OpenTelemetry Collector v0.164.0-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/otelcol:v0.164.0-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/otelcol:v0.164.0-CE-ubuntu24.04-r1
  • Index digestsha256:f56eaf939af6eb2081d5eefa4bfd1607c89a759c006a63767212fa9238630a2b
  • linux/amd64 digestsha256:59a91de832a64a1aff37b7303e5053383dda6b83d81776710791b9d4f2d231e4
  • ArchiveReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 now2946f4db313919f26b3438080180270a4f784577b45bb037b13523d810a837de
  • Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
  • Sections9 sections, 3 fully recorded; 13 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.trail.json
ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.trail.jsonReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.trail.mdOpenTelemetry Collector product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

1 item not recorded
  • ProductOpenTelemetry Collector (otelcol) [MANIFEST.json]
  • Release tagv0.164.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/otelcol:v0.164.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:f56eaf939af6eb2081d5eefa4bfd1607c89a759c006a63767212fa9238630a2b [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:59a91de832a64a1aff37b7303e5053383dda6b83d81776710791b9d4f2d231e4 [ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.tar.gz (bytes 469749827) [MANIFEST.json]
  • Archive sha256 at publish43b99fd768abdc4398e02604d057201fe7f47a469174d424b9cac7c36fa294c5 [MANIFEST.json, repack_history[0].previous_tarball_sha256]
  • Archive sha256 now2946f4db313919f26b3438080180270a4f784577b45bb037b13523d810a837de [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack history
    • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 43b99fd768abdc4398e02604d057201fe7f47a469174d424b9cac7c36fa294c5 · sha256 2946f4db313919f26b3438080180270a4f784577b45bb037b13523d810a837de · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
    [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/open-telemetry/opentelemetry-collector-releases [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv0.164.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitbf626fce5c8053ac6ae9c6c5f4c408c8c182740e [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash0f2a1fd39430c2feda74049ae28d1454f12dadd02e7e403c805ec291962b954e (files 177) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:d99b2ab934dea297c81de6c5eb9c81165b796ff92593b7270b2f20c219f357d9 [ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793057089 (utc 2026-10-26T23:24:49Z) [ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded
  • Chain708 (created 2026-10-27T16:24:38Z · trigger customer_request · upstream version v0.164.0) [chains, chains #708]
  • Requestbuild request #386 (rebuild) (requested at 2026-10-27T04:39:55Z · requested by kitforge-agent · version v0.164.0) [build_requests, build_requests #386]
  • Reasonretarget to v0.164.0: a newer upstream release (rule 1) [build_requests, build_requests #386 request_reason]
  • Supersedesreadystack/otelcol:v0.163.2-CE-ubuntu24.04-r1 (chain 607) [chains, chains #607]

The path through the harness

2 items not recorded

1 chain · 6 drives · 18 stages · 3 rewinds

Chain 708 release · shipped

Created 2026-10-27T16:24:38Z, upstream v0.164.0, build request 386 [chains, chains #708]

DriveStartedMinutesBuild hostHow it stopped
2232026-10-27T16:25:02Z52.4build host 1 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #223] rebuilt from a build line's log
2262026-10-27T17:34:26Z7.9build host 1 withhold-publish ready_to_ship [drive_runs, drive_runs #226] rebuilt from a build line's log
2282026-10-27T18:33:29Z1.3build host 1 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #228] rebuilt from a build line's log
2352026-10-28T00:31:31Z4build host 1 withhold-publish ready_to_ship [drive_runs, drive_runs #235] rebuilt from a build line's log
2372026-10-28T00:51:36Z3.3build host 1 withhold-publish ready_to_ship [drive_runs, drive_runs #237] rebuilt from a build line's log
2392026-10-28T01:16:12Z6.2build host 1 publish-held shipped [drive_runs, drive_runs #239] rebuilt from a build line's log

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-27T16:25:09Z2026-10-27T16:25:10Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-27T16:25:16Z2026-10-27T16:25:17Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-27T16:25:58Z2026-10-27T16:25:59Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-27T16:32:42Z2026-10-27T16:32:43Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 —
remediate 2026-10-27T16:33:38Z2026-10-27T16:33:39Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 —
build_kit 2026-10-27T16:42:17Z2026-10-27T16:42:18Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 —
verdict 2026-10-27T16:43:12Z2026-10-27T16:43:13Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 —
publish_image 2026-10-27T16:43:54Z2026-10-27T16:43:55Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 —
boot_instance 2026-10-27T16:44:00Z2026-10-27T16:44:01Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 —
sbom 2026-10-27T16:44:14Z2026-10-27T16:44:15Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 —
schema_discovery 2026-10-27T16:44:16Z2026-10-27T16:44:17Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 —
admin_handbook 2026-10-27T16:59:20Z2026-10-27T16:59:21Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 —
db_handbook 2026-10-27T17:12:40Z2026-10-27T17:12:41Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 —
seed_data 2026-10-27T17:12:46Z2026-10-27T17:12:46Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 —
seed_validate 2026-10-27T17:12:48Z2026-10-27T17:12:49Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 —
usecase_validate 2026-10-27T17:13:11Z2026-10-27T17:13:12Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 —
finalize_docs 2026-10-27T17:13:16Z2026-10-27T17:13:17Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 —
package_archive 2026-10-27T17:17:21Z2026-10-28T01:22:17Z6
33 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 scout_grade_a
  • G8 script_copies
  • G8 three_way_sha
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 assetchain_coverage
 —

[stage_runs]

Rewinds

  • 2026-10-27T18:09:41Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2188]
  • 2026-10-28T00:45:50Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2189]
  • 2026-10-28T01:15:37Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #275]
  • Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
  • Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-10-28T01:22:17Z.

154 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook793603 not recordednot recorded —
db_handbook702703 not recordednot recorded —
usecase_validate1001 not recordednot recorded —

[micro_step_runs]

  • Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
  • Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

2 items not recorded

Role: review model.

3 rounds, 3 counted, $5.87 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-10-27T17:43:08Z 0426 findings to repackage [held_rounds, held_rounds #139] rebuilt from a held-review state file $1.99 not recorded not recorded
22026-10-28T00:36:01Z 0110 findings to repackage [held_rounds, held_rounds #140] rebuilt from a held-review state file $1.90 not recorded not recorded
32026-10-28T00:55:02Z 005 clean to publish [held_rounds, held_rounds #141] rebuilt from a held-review state file $1.98 not recorded not recorded
  • Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
  • Not recorded: the round cap in force at each round (the state files did not keep it)

Defects

Fully recorded
  • Ledger entries47 [defects, defects where product_slug=otelcol and this tag or chain]
  • Disclosed in the archive47 [docs/defects/defects.json, entries]

47 ledger entries: by severity high 6, low 41; by status open 1, fixed-before-release 46.

DefectSeverityStatusFound byFixed in
RSD-otelcol-3f78f3a9a9
Unauthenticated access by default [defects, defects #116642]		highopenbuild strategy record—
RSD-otelcol-bab86c1cc2
Admin handbook: The URL a customer is told to scrape is wrong: 1777 is the pprof server (no /metrics, 404) and `localhost` on the host reaches neither loopback port. [defects, defects #117435]		highfixed-before-releaseheld review (review model)—
RSD-otelcol-c8f66ef87f
Admin handbook: The procedure fails: `docker exec` runs as the non-root otelcol user, which cannot change the owner of a file it does not own, so the key stays unreadable and the collector keeps exiting with… [defects, defects #117436]		highfixed-before-releaseheld review (review model)—
RSD-otelcol-c7f1cd0b1a
Admin handbook: Same failing procedure as line 1406 for the TLS files: `docker exec` as uid 999 gets `Operation not permitted`. [defects, defects #117437]		highfixed-before-releaseheld review (review model)—
RSD-otelcol-c0b6e2b898
Admin handbook: Offered as the alternative to the (non-image) alpine command, but it runs as otelcol and fails on any file owned by another uid with `Operation not permitted`. [defects, defects #117438]		highfixed-before-releaseheld review (review model)—
RSD-otelcol-8ced9da514
Admin handbook: Garbled instruction: `append: true` does not change owner or mode. [defects, defects #117439]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-db9b06fd32
Admin handbook: The /v1/traces|metrics|logs paths exist only on the HTTP receiver. [defects, defects #117440]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-8f217cced7
Admin handbook: Says the shipped configuration listens on loopback only; the shipped file binds 0.0.0.0. [defects, defects #117441]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-e9c214909c
Admin handbook: Sampling is not in the shipped pipelines. [defects, defects #117442]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-157e79e08a
Admin handbook: A customer who writes `otlp` for a no-op exporter gets the gRPC OTLP exporter. [defects, defects #117443]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-94e80d0b02
Admin handbook: Port list repeats 4318 and omits 13133. [defects, defects #117444]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-541f8ee239
Admin handbook: Contradicts the curated health_check fact and the same handbook's other sections. [defects, defects #117445]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-5af2cc5a41
Admin handbook: Same contradiction of the 503 behaviour. [defects, defects #117446]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-037a6016af
Admin handbook: Same contradiction of the 503 behaviour. [defects, defects #117447]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-f6c11a35f1
Admin handbook: Self-contradictory: the handbook itself runs the image as root. [defects, defects #117448]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-a7557b4cdd
Admin handbook: The health endpoint's JSON never contains those messages. [defects, defects #117449]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-0e389aee2a
Admin handbook: Puts zpages and self-metrics on port 1777. [defects, defects #117450]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-cd82a6995e
Admin handbook: Wrong ports; /debug/vars is not the self-metrics endpoint. [defects, defects #117451]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-5e68ca0c75
Admin handbook: Claims the loopback-bound ports become reachable from other containers when 'exposed'. [defects, defects #117452]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-9d97dcc182
Admin handbook: Describes the spike limit as extra allowance above 80%; the same paragraph then states a 60% soft limit. [defects, defects #117453]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-679b482839
Admin handbook: The sentence says 614 and 615 MiB for the same threshold. [defects, defects #117454]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-dbcfd7451e
Admin handbook: Example line does not match the format documented elsewhere. [defects, defects #117455]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-9ae0f64777
Database handbook: Stale component versions from the previous release contradict lines 156 and 2060. [defects, defects #117456]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-48c7229650
Database handbook: Reversed: names resolve only on user-defined networks. [defects, defects #117457]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-663bf42d34
Database handbook: False statement; contradicted by the handbook's own line 1718 example. [defects, defects #117458]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-8aadffd42c
Database handbook: The list under it includes /debug/pprof/ and /debug/vars, which port 55679 does not serve. [defects, defects #117459]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-08de5c337f
Database handbook: There is no /debug/pprof/cpu profile; the CPU profile is /debug/pprof/profile. [defects, defects #117460]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-96b0497a96
Database handbook: Points to the wrong setting; the pipeline prometheus exporter does not control port 8888. [defects, defects #117461]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-26cd5cb30c
Database handbook: Labels the 20% spike setting the 'soft limit' and then calls 60% the soft limit; line 1583 says refusal begins at 80%, contradicting 1584. [defects, defects #117462]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-67cd70c851
Database handbook: pprof and self-metrics ports are swapped. [defects, defects #117463]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-2aff2804b5
Database handbook: The command as written (no -i/-t) does not give an interactive shell; the same applies to the sample at line 1427. [defects, defects #117464]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-1e11741337
Admin handbook: Alternative TLS procedure fails: a key of mode 600 owned by the host user stays unreadable to uid 999 whatever owns the directory; contradicts the handbook's own line 1326. [defects, defects #123886]		highfixed-before-releaseheld review (review model)—
RSD-otelcol-3e356b45fb
Admin handbook: The grpc:// scheme is not an OTLP endpoint scheme; every other section (and the Operating facts api_base) uses http://<host>:4317 for gRPC. [defects, defects #123887]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-d00b9c7cec
Admin handbook: Mode 600 gives group and others no access; 'read-only to others' is false (the next sentences rely on the file being unreadable). [defects, defects #123888]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-6fa94e5035
Admin handbook: There is no 'remounting the container's network namespace'; sharing it is done with `--network container:<name>` when starting another container. [defects, defects #123889]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-ba92268725
Admin handbook: Contradicts the same section (line 2248 and the Memory facts): refusal begins at the soft limit (limit_percentage minus spike_limit_percentage, 60%), not at limit_percentage. [defects, defects #123890]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-c14e8c5de8
Database handbook: The HEALTHCHECK command omits `-o /dev/null`; the real one is `curl -fsS -o /dev/null http://127.0.0.1:13133/ || exit 1` (the handbook itself gives that form elsewhere). [defects, defects #123891]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-4118c5cc84
Database handbook: Same: the HEALTHCHECK command is quoted without `-o /dev/null` and `|| exit 1`. [defects, defects #123892]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-ba851386b4
Database handbook: Says refusal starts when limit_percentage (80%) is reached; the next bullet and the Operating facts say refusal starts at the 60% soft limit. [defects, defects #123893]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-3e9a0ad986
Database handbook: Garbled: the command that follows is identical to the previous example and still sets GOMEMLIMIT. [defects, defects #123894]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-731249d8e0
Database handbook: False for the volume the section is about: a fresh named volume mounted at /var/lib/otelcol inherits the image directory's owner otelcol:otelcol, so no chown is needed there (the handbook says so at… [defects, defects #123895]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-a4e6e57cfb
Database handbook: Publishing the port is irrelevant: other containers reach 13133 over the network (default bridge by IP too) without -p; contradicts line 1866 and the Operating facts. [defects, defects #123896]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-767ea3e23e
Admin handbook: Repeat of the round-2 finding, still present: the sentence and the alpine chown command that follows say a named volume at /var/lib/otelcol must be chowned. [defects, defects #124731]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-4cc4024637
Admin handbook: Same false premise as line 700, in the Data Directory Example. [defects, defects #124732]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-0b535c0515
Admin handbook: The documented run command also publishes 13133 (health check). [defects, defects #124733]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-e2358d61f2
Admin handbook: The quoted curl error is not what curl prints; it names the host that failed to resolve. [defects, defects #124734]		lowfixed-before-releaseheld review (review model)—
RSD-otelcol-d5b77eff62
Database handbook: Says refusal happens when 'the limit' is reached. [defects, defects #124735]		lowfixed-before-releaseheld review (review model)—

Verification

3 items not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:59a91de832a64a1aff37b7303e5053383dda6b83d81776710791b9d4f2d231e4 · published digest sha256:59a91de832a64a1aff37b7303e5053383dda6b83d81776710791b9d4f2d231e4 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 252) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 708 package_archive gate_result.g8.result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-28T01:16:29Z · failing Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • First own scan of the releaseA (at 2026-10-28T01:22:28Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-27T06:30:41Z) [image_scans, image_scans #1360]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-28T01:16:17Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [docs/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3627546033 · transparency-log entry · integrated 2026-11-01T10:58:10Z) [ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]

Offline clean-room rebuilds

  • 2026-10-27T17:43:10Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:59a91de832a64a1aff37b7303e5053383dda6b83d81776710791b9d4f2d231e4 [clean-room rebuild ledger, runs[477]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
  • Not recorded: the attestations' transparency-log entries (no attestation record in the release's workspace)
  • Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

2 items not recorded
  • Image pushed (internal tag), publish_image passed2026-10-27T16:43:55Z [stage_runs, stage_runs chain 708 stage publish_image]
  • Archive manifests written2026-10-28T01:18:14Z [PUBLISH_MANIFEST.json, published_at]
  • Archive cut over on prodasset, package_archive passed2026-10-28T01:22:17Z [stage_runs, stage_runs chain 708 stage package_archive]
  • Cut-over markerpresent (chain 708) [.cutover.json]
  • Not recorded: when the release tag was promoted (the promotion record in the archive was written before the promotion, and the release's workspace no longer holds this chain)
  • Not recorded: the site event's time (the release checklist is in the chain's workspace, which no longer holds this chain)

Packages and CPU level

Fully recorded
  • Packages in the image565 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 743 · probed 2026-11-02T17:07:40Z · source backfill) [release_images, isa_level_hard]

History

1 event
  • 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records

Records

23 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PROMOTION_RECORD.jsoninside the archive (ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.tar.gz)—
.cutover.jsonbeside the archive (prodasset /data/production/otelcol/v0.164.0-CE-ubuntu24.04-r1/)—
MANIFEST.jsonbeside the archive (prodasset /data/production/otelcol/v0.164.0-CE-ubuntu24.04-r1/)—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/otelcol/v0.164.0-CE-ubuntu24.04-r1/)—
ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/otelcol/v0.164.0-CE-ubuntu24.04-r1/)—
ReadyStack-otelcol-v0.164.0-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/otelcol/v0.164.0-CE-ubuntu24.04-r1/)—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/otelcol/v0.164.0-CE-ubuntu24.04-r1/)—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)386
chainssadb, ReadyStack's engine database (not published)708
defectssadb, ReadyStack's engine database (not published)otelcol v0.164.0-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 708
held_roundssadb, ReadyStack's engine database (not published)chain 708
image_scanssadb, ReadyStack's engine database (not published)1360
micro_step_runssadb, ReadyStack's engine database (not published)chain 708
release_imagessadb, ReadyStack's engine database (not published)otelcol v0.164.0-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 708
stage_runssadb, ReadyStack's engine database (not published)chain 708