MySQL 9.7.4-CE-ubuntu24.04-r3 build trail
How ReadyStack built readystack/mysql:9.7.4-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/mysql:9.7.4-CE-ubuntu24.04-r3 - Index digestsha256:d74ee1db9c3cf07d4c24961a7296c1fce953044355ef01c087b4cf80b13f0502
- linux/amd64 digestsha256:1c13d97e2cacec10a4164787666a670ff2d5998f38ea8066e4a8bb0bc4118dc6
- Archive
ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.tar.gz - Archive SHA-256 now16ecfeadcc3f2ce35f92952c7b871fc9d68bdadfc57011e8d2ddf8c5891c9288
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-05T07:40:43Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductMySQL (mysql) [MANIFEST.json]
- Release tag9.7.4-CE-ubuntu24.04-r3 [MANIFEST.json]
- Imagereadystack/mysql:9.7.4-CE-ubuntu24.04-r3 [MANIFEST.json]
- Image index digestsha256:d74ee1db9c3cf07d4c24961a7296c1fce953044355ef01c087b4cf80b13f0502 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:1c13d97e2cacec10a4164787666a670ff2d5998f38ea8066e4a8bb0bc4118dc6 [ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.tar.gz (bytes 1144796425) [MANIFEST.json]
- Archive sha256 at publish16ecfeadcc3f2ce35f92952c7b871fc9d68bdadfc57011e8d2ddf8c5891c9288 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/mysql/mysql-server [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refmysql-9.7.4 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit780b506e8296a61f2a7067bf2087d32c78e0bb76 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash02f5225b63b5b77b31042a137b38d1f4c7f72df8625acf796f051157bdfdc557 (files 59201) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:e58f509f7b38193d925039c376c19a2df8fb522208309d41395355f7060d2463 [ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1792523961 (utc 2026-10-20T19:19:21Z) [ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.rebuild.json, engine]
- Engine commit(s)
- commit f2b315730b18edeb7d76a7f9321303dc1de25083 · dirty yes · first drive 3495
- commit 365a624fc69da14f0fe38c698c9f4af5f4ee920f · dirty yes · first drive 3509
- commit f8b1b53e7deb936a7037cd1098d622c9dceca268 · dirty yes · first drive 3517
Why this release exists
Fully recorded- Chain816 (created 2026-11-05T04:24:05Z · trigger customer_request · upstream version 9.7.4) [chains, chains #816]
- Requestbuild request #497 (rebuild) (requested at 2026-11-05T04:21:06Z · requested by kitforge-agent · version 9.7.4) [build_requests, build_requests #497]
- Reasonrerelease agenda REVISION -> 9.7.4-CE-ubuntu24.04-r3 (decay loop, IMP-08) [build_requests, build_requests #497 request_reason]
- Supersedesreadystack/mysql:9.7.4-CE-ubuntu24.04-r2 (chain 669) [chains, chains #669]
The path through the harness
Fully recorded1 chain · 3 drives · 18 stages · 1 rewind
Chain 816 release · ready_to_ship
Created 2026-11-05T04:24:05Z, upstream 9.7.4, build request 497 [chains, chains #816]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 3495 | 2026-11-05T04:24:57Z | 91.3 | build host 4 withhold-publish | infra_hub_rate_limit at publish_image; 8 ticks [drive_runs, drive_runs #3495] |
| 3509 | 2026-11-05T06:14:08Z | 38.6 | build host 4 withhold-publish | ready_to_ship at package_archive; 12 ticks [drive_runs, drive_runs #3509] |
| 3517 | 2026-11-05T07:30:00Z | — | build host 4 publish-held | not recorded [drive_runs, drive_runs #3517] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-05T04:25:07Z | 2026-11-05T04:25:08Z | 1 | 4
|
order_json 5a9bdcf8568a… |
acquire |
2026-11-05T04:25:44Z | 2026-11-05T04:25:50Z | 1 | 12
|
source_tree 774a68939d0d…license_file 89bc1cf378aa…custody_inputs 717ab3fe3f2f…source_tree_hash 02a717d4fa6d…source_file_manifest b7e630ea7edd… |
plan |
2026-11-05T04:26:19Z | 2026-11-05T04:26:20Z | 1 | 10
|
recon_report 386171d7b0be…input_pin_plan b57336576b60…toolchain_lock a8bb18787334… |
assemble_kit |
2026-11-05T04:56:46Z | 2026-11-05T04:56:47Z | 1 | 27
|
dockerfile 74f596105feb…build_recipe c1f05f7a5dfc…system_pinning a28c9c05d3f0…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health ecb1b7d7d4b5…verify_offline_sh 3e8184ea230c…base_image_digests 478219ad01e9…dockerfile_offline 74f596105feb…first_build_digest ce611b15a4dd… |
remediate |
2026-11-05T04:57:09Z | 2026-11-05T04:57:10Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log ae28d5fc76c0…security_report 16f320e08724… |
build_kit |
2026-11-05T05:52:27Z | 2026-11-05T05:52:28Z | 1 | 9
|
cosign_stamp a8ddcbd622bf…locked_digest 8e2edab42eb6…freeze_manifest f17443fe46a8…offline_rebuild_transcript b69d2203403b… |
verdict |
2026-11-05T05:53:32Z | 2026-11-05T05:53:33Z | 1 | 8
|
scout_verdict ba1498403ad0… |
publish_image |
2026-11-05T06:15:06Z | 2026-11-05T06:15:07Z | 1 | 7
|
hub_readme 1331a4cb07e3…promotion_record 255798a8f083… |
boot_instance |
2026-11-05T06:15:27Z | 2026-11-05T06:15:30Z | 2 | 3
|
instance_handle 3aea18f5b0ea… |
sbom |
2026-11-05T06:15:53Z | 2026-11-05T06:15:54Z | 1 | 5
|
sbom_md 8a1418ee6076…sbom_json 1173697599cc… |
schema_discovery |
2026-11-05T06:15:57Z | 2026-11-05T06:15:58Z | 1 | 7
|
schema_hash ace2d359e979…dependency_tree ebc40a637843…table_classification d6a40cfce23a… |
admin_handbook |
2026-11-05T06:16:08Z | 2026-11-05T06:16:08Z | 1 | 7
|
api_map aef45610634e…admin_handbook a6c0b6bacb17… |
db_handbook |
2026-11-05T06:16:21Z | 2026-11-05T06:16:21Z | 1 | 8
|
db_handbook 20279a8c2f1c…seed_isolation c131b893948e… |
seed_data |
2026-11-05T06:16:28Z | 2026-11-05T06:16:29Z | 1 | 6
|
seed_data_sql b033ce872dcf…seed_cases_json c0985f1ee28f… |
seed_validate |
2026-11-05T06:16:32Z | 2026-11-05T06:16:33Z | 1 | 3
|
seed_data_contract ae4ec05c1883… |
usecase_validate |
2026-11-05T06:16:54Z | 2026-11-05T06:16:55Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 34154cfd1c7d…test_results 57e9440835a9…usecase_contract dcfe737c00f6… |
finalize_docs |
2026-11-05T06:17:00Z | 2026-11-05T06:17:01Z | 1 | 9
|
defects_json f26cfa70f8c6…release_notes a324ed6cabf5…api_integration_guide bf7c36d61be4… |
package_archive invalidated 2026-11-05T07:29:35Z |
2026-11-05T06:52:40Z | 2026-11-05T06:52:45Z | 1 | 34 (final gate PASS)
|
sale_tar 396845b3a81a…checksums ba557851191c…verify_md d33ee7ba3423…rebuild_md 572de43783e7…manifest_txt 008102df3b3b…actions_jsonl b91651aa801e…provenance_md ad0d08f7e361…assetchain_log_md e9eccaec0c0f…assetchain_log_json 1d63490e795b… |
[stage_runs]
Rewinds
- 2026-11-05T07:29:35Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #22911]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-05T06:52:45Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 7155 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 6838 | L-A183, L-A15 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.33 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-05T06:53:19Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1407] | $0.33 | 3 rounds, $40.00 | 396845b3a81a… |
Defects
Fully recorded- Ledger entries1 [defects, defects where product_slug=mysql and this tag or chain]
- Disclosed in the archive1 [docs/defects/defects.json, entries]
1 ledger entry: by severity medium 1; by status open 1.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-mysql-8bdbd43b1cThe seed-data record says the product has no SQL database ('config/CRD-native product') [defects, defects #155247] | medium | open | engine review | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:1c13d97e2cacec10a4164787666a670ff2d5998f38ea8066e4a8bb0bc4118dc6 · published digest sha256:1c13d97e2cacec10a4164787666a670ff2d5998f38ea8066e4a8bb0bc4118dc6 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 1650) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-05T07:30:24Z · failing Docker Scout counts 83 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-05T07:30:10Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3692703775 · transparency-log entry
- log index 3692703887 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3692828634 · transparency-log entry · integrated 2026-11-05T07:38:41Z) [ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:d74ee1db9c3cf07d4c24961a7296c1fce953044355ef01c087b4cf80b13f0502 · state attached · log index 3692829285 · transparency-log entry
- kind sbom · digest sha256:d74ee1db9c3cf07d4c24961a7296c1fce953044355ef01c087b4cf80b13f0502 · state attached · log index 3692829497 · transparency-log entry
- kind vsa · digest sha256:d74ee1db9c3cf07d4c24961a7296c1fce953044355ef01c087b4cf80b13f0502 · state attached · log index 3692829690 · transparency-log entry
- kind provenance · digest sha256:1c13d97e2cacec10a4164787666a670ff2d5998f38ea8066e4a8bb0bc4118dc6 · state attached · log index 3692829882 · transparency-log entry
- kind sbom · digest sha256:1c13d97e2cacec10a4164787666a670ff2d5998f38ea8066e4a8bb0bc4118dc6 · state attached · log index 3692830079 · transparency-log entry
- kind vsa · digest sha256:1c13d97e2cacec10a4164787666a670ff2d5998f38ea8066e4a8bb0bc4118dc6 · state attached · log index 3692830345 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/mysql/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-05T06:53:29Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:1c13d97e2cacec10a4164787666a670ff2d5998f38ea8066e4a8bb0bc4118dc6 [clean-room rebuild ledger, runs[589]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-05T06:15:07Z [stage_runs, stage_runs chain 816 stage publish_image]
- Archive manifests written2026-11-05T07:34:55Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 879 · probed 2026-11-05T05:24:43Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-05T07:40:43Z generated: by KitForge release/build_trail.py · generator commit f8b1b53e7deb936a7037cd1098d622c9dceca268
- 2026-11-05T07:43:04Z publication: promoted at 2026-11-05T07:41:28Z · promoted digest sha256:d74ee1db9c3cf07d4c24961a7296c1fce953044355ef01c087b4cf80b13f0502 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 320 · checklist status complete · checklist at 2026-11-05T07:43:04Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/mysql/9.7.4-CE-ubuntu24.04-r3/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/mysql/9.7.4-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.rebuild.json | beside the archive (prodasset /data/production/mysql/9.7.4-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-mysql-9.7.4-CE-ubuntu24.04-r3.rebuild.json.sigstore | beside the archive (prodasset /data/production/mysql/9.7.4-CE-ubuntu24.04-r3/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/mysql/9.7.4-CE-ubuntu24.04-r3/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 497 |
chains | sadb, ReadyStack's engine database (not published) | 816 |
defects | sadb, ReadyStack's engine database (not published) | mysql 9.7.4-CE-ubuntu24.04-r3 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 816 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 816 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 816 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 816 |
release_images | sadb, ReadyStack's engine database (not published) | mysql 9.7.4-CE-ubuntu24.04-r3 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 816 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 816 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |