Multus CNI v4.3.2-CE-ubuntu24.04-r2 build trail
How ReadyStack built readystack/multuscni:v4.3.2-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/multuscni:v4.3.2-CE-ubuntu24.04-r2 - Index digestsha256:a8b4b9e8d08bf1c814adf4e68799861d8656539103e01db7e09a8134ae419263
- linux/amd64 digestsha256:0907ad4a2ed2028ef4974ba9ee54e1b470ceca10e226a9d6945c408c3bef5331
- Archive
ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.tar.gz - Archive SHA-256 nowc26ba50a327010718e97282e7946aaa5cb509beed5171f08622ed9aced3fd9d9
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-13T10:23:37Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductMultus CNI (multuscni) [MANIFEST.json]
- Release tagv4.3.2-CE-ubuntu24.04-r2 [MANIFEST.json]
- Imagereadystack/multuscni:v4.3.2-CE-ubuntu24.04-r2 [MANIFEST.json]
- Image index digestsha256:a8b4b9e8d08bf1c814adf4e68799861d8656539103e01db7e09a8134ae419263 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:0907ad4a2ed2028ef4974ba9ee54e1b470ceca10e226a9d6945c408c3bef5331 [ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.tar.gz (bytes 458770804) [MANIFEST.json]
- Archive sha256 at publishc26ba50a327010718e97282e7946aaa5cb509beed5171f08622ed9aced3fd9d9 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/k8snetworkplumbingwg/multus-cni [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv4.3.2 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit1d81062afcb32eb7290fa28bcbc482c3d0c5cae9 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashe0f3ab4e4ec869c7bcc00c31d2acf5a075aee8ef7e25ee5783bc99b188105722 (files 159) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:cecd12cf503748359cb277468e5000607a37e269bc8bdf80a4103908353e25a5 [ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794448250 (utc 2026-11-12T01:50:50Z) [ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.26.11-bookworm@sha256:dc40a13b61304647ed7e5d581d246b86413dfc29d63c6d018310feb93cd98fc0 · platform digest sha256:79ecd0a7157c7a4cf3b281ced8465350591bf54fedab540e75374a003e1fde7e
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.rebuild.json, engine]
- Engine commit(s)
- commit 96f3323140891ba62fe76c4b7c36875344807578 · dirty yes · first drive 4538
- commit 53328f4754ecefc18b308504e3b02f89c9062497 · dirty yes · first drive 4551
Why this release exists
Fully recorded- Chain1061 (created 2026-11-13T04:10:46Z · trigger customer_request · upstream version v4.3.2) [chains, chains #1061]
- Requestbuild request #705 (rebuild) (requested at 2026-11-12T01:50:51Z · requested by kitforge-agent · version v4.3.2) [build_requests, build_requests #705]
- Reasonrevision v4.3.2-CE-ubuntu24.04-r2: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #705 request_reason]
- Supersedesreadystack/multuscni:v4.3.2-CE-ubuntu24.04-r1 (chain 885) [chains, chains #885]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1061 release · ready_to_ship
Created 2026-11-13T04:10:46Z, upstream v4.3.2, build request 705 [chains, chains #1061]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4538 | 2026-11-13T04:11:11Z | 30.9 | build host 3 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4538] |
| 4551 | 2026-11-13T10:18:02Z | — | build host 3 publish-held | not recorded [drive_runs, drive_runs #4551] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-13T04:11:21Z | 2026-11-13T04:11:22Z | 1 | 4
|
order_json d05b7f742981… |
acquire |
2026-11-13T04:11:26Z | 2026-11-13T04:11:27Z | 1 | 12
|
source_tree 7fad03a5829b…license_file c6596eb7be85…custody_inputs 7405bcbec249…source_tree_hash df6f287725ca…source_file_manifest 57cf842d4ae2… |
plan |
2026-11-13T04:12:02Z | 2026-11-13T04:12:03Z | 1 | 10
|
recon_report 53705871d9bc…input_pin_plan aac01e3242f6…toolchain_lock 3d4edb1ededa… |
assemble_kit |
2026-11-13T04:17:33Z | 2026-11-13T04:17:34Z | 1 | 27
|
dockerfile a18c0dcd1808…build_recipe d0208111419e…system_pinning aa8db05a9a8a…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health ce98fd09e590…verify_offline_sh 3e8184ea230c…base_image_digests fa8857a07582…dockerfile_offline a18c0dcd1808…first_build_digest 562c79dc7f6f… |
remediate |
2026-11-13T04:18:20Z | 2026-11-13T04:18:21Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 605536a6ba50…security_report e9942b9de1be… |
build_kit |
2026-11-13T04:30:14Z | 2026-11-13T04:30:15Z | 1 | 9
|
cosign_stamp 32168234c04d…locked_digest 88b851e77470…freeze_manifest a89f1b68cc09…offline_rebuild_transcript 611af472e5b7… |
verdict |
2026-11-13T04:31:27Z | 2026-11-13T04:31:28Z | 1 | 8
|
scout_verdict 4903244eead5… |
publish_image |
2026-11-13T04:32:20Z | 2026-11-13T04:32:21Z | 1 | 7
|
hub_readme 12ae80bad16c…promotion_record b24bc5ac2f6e… |
boot_instance |
2026-11-13T04:32:23Z | 2026-11-13T04:32:24Z | 1 | 3
|
instance_handle 48d5f21e0583… |
sbom |
2026-11-13T04:32:45Z | 2026-11-13T04:32:45Z | 1 | 5
|
sbom_md d3dc77a313b0…sbom_json cf34610f5939… |
schema_discovery |
2026-11-13T04:32:48Z | 2026-11-13T04:32:49Z | 1 | 7
|
schema_hash 70067650c662…dependency_tree 983147341fa9…table_classification 67a43e6532b9… |
admin_handbook |
2026-11-13T04:32:51Z | 2026-11-13T04:32:52Z | 1 | 7
|
api_map 42d7b7e5dc02…admin_handbook 009056e8b9be… |
db_handbook |
2026-11-13T04:32:55Z | 2026-11-13T04:32:56Z | 1 | 8
|
db_handbook b7a9d7338bc6…seed_isolation a3505816c32f… |
seed_data |
2026-11-13T04:32:58Z | 2026-11-13T04:32:59Z | 1 | 6
|
seed_data_sql 1d9ae64332cb…seed_cases_json 31feab0f93c3… |
seed_validate |
2026-11-13T04:33:02Z | 2026-11-13T04:33:03Z | 1 | 3
|
seed_data_contract c1ffef37fb99… |
usecase_validate |
2026-11-13T04:33:05Z | 2026-11-13T04:33:06Z | 1 | 10
|
failed_tests 30cfa6bdfb6a…passed_tests 918208c0fbb0…test_results 5eaeb6dae9b4…usecase_contract 027017e56399… |
finalize_docs |
2026-11-13T04:33:10Z | 2026-11-13T04:33:11Z | 1 | 9
|
defects_json 5bf4414f0136…release_notes 9b57d7cdac00…api_integration_guide 7aa72716e600… |
package_archive invalidated 2026-11-13T10:17:28Z |
2026-11-13T04:42:05Z | 2026-11-13T04:42:06Z | 1 | 37 (final gate PASS)
|
sale_tar 9bd1adff7380…checksums 00e73cf734b0…verify_md 53446e05e40c…rebuild_md 38b7c9ac9670…manifest_txt 78da8376f27e…actions_jsonl 234f4e800afd…provenance_md 99169296f8aa…assetchain_log_md e9eccaec0c0f…assetchain_log_json 263aad141c76… |
[stage_runs]
Rewinds
- 2026-11-13T10:17:28Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #35524]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-13T04:42:06Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 13389 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 17431 | L-A08, L-038, L-036, L-034, L-032 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.33 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-13T04:43:18Z | 0 | 0 | 1 | clean to publish [held_rounds, held_rounds #1861] | $0.33 | 3 rounds, $40.00 | 9bd1adff7380… |
Defects
Fully recorded- Ledger entries2 [defects, defects where product_slug=multuscni and this tag or chain]
- Disclosed in the archive2 [docs/defects/defects.json, entries]
2 ledger entries: by severity low 2; by status open 2.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-multuscni-2c91487892Admin handbook: Parenthetical names the v4.3.1 tag as the name images.tsv gives 'it' (this v4.3.2 image). [defects, defects #278586] | low | open | held review (review model) | — |
RSD-multuscni-65339a0bdcAdmin handbook: Handbook states images.tsv gives the r2 tag; the repo bundle's images.tsv lists r1. [defects, defects #278717] | low | open | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:0907ad4a2ed2028ef4974ba9ee54e1b470ceca10e226a9d6945c408c3bef5331 · published digest sha256:0907ad4a2ed2028ef4974ba9ee54e1b470ceca10e226a9d6945c408c3bef5331 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 336) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T10:18:30Z · failing Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T10:18:12Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3846121979 · transparency-log entry
- log index 3846125206 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3851871955 · transparency-log entry · integrated 2026-11-13T10:21:49Z) [ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:a8b4b9e8d08bf1c814adf4e68799861d8656539103e01db7e09a8134ae419263 · state attached · log index 3851875729 · transparency-log entry
- kind sbom · digest sha256:a8b4b9e8d08bf1c814adf4e68799861d8656539103e01db7e09a8134ae419263 · state attached · log index 3851880221 · transparency-log entry
- kind vsa · digest sha256:a8b4b9e8d08bf1c814adf4e68799861d8656539103e01db7e09a8134ae419263 · state attached · log index 3851883450 · transparency-log entry
- kind provenance · digest sha256:0907ad4a2ed2028ef4974ba9ee54e1b470ceca10e226a9d6945c408c3bef5331 · state attached · log index 3851886763 · transparency-log entry
- kind sbom · digest sha256:0907ad4a2ed2028ef4974ba9ee54e1b470ceca10e226a9d6945c408c3bef5331 · state attached · log index 3851889252 · transparency-log entry
- kind vsa · digest sha256:0907ad4a2ed2028ef4974ba9ee54e1b470ceca10e226a9d6945c408c3bef5331 · state attached · log index 3851892243 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/multuscni/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-13T10:01:05Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:0907ad4a2ed2028ef4974ba9ee54e1b470ceca10e226a9d6945c408c3bef5331 [clean-room rebuild ledger, runs[822]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-13T04:32:21Z [stage_runs, stage_runs chain 1061 stage publish_image]
- Archive manifests written2026-11-13T10:19:50Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 68 · probed 2026-11-13T04:24:19Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-13T10:23:37Z generated: by KitForge release/build_trail.py · generator commit 53328f4754ecefc18b308504e3b02f89c9062497
- 2026-11-13T10:25:17Z publication: promoted at 2026-11-13T10:24:21Z · promoted digest sha256:a8b4b9e8d08bf1c814adf4e68799861d8656539103e01db7e09a8134ae419263 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 535 · checklist status complete · checklist at 2026-11-13T10:25:17Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/multuscni/v4.3.2-CE-ubuntu24.04-r2/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/multuscni/v4.3.2-CE-ubuntu24.04-r2/), as staged for publishing | — |
ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.rebuild.json | beside the archive (prodasset /data/production/multuscni/v4.3.2-CE-ubuntu24.04-r2/), as staged for publishing | — |
ReadyStack-multuscni-v4.3.2-CE-ubuntu24.04-r2.rebuild.json.sigstore | beside the archive (prodasset /data/production/multuscni/v4.3.2-CE-ubuntu24.04-r2/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/multuscni/v4.3.2-CE-ubuntu24.04-r2/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 705 |
chains | sadb, ReadyStack's engine database (not published) | 1061 |
defects | sadb, ReadyStack's engine database (not published) | multuscni v4.3.2-CE-ubuntu24.04-r2 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1061 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1061 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1061 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1061 |
release_images | sadb, ReadyStack's engine database (not published) | multuscni v4.3.2-CE-ubuntu24.04-r2 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1061 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1061 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |