r1 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 885 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 885 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 885 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 885 |
release_images | sadb, ReadyStack's engine database (not published) | multuscni v4.3.2-CE-ubuntu24.04-r1 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 885 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 885 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |