NGINX 1.31.8-CE-ubuntu24.04-r3 build trail

How ReadyStack built readystack/nginx:1.31.8-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/nginx:1.31.8-CE-ubuntu24.04-r3
  • Index digestsha256:8e9465af4e8612da78ec4368f18a3dbe3c12403cb0947f185278a7a1d16350dd
  • linux/amd64 digestsha256:b880d874ee7d8f30da9ed691fed953b4419300afc06a704e619ee49d4eb531d4
  • ArchiveReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.tar.gz
  • Archive SHA-256 nowbb3889a1ad16ba85a498b24b9dd97f25af1cbbe7def46216b168591eae50fcb6
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T10:33:21Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.trail.json
ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.trail.jsonReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.trail.json.sigstoreReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.trail.mdNGINX product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductNGINX (nginx) [MANIFEST.json]
  • Release tag1.31.8-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Imagereadystack/nginx:1.31.8-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Image index digestsha256:8e9465af4e8612da78ec4368f18a3dbe3c12403cb0947f185278a7a1d16350dd [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:b880d874ee7d8f30da9ed691fed953b4419300afc06a704e619ee49d4eb531d4 [ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.tar.gz (bytes 541435296) [MANIFEST.json]
  • Archive sha256 at publishbb3889a1ad16ba85a498b24b9dd97f25af1cbbe7def46216b168591eae50fcb6 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/nginx/nginx [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refrelease-1.31.8 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit140aa942711868a8daeb95810bc9a81f272ada72 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash30b1e300a9859801916b2aef8707f40ed7d489117582f461334f09b10c4b9190 (files 544) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:e237d98f34ecb48baea7c7b07e1ff2dfabce29405dff1411a460b8c8df6dee10 [ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1792592691 (utc 2026-10-21T14:24:51Z) [ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.rebuild.json, engine]
  • Engine commit(s)
    • commit 53eeaa1375fde24597366a5342db51d1d1fd7b52 · dirty yes · first drive 3975
    • commit 9e1e08daa6fd77ad7901229048721017ec2e4d84 · dirty yes · first drive 3987
    • commit 83a33a598e56060c083542e06b07b17380b8c103 · dirty yes · first drive 3991
    • commit d83d0de9b6c19e378265f1b12eeea189e2c78f64 · dirty yes · first drive 3995
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain912 (created 2026-11-09T07:05:31Z · trigger customer_request · upstream version 1.31.8) [chains, chains #912]
  • Requestbuild request #545 (rebuild) (requested at 2026-11-08T03:42:11Z · requested by kitforge-agent · version 1.31.8) [build_requests, build_requests #545]
  • Reasonrevision 1.31.8-CE-ubuntu24.04-r3: same upstream version rebuilt on the chiselled runtime (slim base, C/Rust engine #198) [build_requests, build_requests #545 request_reason]
  • Supersedesreadystack/nginx:1.31.8-CE-ubuntu24.04-r2 (chain 817) [chains, chains #817]

The path through the harness

Fully recorded

1 chain · 4 drives · 18 stages · 4 rewinds

Chain 912 release · ready_to_ship

Created 2026-11-09T07:05:31Z, upstream 1.31.8, build request 545 [chains, chains #912]

DriveStartedMinutesBuild hostHow it stopped
39752026-11-09T07:07:47Z54build host 2 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3975]
39872026-11-09T09:03:46Z10.3build host 2 withhold-publish ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #3987]
39912026-11-09T10:02:15Z2.5build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3991]
39952026-11-09T10:29:36Z—build host 2 publish-held not recorded [drive_runs, drive_runs #3995]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-09T07:08:00Z2026-11-09T07:08:01Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json ae8db77389f1…
acquire 2026-11-09T07:08:09Z2026-11-09T07:08:10Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 2bd4e5411265…
license_file 08845fe39e06…
custody_inputs d5296c77d550…
source_tree_hash cf0f25330e3f…
source_file_manifest 290045106f13…
plan 2026-11-09T07:08:50Z2026-11-09T07:08:51Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 87fb7e3457da…
input_pin_plan 2985fa016f7d…
toolchain_lock f7b66fed1887…
assemble_kit 2026-11-09T07:10:53Z2026-11-09T09:05:37Z2
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 094acba758b7…
build_recipe a21ed89a7b5a…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health cfd9466ef27f…
verify_offline_sh 3e8184ea230c…
base_image_digests 686b9f7e1b04…
dockerfile_offline 094acba758b7…
first_build_digest ea2dd23780e9…
remediate 2026-11-09T07:11:27Z2026-11-09T09:05:42Z2
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 1075b94f4c29…
security_report ef1ebe56a3a3…
build_kit 2026-11-09T07:14:02Z2026-11-09T09:08:13Z2
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp f2b1fcc649a3…
locked_digest 32d12bc659fc…
freeze_manifest c39d71f9e192…
offline_rebuild_transcript 51533a291ddb…
verdict 2026-11-09T07:14:27Z2026-11-09T09:08:38Z2
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 752ccf5958bf…
publish_image 2026-11-09T07:14:57Z2026-11-09T09:09:07Z2
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme f401e39cb798…
promotion_record 7c0302f91cce…
boot_instance 2026-11-09T07:15:03Z2026-11-09T09:09:17Z4
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 181806bf576f…
sbom 2026-11-09T07:15:17Z2026-11-09T09:09:26Z2
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 0b02dd0eff37…
sbom_json d2d37901d3f2…
schema_discovery 2026-11-09T07:15:20Z2026-11-09T09:09:29Z2
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 499a56abf9f1…
dependency_tree 98582bd18ff0…
table_classification 4cad56f5de2e…
admin_handbook 2026-11-09T07:26:44Z2026-11-09T09:09:39Z2
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 00f816c804e4…
admin_handbook 9b67b4417767…
db_handbook 2026-11-09T07:39:31Z2026-11-09T09:09:51Z2
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 2957ca6f7002…
seed_isolation 208647f15d9e…
seed_data 2026-11-09T07:39:39Z2026-11-09T09:09:59Z2
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql a90f8d1a27f9…
seed_cases_json 1cffd2f55a75…
seed_validate 2026-11-09T07:39:42Z2026-11-09T09:10:03Z2
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 7a70f2074f7d…
usecase_validate 2026-11-09T07:39:59Z2026-11-09T09:10:14Z2
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests d93ae11e4f98…
test_results dde0bfe67f71…
usecase_contract dc5482be05ef…
finalize_docs 2026-11-09T07:53:19Z2026-11-09T09:10:20Z2
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 3588069afa78…
release_notes 22fdb8fd9d5c…
api_integration_guide ea6b6b89d161…
package_archive invalidated 2026-11-09T10:29:12Z 2026-11-09T08:01:42Z2026-11-09T10:04:44Z3
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 0c67748bb58c…
checksums 9e5439d10ba6…
verify_md 6ec86f5af25e…
rebuild_md ee28d8940ebb…
manifest_txt 394aa841805c…
actions_jsonl 569f00fac355…
provenance_md 6dc86b3891a0…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json d14b6b83c2b1…

[stage_runs]

Rewinds

  • 2026-11-09T08:35:40Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive --allow-rebuild) [stage_events, stage_events #28420]
  • 2026-11-09T09:03:50Z: package_archive to assemble_kit on strategy_changed (strategy changed (e47a8d3584a5 -> 4ae5a54acc6c)) [stage_events, stage_events #28489]
  • 2026-11-09T09:39:48Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28599]
  • 2026-11-09T10:29:12Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28702]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T10:04:44Z.

183 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 08280 L-A183, L-A15
remediate2001 07720 L-A183, L-A15
admin_handbook531703 3423903 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook611903 5522356 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate1001 01656 L-A59
finalize_docs642303 4526585 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $7.10 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T08:03:43Z 01231 findings to rebuild [held_rounds, held_rounds #1599] $2.88 3 rounds, $40.00 ef210585560b…
22026-11-09T09:15:23Z 0217 findings to repackage [held_rounds, held_rounds #1603] $2.05 3 rounds, $40.00 bc4f556d1cca…
32026-11-09T10:05:24Z 0019 clean to publish [held_rounds, held_rounds #1605] $2.16 3 rounds, $40.00 0c67748bb58c…

Defects

Fully recorded
  • Ledger entries81 [defects, defects where product_slug=nginx and this tag or chain]
  • Disclosed in the archive81 [docs/defects/defects.json, entries]

81 ledger entries: by severity high 14, low 67; by status fixed-before-release 81.

DefectSeverityStatusFound byFixed in
RSD-nginx-9cb4357c64
Admin handbook: The documented custom health command makes the container fail every probe ('CMD-SHELL: not found'), so a customer who follows it gets an unhealthy container. [defects, defects #201876]		highfixed-before-releaseheld review (review model)—
RSD-nginx-b3549e983c
Database handbook: The documented compression test uses a flag rs-probe does not have; it exits 2 with a usage message and shows no headers. [defects, defects #201877]		highfixed-before-releaseheld review (review model)—
RSD-nginx-90143b48c6
Database handbook: Claims rs-probe prints response headers; it does not. [defects, defects #201878]		highfixed-before-releaseheld review (review model)—
RSD-nginx-b113706730
Database handbook: Mounting a stream{} file into conf.d (the documented procedure) makes nginx refuse to start. [defects, defects #201879]		highfixed-before-releaseheld review (review model)—
RSD-nginx-16deb51b27
Database handbook: The run command that follows (line 1767) mounts the stream{} file into /etc/nginx/conf.d, so the container exits at start. [defects, defects #201880]		highfixed-before-releaseheld review (review model)—
RSD-nginx-b8971fe5f5
Database handbook: The documented nginx.conf (stream + http, no events block) does not start. [defects, defects #201881]		highfixed-before-releaseheld review (review model)—
RSD-nginx-4f81a12e00
API guide: A file containing only the stream block mounted over nginx.conf makes nginx exit at start. [defects, defects #201882]		highfixed-before-releaseheld review (review model)—
RSD-nginx-a9b5c415be
API guide: Recommends mounting stream.conf into /etc/nginx/conf.d/stream.conf, which nginx rejects. [defects, defects #201883]		highfixed-before-releaseheld review (review model)—
RSD-nginx-0e8eadf4e2
API guide: The first docker run mounts stream.conf at a path nothing includes, so the stream listener never starts. [defects, defects #201884]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-9bacefb803
Database handbook: With the documented proxy.conf the request to http://localhost:8080/ is answered by the shipped welcome-page site, not forwarded to the upstream. [defects, defects #201885]		highfixed-before-releaseheld review (review model)—
RSD-nginx-39ceafe784
Admin handbook: The documented examples (mysite.conf `listen 8080;` with root /var/www/html, and the 'Hello World' site at line 370) never serve the customer's content: the welcome page answers instead. [defects, defects #201886]		highfixed-before-releaseheld review (review model)—
RSD-nginx-9461f38e94
Database handbook: Both sites cannot answer on the same port 8080 unless the Host header selects the second one. [defects, defects #201887]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-b44e25d200
Admin handbook: Same family: with no server_name the new site is never selected. [defects, defects #201888]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-ba9a5f34fb
Admin handbook: The host-directory example is introduced as 'ensure it is writable by uid 999' but creates a 0700 directory owned by the caller, which the nginx user cannot use: every cache write fails with 500. [defects, defects #201889]		highfixed-before-releaseheld review (review model)—
RSD-nginx-e412181be1
API guide: The note names a port conflict that cannot happen and tells the customer to remove a container called nginx, which is not the verification container; it contradicts the same guide's later sentence. [defects, defects #201890]		highfixed-before-releaseheld review (review model)—
RSD-nginx-528d1e7167
Admin handbook: Predicts exit code 125 'port already allocated' after verification; the script's container uses another port and is removed. [defects, defects #201891]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-4dccff6235
Admin handbook: Contradicts the Operating facts ('compiled in with --with-http_stub_status_module'): stub_status does appear in nginx -V. [defects, defects #201892]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-44668bb875
Admin handbook: Contradicts the Health check facts: the probe does not require 200. [defects, defects #201893]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-9eb8766ea8
Admin handbook: Same contradiction: the probe does not expect 200. [defects, defects #201894]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-d5a6079901
Database handbook: Says replacing default.conf makes the health check fail 'because nothing answers on port 8080'; with a replacement that listens on 8080 it passes. [defects, defects #201895]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-ab707391e0
Database handbook: States that no reload signal reaches the master; the master logs 'signal 1 (SIGHUP) received ... [defects, defects #201896]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-e8fee68309
Database handbook: For an unparseable configuration `nginx -s reload` exits 1 and prints the error; the text says it exits 0 and sends the signal, contradicting lines 1493-1495 and the Operating facts. [defects, defects #201897]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-2555143255
API guide: Says no signal is sent when files cannot be opened; the signal is sent (contradicts the sentence before it, which says the master logs the error). [defects, defects #201898]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-25080998b4
API guide: Same false claim: the master receives SIGHUP. [defects, defects #201899]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-85e1b55254
API guide: A missing certificate is reported by `nginx -s reload` in the terminal with exit 1, not exit 0 with a log entry. [defects, defects #201900]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-3f74f576ec
API guide: docker kill never prints the nginx error or exits 1. [defects, defects #201901]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-10ed7a2a22
API guide: States generally that reload exits 0 for an invalid configuration; syntax errors exit 1. [defects, defects #201902]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-3a6bfacccc
Database handbook: There is no `protocol` directive; the sentence contradicts its own example (`listen 53 udp;`). [defects, defects #201903]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-485049f657
Database handbook: Tells the customer to set proxy_temp_path in the stream block, which nginx rejects. [defects, defects #201904]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-875dc7637b
Database handbook: Contradicts line 1937 and nginx's stream default. [defects, defects #201905]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-7b716cac1f
Database handbook: The example does not enable realip as the sentence says. [defects, defects #201906]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-b3c3b72f11
Admin handbook: The r3 image has no runtime debs; the handbook still describes the r2 full-ubuntu runtime. [defects, defects #201907]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-f455d6db27
Database handbook: Same: no runtime debs in r3. [defects, defects #201908]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-5513b152b8
API guide: Same: the runtime is a chiselled rootfs, not Debian packages. [defects, defects #201909]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-c9f8aecb3a
API guide: The documented shell command does nothing without -it. [defects, defects #201910]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-4d2d7a341e
Admin handbook: -body does not print the status code. [defects, defects #201911]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-f265b88e40
Admin handbook: Error log goes to stderr. [defects, defects #201912]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-3ef9770563
API guide: The example is introduced as a copy of the shipped default site but replaces default_type with add_header, producing a duplicate Content-Type header. [defects, defects #201913]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-081503fe5d
Database handbook: The command does not test a file before a new container starts. [defects, defects #201914]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-9197603237
API guide: docker cp is not a mount and cannot be used as the non-root user. [defects, defects #201915]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-3d866ebb72
Database handbook: The image has no package manager, so a package cannot be installed there. [defects, defects #201916]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-db2e81f3a7
API guide: Inconsistent mount paths: a configuration following the guide's own ssl.conf (`/etc/nginx/ssl/cert.pem`) fails with 'cannot load certificate ... [defects, defects #201917]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-bc433205ef
Admin handbook: reuseport is not required by nginx. [defects, defects #201918]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-1c199c9042
Admin handbook: The documented 'Hello World' site (mysite.conf: listen 8080; root /var/www/html, no server_name) is never selected: default.conf (server_name localhost) is the default server for 8080, so the… [defects, defects #202922]		highfixed-before-releaseheld review (review model)—
RSD-nginx-701b82d9bc
Admin handbook: The 'Creating Mount Files' site.conf (listen 8080; server_name localhost; root /data) duplicates default.conf's server_name on the same port: nginx logs 'conflicting server name "localhost" on… [defects, defects #202923]		highfixed-before-releaseheld review (review model)—
RSD-nginx-07ea0f08dd
Admin handbook: Directories need execute permission as well; contradicts the Permissions section (line 729) and DB handbook line 995. [defects, defects #202924]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-577e780162
Admin handbook: Says the health check fails unless /healthz is provided; the probe passes on any HTTP status (Operating facts, health check). [defects, defects #202925]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-aeb36e4356
Admin handbook: Nothing is served 'from memory'; the page is read from the image's filesystem and /healthz is a return directive. [defects, defects #202926]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-72b618df9d
API guide: A redirection truncates then writes; it is in place, not atomic. [defects, defects #202927]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-6ddb75777a
API guide: Same false 'atomically' claim. [defects, defects #202928]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-c7e9b3870e
Database handbook: Same false 'atomically' claim. [defects, defects #202929]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-0e86b6de5f
API guide: Requires a /healthz location for health; the probe passes with any HTTP answer on 8080 (contradicts the Operating facts and API line 481). [defects, defects #202930]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-bb40b3d764
API guide: Replacing the default site alone does not fail the check; contradicts line 1164 and the Operating facts. [defects, defects #202931]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-801ca91ccc
API guide: Ports above 1023 need no sysctl; the sentence contradicts API line 501 and ADMIN 865. [defects, defects #202932]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-997c310df9
API guide: Port binding has nothing to do with writing a cache directory; the clause suggests a default Docker setting grants write access. [defects, defects #202933]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-cdb19ff218
API guide: Contradicts API lines 2077 and 2169 and the Operating facts: /tmp files survive docker restart. [defects, defects #202934]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-233fe3f51f
API guide: The shipped site has `location / { root /usr/share/nginx/html; }`, so /index.html answers 200. [defects, defects #202935]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-4f79e39d4f
Database handbook: Same: /index.html answers 200. [defects, defects #202936]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-000be6b915
API guide: Introduced as a copy of the shipped default site, but server_name, the `location /` block and the layout differ from the shipped default.conf (stub_status itself works). [defects, defects #202937]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-866e56c2ce
Database handbook: Without -body or -code rs-probe prints nothing (exit 0), so the command shows no health answer. [defects, defects #202938]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-a2c9bbc52a
Database handbook: proxy_ssl_certificate/proxy_ssl_certificate_key make nginx authenticate itself to the proxied server; they do not require client certificates from clients. [defects, defects #202939]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-14e953f287
Database handbook: The example mounts the customer's own nginx.conf, which replaces the shipped main configuration; the default site survives only if that file includes conf.d. [defects, defects #202940]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-ce80d1253f
Admin handbook: Ports above 1023 need no sysctl; contradicts API line 501 and ADMIN line 868 (round-2 finding, still present). [defects, defects #203778]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-ca7bdb7635
Admin handbook: Live (jt-ha912-b): after `sed -i` on a single bind-mounted site.conf, `nginx -T` still showed server_name site.local after reload, and showed site.two after `docker restart`. [defects, defects #203779]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-6becf87e09
Admin handbook: Live: a directory mounted over conf.d holding only `server { listen 8080; location / { return 200; } }` (no /healthz location) stays `healthy`; rs-probe -code passes on any HTTP status (IMAGE_CONFIG… [defects, defects #203780]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-09b870d597
Admin handbook: Same live test as ADMIN 297: no /healthz location, still healthy; round-2 finding 'requires a /healthz location for health' not fully fixed. [defects, defects #203781]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-de2834d82c
Admin handbook: Same live test: health depends on anything answering on 8080, not on /healthz. [defects, defects #203782]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-8f6fd57a0c
Admin handbook: Same live test; contradicts ADMIN 1753-1755 ('remains healthy as long as some endpoint on port 8080 answers'). [defects, defects #203783]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-6ecd2f6a65
Admin handbook: Same live test; contradicts Operating facts health_check. [defects, defects #203784]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-6539ade937
Database handbook: Same live test; the server need not answer /healthz. [defects, defects #203785]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-c4cbd2dd00
Admin handbook: The image HEALTHCHECK is part of the image config (IMAGE_CONFIG.json Healthcheck), not of default.conf, and passes on any HTTP answer; contradicts Operating facts health_check and ADMIN 592/1753. [defects, defects #203786]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-b6f9e923d4
Admin handbook: Live: a default.conf containing only `listen 8081;` leaves nothing on 8080 (container never reaches healthy); the sentence is true only when the replacement listens on 8080. [defects, defects #203787]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-6d322fb35e
Admin handbook: The docker run block that follows (lines 341-345) publishes only `-p 8080:8080` and the mysite.conf content is not shown; a customer who follows the sentence with listen 8081 cannot reach the site. [defects, defects #203788]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-1036af43dc
Database handbook: Live: GET /index.html on the shipped default site returns 200 (rs-probe -code / wget); default.conf `location / { root /usr/share/nginx/html; }`. [defects, defects #203789]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-b85b783d56
Database handbook: Live: after `sed -i` (replaced file) a reload kept the old content and `docker restart nginx` loaded the new one; a file written with `cat new > file` needs only the reload (DB 1090 says the same). [defects, defects #203790]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-2d3e8fc8c7
Database handbook: Operating facts ports: under plain docker run the nginx user can bind below 1024 (`listen 80;` works, measured with Docker 29.1.3); DB line 1985 itself uses `listen 443;` in a stream server. [defects, defects #203791]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-6bfefb0cb9
Database handbook: Operating facts data_persistence: /tmp is in the container's writable layer (not a tmpfs); the same section's Data and State text (DB 2253) says it survives docker restart. [defects, defects #203792]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-077c29d5a6
Database handbook: Live (jt-ha912-p, mode 700 dir/600 file): GET / returned 403 and docker logs showed `[error] ... [defects, defects #203793]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-2d8fe5445a
API guide: Live (jt-ha912-u): `docker logs jt-ha912-u > out.txt 2> err.txt` gave 5 stdout lines (access log) and 13 stderr lines (error log: the notice/startup lines); the documented command would drop the… [defects, defects #203794]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-aa341bd59d
API guide: The block that follows is a different server (`server_name _;`, elided body), not the shipped default.conf (`server_name localhost`, location / with root, /healthz, /50x.html); round-2 finding… [defects, defects #203795]		lowfixed-before-releaseheld review (review model)—
RSD-nginx-409222005d
API guide: IMAGE_BINARIES.txt lists no HTTP client besides rs-probe (no curl, wget); 'another tool available in the container' for testing 'from outside the container' names nothing that exists. [defects, defects #203796]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:b880d874ee7d8f30da9ed691fed953b4419300afc06a704e619ee49d4eb531d4 · published digest sha256:b880d874ee7d8f30da9ed691fed953b4419300afc06a704e619ee49d4eb531d4 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 64) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T10:29:56Z · failing Docker Scout counts 9 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T10:29:47Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3763241570 · transparency-log entry · integrated 2026-11-09T10:32:12Z) [ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:8e9465af4e8612da78ec4368f18a3dbe3c12403cb0947f185278a7a1d16350dd · state attached · log index 3763241931 · transparency-log entry
    • kind sbom · digest sha256:8e9465af4e8612da78ec4368f18a3dbe3c12403cb0947f185278a7a1d16350dd · state attached · log index 3763242354 · transparency-log entry
    • kind vsa · digest sha256:8e9465af4e8612da78ec4368f18a3dbe3c12403cb0947f185278a7a1d16350dd · state attached · log index 3763242694 · transparency-log entry
    • kind provenance · digest sha256:b880d874ee7d8f30da9ed691fed953b4419300afc06a704e619ee49d4eb531d4 · state attached · log index 3763243049 · transparency-log entry
    • kind sbom · digest sha256:b880d874ee7d8f30da9ed691fed953b4419300afc06a704e619ee49d4eb531d4 · state attached · log index 3763243521 · transparency-log entry
    • kind vsa · digest sha256:b880d874ee7d8f30da9ed691fed953b4419300afc06a704e619ee49d4eb531d4 · state attached · log index 3763243940 · transparency-log entry
    (at 2026-11-09T10:32:13Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/nginx/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T08:03:49Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:49196640c0f71cbdfc8512cd8a2e2cfd30357a5443ed70bbf02fe182de98c73e [clean-room rebuild ledger, runs[690]]
  • 2026-11-09T09:15:28Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:b880d874ee7d8f30da9ed691fed953b4419300afc06a704e619ee49d4eb531d4 [clean-room rebuild ledger, runs[692]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-09T09:09:07Z [stage_runs, stage_runs chain 912 stage publish_image]
  • Archive manifests written2026-11-09T10:31:12Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 66 · probed 2026-11-09T09:06:53Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T10:33:21Z generated: by KitForge release/build_trail.py · generator commit d83d0de9b6c19e378265f1b12eeea189e2c78f64
  • 2026-11-09T10:34:28Z publication: promoted at 2026-11-09T10:33:52Z · promoted digest sha256:8e9465af4e8612da78ec4368f18a3dbe3c12403cb0947f185278a7a1d16350dd · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 408 · checklist status complete · checklist at 2026-11-09T10:34:28Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/nginx/1.31.8-CE-ubuntu24.04-r3/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/nginx/1.31.8-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.rebuild.jsonbeside the archive (prodasset /data/production/nginx/1.31.8-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-nginx-1.31.8-CE-ubuntu24.04-r3.rebuild.json.sigstorebeside the archive (prodasset /data/production/nginx/1.31.8-CE-ubuntu24.04-r3/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/nginx/1.31.8-CE-ubuntu24.04-r3/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)545
chainssadb, ReadyStack's engine database (not published)912
defectssadb, ReadyStack's engine database (not published)nginx 1.31.8-CE-ubuntu24.04-r3
drive_runssadb, ReadyStack's engine database (not published)chain 912
held_roundssadb, ReadyStack's engine database (not published)chain 912
lesson_recallssadb, ReadyStack's engine database (not published)chain 912
micro_step_runssadb, ReadyStack's engine database (not published)chain 912
release_imagessadb, ReadyStack's engine database (not published)nginx 1.31.8-CE-ubuntu24.04-r3
stage_eventssadb, ReadyStack's engine database (not published)chain 912
stage_runssadb, ReadyStack's engine database (not published)chain 912
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—