Paperless-ngx v3.4.1-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/paperlessngx:v3.4.1-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/paperlessngx:v3.4.1-CE-ubuntu24.04-r1
  • Index digestsha256:2fe11c61faf768fb097f1c553fba9b236d80a4596f756827528d6ff5a39c4feb
  • linux/amd64 digestsha256:85e31848a787e041c79a296adee5115eccd0ad800226cbe83e520e41584c1754
  • ArchiveReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 nowd0c6c67b6b5b27da7e774f19c618bb43e7e8e45757c74493131c14ffef93e1ab
  • Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
  • Sections9 sections, 4 fully recorded; 10 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.trail.json
ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.trail.jsonReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.trail.mdPaperless-ngx product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

1 item not recorded
  • ProductPaperless-ngx (paperlessngx) [MANIFEST.json]
  • Release tagv3.4.1-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/paperlessngx:v3.4.1-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:2fe11c61faf768fb097f1c553fba9b236d80a4596f756827528d6ff5a39c4feb [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:85e31848a787e041c79a296adee5115eccd0ad800226cbe83e520e41584c1754 [ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.tar.gz (bytes 2449706194) [MANIFEST.json]
  • Archive sha256 at publishd0c6c67b6b5b27da7e774f19c618bb43e7e8e45757c74493131c14ffef93e1ab [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/paperless-ngx/paperless-ngx [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv3.4.1 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitb67cfdf3fdfcde4883c4ac136c8545835f679d21 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashf0bda158ccfdec9da49c6c8e55f649135208b554b3653074858c364c3c3d0828 (files 1558) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:b320d021420b02e7c8e0a7c926c8f5b0c4ab9902a8a372cd6d7af6efc76e652f [ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793424031 (utc 2026-10-31T05:20:31Z) [ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded
  • Chain810 (created 2026-11-01T05:48:14Z · trigger customer_request · upstream version v3.4.1) [chains, chains #810]
  • Requestbuild request #486 (rebuild) (requested at 2026-11-01T02:08:59Z · requested by kitforge-agent · version v3.4.1) [build_requests, build_requests #486]
  • Reasonretarget to v3.4.1-CE-ubuntu24.04-r1: CPython CVE-2026-115557 rebuild (owner 2026-10-31) [build_requests, build_requests #486 request_reason]
  • Supersedesreadystack/paperlessngx:v3.3.4-CE-ubuntu24.04-r4 (chain 723) [chains, chains #723]

The path through the harness

2 items not recorded

1 chain · 6 drives · 18 stages · 3 rewinds

Chain 810 release · shipped

Created 2026-11-01T05:48:14Z, upstream v3.4.1, build request 486 [chains, chains #810]

DriveStartedMinutesBuild hostHow it stopped
72026-11-01T05:48:52Z126.1build host 3 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #7] rebuilt from a build line's log
102026-11-01T08:27:17Z32.5build host 3 withhold-publish ready_to_ship [drive_runs, drive_runs #10] rebuilt from a build line's log
132026-11-01T10:24:21Z17.4build host 3 withhold-publish ready_to_ship [drive_runs, drive_runs #13] rebuilt from a build line's log
152026-11-01T11:19:06Z2.2build host 3 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #15] rebuilt from a build line's log
162026-11-01T11:27:53Z18.1build host 3 withhold-publish ready_to_ship [drive_runs, drive_runs #16] rebuilt from a build line's log
182026-11-01T12:25:10Z25.2build host 3 publish-held shipped [drive_runs, drive_runs #18] rebuilt from a build line's log

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-01T05:48:57Z2026-11-01T05:48:58Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-11-01T05:49:03Z2026-11-01T05:49:04Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-11-01T05:49:32Z2026-11-01T05:49:32Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-11-01T06:20:23Z2026-11-01T06:20:24Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 —
remediate 2026-11-01T06:21:11Z2026-11-01T06:21:12Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 —
build_kit 2026-11-01T06:51:09Z2026-11-01T06:51:10Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 —
verdict 2026-11-01T06:58:06Z2026-11-01T06:58:07Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 —
publish_image 2026-11-01T07:03:21Z2026-11-01T07:03:22Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 —
boot_instance 2026-11-01T07:04:23Z2026-11-01T07:04:25Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 —
sbom 2026-11-01T07:06:02Z2026-11-01T07:06:03Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 —
schema_discovery 2026-11-01T07:06:04Z2026-11-01T07:06:05Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 —
admin_handbook 2026-11-01T07:17:42Z2026-11-01T07:17:43Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 —
db_handbook 2026-11-01T07:27:09Z2026-11-01T07:27:10Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 —
seed_data 2026-11-01T07:27:34Z2026-11-01T07:27:34Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 —
seed_validate 2026-11-01T07:27:36Z2026-11-01T07:27:37Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 —
usecase_validate 2026-11-01T07:28:10Z2026-11-01T07:28:11Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 —
finalize_docs 2026-11-01T07:41:33Z2026-11-01T07:41:34Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 —
package_archive 2026-11-01T07:54:55Z2026-11-01T12:50:19Z6
33 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 scout_grade_a
  • G8 script_copies
  • G8 three_way_sha
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 assetchain_coverage
 —

[stage_runs]

Rewinds

  • 2026-11-01T09:47:48Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2193]
  • 2026-11-01T11:13:34Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2194]
  • 2026-11-01T12:24:39Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #21]
  • Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
  • Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-11-01T12:50:19Z.

269 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook783903 not recordednot recorded —
db_handbook703003 not recordednot recorded —
usecase_validate2001 not recordednot recorded —
finalize_docs1155703 not recordednot recorded —

[micro_step_runs]

  • Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
  • Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

2 items not recorded

Role: review model.

3 rounds, 3 counted, $10.37 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-01T09:00:39Z 01723 findings to repackage [held_rounds, held_rounds #142] rebuilt from a held-review state file $3.75 not recorded not recorded
22026-11-01T10:42:33Z 0412 findings to repackage [held_rounds, held_rounds #143] rebuilt from a held-review state file $3.90 not recorded not recorded
32026-11-01T11:46:40Z 008 clean to publish [held_rounds, held_rounds #144] rebuilt from a held-review state file $2.73 not recorded not recorded
  • Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
  • Not recorded: the round cap in force at each round (the state files did not keep it)

Defects

Fully recorded
  • Ledger entries64 [defects, defects where product_slug=paperlessngx and this tag or chain]
  • Disclosed in the archive64 [docs/defects/defects.json, entries]

64 ledger entries: by severity high 21, low 43; by status fixed-before-release 64.

DefectSeverityStatusFound byFixed in
RSD-paperlessngx-6b3aaebe9e
Admin handbook: The documented install command fails as written: the image carries no apt package lists, so apt-get install alone cannot find the package. [defects, defects #149199]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-011d2928f2
Admin handbook: The documented install command fails as written: the image carries no apt package lists, so apt-get install alone cannot find the package. [defects, defects #149200]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-daea19cbc8
Admin handbook: The documented install command fails as written: the image carries no apt package lists, so apt-get install alone cannot find the package. [defects, defects #149201]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-f709a3db93
Admin handbook: The documented install command fails as written: the image carries no apt package lists, so apt-get install alone cannot find the package. [defects, defects #149202]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-8272d4baff
Admin handbook: Contradicts the handbook's own runtime-install instructions. [defects, defects #149203]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-deb778fb06
Admin handbook: Self-contradiction: tells the customer to build from the archive and then says the archive cannot add languages. [defects, defects #149204]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-358b58af90
Admin handbook: The sentence is false and contradicts the command printed right below it. [defects, defects #149205]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-362331a896
Admin handbook: Mixes two mechanisms; basic auth on the token endpoint does not return a token. [defects, defects #149206]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-5c5374dd99
Admin handbook: Contradicts line 879 (per IP address). [defects, defects #149207]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-4fea0416f0
Admin handbook: The data volume holds no consumption queue and the media volume no exports. [defects, defects #149208]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-eed5da6bac
Admin handbook: No consume volume exists in the documented deployment. [defects, defects #149209]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-62e92278ca
Admin handbook: Documents are in the media volume, not the data volume. [defects, defects #149210]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-5bc01b2f24
Admin handbook: Contradiction between the handbooks about where the SQLite file lives. [defects, defects #149211]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-044eaedbb6
Admin handbook: Contradicts the Operating facts instruction. [defects, defects #149212]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-04f57a58f3
Database handbook: The Quick Start paperlessngx.env block (lines 292-295) omits PAPERLESS_DBPASS, so a customer following it verbatim gets a container that exits at the first migration. [defects, defects #149213]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-50a9d71db4
Database handbook: As written the command writes to a host path and copies nothing into the container. [defects, defects #149214]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-c1e95e35d5
Database handbook: PAPERLESS_REDIS_URL is not read; a customer setting it keeps the default redis://localhost:6379 and the container waits for Redis forever. [defects, defects #149215]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-3ec0eee63f
Database handbook: Those variables do not exist in v3.4.1. [defects, defects #149216]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-f9094461be
Database handbook: Self-contradictory, the command fails without apt-get update, and 'or restarted' is false. [defects, defects #149217]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-0bff53603e
Database handbook: The documented install command fails as written: the image carries no apt package lists, so apt-get install alone cannot find the package. [defects, defects #149218]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-8182d66e0f
Database handbook: Contradicts line 1038 and the measured behaviour. [defects, defects #149219]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-5421b277d3
Database handbook: Names the wrong variables. [defects, defects #149220]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-90c5dbd326
Database handbook: Contradicts the 'rebuilt at every container start' statements. [defects, defects #149221]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-6d2410fc6c
Database handbook: Points to a procedure that does not exist. [defects, defects #149222]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-37ae140c4e
API guide: A monitoring script built from this section gets 401; the same guide's last section (line 2444) says authentication is required. [defects, defects #149223]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-0d55e16863
API guide: Same false claim. [defects, defects #149224]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-27e4a6813f
API guide: The example curl -s http://localhost:8000/api/status/ returns 401. [defects, defects #149225]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-a5047c1f62
API guide: Lists /api/status/ as public. [defects, defects #149226]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-7b7cd45cf5
API guide: Contradicts the 5-per-minute limit documented in many other places of the guide and measured. [defects, defects #149227]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-fb31e67574
API guide: Says the token endpoint is unthrottled. [defects, defects #149228]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-b0727e614a
API guide: PAPERLESS_TOKEN_THROTTLE_RATE is a configuration option and is documented at admin handbook line 347. [defects, defects #149229]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-b17c8c32d1
API guide: The example request as printed is rejected; the endpoint takes a JSON body. [defects, defects #149230]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-3c7c2f54b4
API guide: Wrong method list, contradicting lines 191/262/442. [defects, defects #149231]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-f84d7a3149
API guide: False claim. [defects, defects #149232]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-2b637a24ce
API guide: Contradiction. [defects, defects #149233]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-9a787079dc
API guide: Basic auth does not work on the token endpoint. [defects, defects #149234]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-b6bb729255
API guide: Contradicts the rest of the guide. [defects, defects #149235]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-eddbfb0280
API guide: Contradiction (per user vs per IP). [defects, defects #149236]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-0e5705a67a
API guide: Overstates data loss; contradicts the DB handbook. [defects, defects #149237]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-35151a8831
API guide: The example uses the admin-only endpoint for a self-service task. [defects, defects #149238]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-1b256e02be
API guide: Round-1 major repeated unchanged: the bullet describes HTTP Basic authentication as passing --data-urlencode username/password form fields. [defects, defects #149764]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-112dc1d20a
API guide: `tags__in` is not a filter of this API; unknown query parameters are silently ignored, so a customer filtering by tag gets every document back with a 200 and no error. [defects, defects #149765]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-024856055d
Database handbook: The check cannot succeed as written: a local image ID is the config digest, while BUILD_OFFLINE.sh prints the manifest digest. [defects, defects #149766]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-85e40e93f3
API guide: False as a general statement: sign-in attempts are rate-limited (allauth), so 'only the token endpoint is throttled' and 'web endpoints accept requests without limits' are wrong; a customer… [defects, defects #149767]		highfixed-before-releaseheld review (review model)—
RSD-paperlessngx-910cc1e5d5
API guide: 'Only' is false: the web sign-in has its own failed-login limit. [defects, defects #149768]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-bff1ac488e
API guide: Round-1 minor not corrected: Basic authentication does not work on the token endpoint (400), and the sentence contradicts line 2126 of the same guide. [defects, defects #149769]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-3bc3361938
API guide: Round-1 minor only half corrected: the heading and sentence are about updating your own profile, but the example below still PATCHes /api/users/{id}/ and says 'Replace {id} with your numeric user… [defects, defects #149770]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-2094ab376b
Admin handbook: A failing migration (wrong database password, unreachable schema) stops the container; it does not keep running with an unresponsive web server. [defects, defects #149771]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-fa1523b4ad
Admin handbook: There is no consume volume in the documented deployment; /usr/src/paperless/consume lives in the container's own filesystem. [defects, defects #149772]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-9c666dbe49
Database handbook: The folder is /usr/src/paperless/consume, not /consume. [defects, defects #149773]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-6d4afedec9
Database handbook: Contradicts the Data Storage and Search Index sections: the search index is not in PostgreSQL. [defects, defects #149774]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-142b6ba639
Database handbook: Contradicts the documented run command, which mounts a volume at /data. [defects, defects #149775]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-39148bb59e
Database handbook: Internal contradiction about the first-start time (55-70 s here, 'a few minutes' in Notes on the start command and Quick Start). [defects, defects #149776]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-4161fa6e7a
Admin handbook: An unauthenticated POST to the token endpoint does not succeed; it succeeds only with valid user name and password form fields. [defects, defects #149777]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-99bd31dadf
API guide: Contradicts the Operating facts and the measured behaviour: the command errors immediately and does not hang. [defects, defects #149778]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-0c3574b653
Database handbook: The Quick Start paperlessngx.env block still omits PAPERLESS_DBPASS. [defects, defects #149779]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-a1c7e08c85
API guide: Round-2 minor only half corrected: the example above is now the administrator PATCH of another user's account, but the sentence still tells the reader to use their own ID. [defects, defects #150804]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-81ebc88aba
API guide: Round-2 minor not corrected: 'token generation' is ambiguous. [defects, defects #150805]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-f48920b142
API guide: Residual of the round-2 throttling major: the paragraph above (line 1836) now names the web sign-in lockout, but this sentence still says every listed endpoint except the token endpoint has only… [defects, defects #150806]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-c3313d367a
API guide: Round-2 minor (first-start time contradiction) only fixed in the DB handbook: this guide gives 45-85 s for the first start, the Admin Handbook says 'a few minutes' (lines 323, 683, 722) and the DB… [defects, defects #150807]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-6535bf39b1
Admin handbook: Same first-start time contradiction inside the Admin Handbook: 55 to 105 s here and at lines 335, 407 and 936, 'a few minutes' / 'several minutes' at lines 323, 683, 722. [defects, defects #150808]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-595b3e3291
Database handbook: Self-contradictory, and contradicts line 115 ('You provide the PostgreSQL and Redis services') and the Operating facts: the customer must run both containers; without them the container never… [defects, defects #150809]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-adc6a8b337
Database handbook: Upstream's documentation describes SQLite as Paperless-ngx's default database, so 'undocumented' is false; the Admin Handbook (line 1797) says 'not intended for production use'. [defects, defects #150810]		lowfixed-before-releaseheld review (review model)—
RSD-paperlessngx-06455436f8
Admin handbook: Contradicts the DB handbook (lines 977-983: put PAPERLESS_OCR_LANGUAGE in paperlessngx.env and recreate the container to apply it). [defects, defects #150811]		lowfixed-before-releaseheld review (review model)—

Verification

2 items not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:85e31848a787e041c79a296adee5115eccd0ad800226cbe83e520e41584c1754 · published digest sha256:85e31848a787e041c79a296adee5115eccd0ad800226cbe83e520e41584c1754 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 810) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 810 package_archive gate_result.g8.result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-01T12:27:12Z · failing Docker Scout counts 214 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 204 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: fonts-urw-base35, ghostscript, jbig2dec, libgs-common, libgs10. · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • First own scan of the releaseA (at 2026-11-01T12:50:47Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-11-01T06:20:12Z) [image_scans, image_scans #1872]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-01T12:25:16Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3629998833 · transparency-log entry · integrated 2026-11-01T12:42:57Z) [ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:2fe11c61faf768fb097f1c553fba9b236d80a4596f756827528d6ff5a39c4feb · state attached · log index 3630008399 · transparency-log entry
    • kind sbom · digest sha256:2fe11c61faf768fb097f1c553fba9b236d80a4596f756827528d6ff5a39c4feb · state attached · log index 3630012693 · transparency-log entry
    • kind vsa · digest sha256:2fe11c61faf768fb097f1c553fba9b236d80a4596f756827528d6ff5a39c4feb · state attached · log index 3630017780 · transparency-log entry
    • kind provenance · digest sha256:85e31848a787e041c79a296adee5115eccd0ad800226cbe83e520e41584c1754 · state attached · log index 3630025309 · transparency-log entry
    • kind sbom · digest sha256:85e31848a787e041c79a296adee5115eccd0ad800226cbe83e520e41584c1754 · state attached · log index 3630032521 · transparency-log entry
    • kind vsa · digest sha256:85e31848a787e041c79a296adee5115eccd0ad800226cbe83e520e41584c1754 · state attached · log index 3630041786 · transparency-log entry
    (at 2026-11-01T12:42:58Z) [attestations.json, results]

Offline clean-room rebuilds

  • 2026-11-01T09:00:47Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:85e31848a787e041c79a296adee5115eccd0ad800226cbe83e520e41584c1754 [clean-room rebuild ledger, runs[574]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
  • Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

Fully recorded
  • Image pushed (internal tag), publish_image passed2026-11-01T07:03:22Z [stage_runs, stage_runs chain 810 stage publish_image]
  • Release tag promoted2026-11-01T12:47:00Z (method imagetools_create_retag_by_digest_no_rebuild · digest sha256:2fe11c61faf768fb097f1c553fba9b236d80a4596f756827528d6ff5a39c4feb · tag readystack/paperlessngx:v3.4.1-CE-ubuntu24.04-r1) [deliverables/provenance/PROMOTION_RECORD.json, promoted_at]
  • Archive manifests written2026-11-01T12:34:00Z [PUBLISH_MANIFEST.json, published_at]
  • Archive cut over on prodasset, package_archive passed2026-11-01T12:50:19Z [stage_runs, stage_runs chain 810 stage package_archive]
  • Cut-over markerpresent (chain 810) [.cutover.json]
  • Release checklist and site event2026-11-01T12:50:18Z (status complete · site event 308 · steps grade a verified done · release tag promoted done · cosign signed done · release evidence recorded done · contract gate passed done · archive published done · hub readme live done · reproducibility recorded done · defects ledger published done · catalog available done · build request fulfilled done · seo regenerated skipped · site catalogue refreshed done · site grade recorded done · site queue synced done · customer requests charged done · owners notified done) [deliverables/provenance/RELEASE_CHECKLIST.json, run_at]

Packages and CPU level

Fully recorded
  • Packages in the image530 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 1671 · probed 2026-11-02T17:01:57Z · source backfill) [release_images, isa_level_hard]

History

1 event
  • 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.tar.gz)—
.cutover.jsonbeside the archive (prodasset /data/production/paperlessngx/v3.4.1-CE-ubuntu24.04-r1/)—
MANIFEST.jsonbeside the archive (prodasset /data/production/paperlessngx/v3.4.1-CE-ubuntu24.04-r1/)—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/paperlessngx/v3.4.1-CE-ubuntu24.04-r1/)—
ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/paperlessngx/v3.4.1-CE-ubuntu24.04-r1/)—
ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/paperlessngx/v3.4.1-CE-ubuntu24.04-r1/)—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/paperlessngx/v3.4.1-CE-ubuntu24.04-r1/)—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)486
chainssadb, ReadyStack's engine database (not published)810
defectssadb, ReadyStack's engine database (not published)paperlessngx v3.4.1-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 810
held_roundssadb, ReadyStack's engine database (not published)chain 810
image_scanssadb, ReadyStack's engine database (not published)1872
micro_step_runssadb, ReadyStack's engine database (not published)chain 810
release_imagessadb, ReadyStack's engine database (not published)paperlessngx v3.4.1-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 810
stage_runssadb, ReadyStack's engine database (not published)chain 810
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/RELEASE_CHECKLIST.jsonthe chain's workspace on the controller (not published)—