Paperless-ngx v3.4.1-CE-ubuntu24.04-r3 build trail
How ReadyStack built readystack/paperlessngx:v3.4.1-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/paperlessngx:v3.4.1-CE-ubuntu24.04-r3 - Index digestsha256:e7e34edf84a221cf43fe292f9d57afac5114d28007a4e10deed6830928c5545f
- linux/amd64 digestsha256:39b20037974906d639869d1cdd3b41a9312b80ff11b134ee68f817abfc7b72a8
- Archive
ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.tar.gz - Archive SHA-256 now52d822d546f16ce27c93c1c49304d6b1b504e3682ec2b01f1b97f7927588310c
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-12T14:32:36Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductPaperless-ngx (paperlessngx) [MANIFEST.json]
- Release tagv3.4.1-CE-ubuntu24.04-r3 [MANIFEST.json]
- Imagereadystack/paperlessngx:v3.4.1-CE-ubuntu24.04-r3 [MANIFEST.json]
- Image index digestsha256:e7e34edf84a221cf43fe292f9d57afac5114d28007a4e10deed6830928c5545f [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:39b20037974906d639869d1cdd3b41a9312b80ff11b134ee68f817abfc7b72a8 [ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.tar.gz (bytes 2452555801) [MANIFEST.json]
- Archive sha256 at publish52d822d546f16ce27c93c1c49304d6b1b504e3682ec2b01f1b97f7927588310c [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/paperless-ngx/paperless-ngx [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv3.4.1 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commitb67cfdf3fdfcde4883c4ac136c8545835f679d21 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashf0bda158ccfdec9da49c6c8e55f649135208b554b3653074858c364c3c3d0828 (files 1558) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:0720da77dabcca31b01d5b66a9ddbcecbb15b22ea39c70ad49bccc474e3258ab [ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794391184 (utc 2026-11-11T09:59:44Z) [ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.rebuild.json, engine]
- Engine commit(s)
- commit 1d19e4172aaa5572a9c6ae1436e282185b7e6835 · dirty yes · first drive 4416
- commit d439f5fb4e2900022d4c2b52cfcb9e9af8fcc20a · dirty yes · first drive 4434
Why this release exists
Fully recorded- Chain1023 (created 2026-11-12T11:55:51Z · trigger customer_request · upstream version v3.4.1) [chains, chains #1023]
- Requestbuild request #675 (rebuild) (requested at 2026-11-11T09:59:46Z · requested by kitforge-agent · version v3.4.1) [build_requests, build_requests #675]
- Reasonrerelease agenda REVISION -> v3.4.1-CE-ubuntu24.04-r3 (decay loop, IMP-08) [build_requests, build_requests #675 request_reason]
- Supersedesreadystack/paperlessngx:v3.4.1-CE-ubuntu24.04-r2 (chain 889) [chains, chains #889]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1023 release · ready_to_ship
Created 2026-11-12T11:55:51Z, upstream v3.4.1, build request 675 [chains, chains #1023]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4416 | 2026-11-12T11:56:31Z | 112.4 | build host 3 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4416] |
| 4434 | 2026-11-12T14:12:18Z | — | build host 3 publish-held | not recorded [drive_runs, drive_runs #4434] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-12T11:56:41Z | 2026-11-12T11:56:42Z | 1 | 4
|
order_json df8a48abbab7… |
acquire |
2026-11-12T11:56:48Z | 2026-11-12T11:56:49Z | 1 | 12
|
source_tree 4178654137f3…license_file d62f065830aa…custody_inputs 94b07a7e5264…source_tree_hash ada7d70a8740…source_file_manifest 69db9887ae5d… |
plan |
2026-11-12T11:57:22Z | 2026-11-12T11:57:22Z | 1 | 10
|
recon_report 05b9d12a2485…input_pin_plan ea0692daa0e2…toolchain_lock 34c2a7a4c938… |
assemble_kit |
2026-11-12T12:29:05Z | 2026-11-12T12:29:06Z | 1 | 27
|
dockerfile d29c292e3f7d…build_recipe 5c716d4ff709…system_pinning 01ba4719c80b…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health 7b97683428e7…verify_offline_sh 3e8184ea230c…base_image_digests d119481183e4…dockerfile_offline d29c292e3f7d…first_build_digest 9a4e2d49f967… |
remediate |
2026-11-12T12:29:57Z | 2026-11-12T12:29:57Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 3cc8c606bec6…security_report 51541a9a21ab… |
build_kit |
2026-11-12T12:58:56Z | 2026-11-12T12:58:58Z | 1 | 9
|
cosign_stamp 667e84ef70c3…locked_digest 5df31196e71e…freeze_manifest 7cabcce53228…offline_rebuild_transcript 3d18c1f88732… |
verdict |
2026-11-12T13:10:41Z | 2026-11-12T13:10:42Z | 1 | 8
|
scout_verdict f53480de13ea… |
publish_image |
2026-11-12T13:14:54Z | 2026-11-12T13:14:55Z | 1 | 7
|
hub_readme f506cd134613…promotion_record 09b087daf2c6… |
boot_instance |
2026-11-12T13:15:57Z | 2026-11-12T13:16:00Z | 2 | 3
|
instance_handle 65d76e02081b… |
sbom |
2026-11-12T13:17:41Z | 2026-11-12T13:17:41Z | 1 | 5
|
sbom_md 972e19eafe69…sbom_json cefa4a8e83b3… |
schema_discovery |
2026-11-12T13:17:44Z | 2026-11-12T13:17:45Z | 1 | 7
|
schema_hash 4dfc3b7cae3b…dependency_tree 15e293ecbc78…table_classification f42640c4dcea… |
admin_handbook |
2026-11-12T13:17:51Z | 2026-11-12T13:17:52Z | 1 | 7
|
api_map 113e0fe1a605…admin_handbook 5cee6e3bc1a1… |
db_handbook |
2026-11-12T13:17:59Z | 2026-11-12T13:18:00Z | 1 | 8
|
db_handbook e341cc9adf21…seed_isolation 659c5035d18f… |
seed_data |
2026-11-12T13:18:24Z | 2026-11-12T13:18:25Z | 1 | 6
|
seed_data_sql cc049929728b…seed_cases_json 4d4022651e04… |
seed_validate |
2026-11-12T13:18:27Z | 2026-11-12T13:18:28Z | 1 | 3
|
seed_data_contract aaa9c265114f… |
usecase_validate |
2026-11-12T13:19:00Z | 2026-11-12T13:19:01Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 1ff1a76bd3b6…test_results 77aa878894fc…usecase_contract 027de0ba7c88… |
finalize_docs |
2026-11-12T13:19:07Z | 2026-11-12T13:19:08Z | 1 | 9
|
defects_json 3f388545aaec…release_notes bf4f3f595af4…api_integration_guide cea4429ab2d6… |
package_archive invalidated 2026-11-12T14:11:37Z |
2026-11-12T13:48:51Z | 2026-11-12T13:48:57Z | 1 | 37 (final gate PASS)
|
sale_tar c237823472f0…checksums 86944064cdb8…verify_md 4817315c3faa…rebuild_md 25388b747a2e…manifest_txt b0d414deddd1…actions_jsonl ff6da7ad3bb5…provenance_md 7439216575e4…assetchain_log_md e9eccaec0c0f…assetchain_log_json 5ff60474115e… |
[stage_runs]
Rewinds
- 2026-11-12T14:11:37Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33940]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-12T13:48:57Z.
5 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 6018 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 10291 | L-A08, L-038, L-036, L-034, L-032 |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 2037 | — |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.31 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-12T13:50:29Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1819] | $0.31 | 3 rounds, $40.00 | c237823472f0… |
Defects
Fully recorded- Ledger entries0 [defects, defects where product_slug=paperlessngx and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
0 ledger entries.
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:39b20037974906d639869d1cdd3b41a9312b80ff11b134ee68f817abfc7b72a8 · published digest sha256:39b20037974906d639869d1cdd3b41a9312b80ff11b134ee68f817abfc7b72a8 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 830) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T14:14:23Z · failing Docker Scout counts 214 packages with copyleft licences (AGPL, GPL, LGPL, MPL), 204 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). AGPL: fonts-urw-base35, ghostscript, jbig2dec, libgs-common, libgs10.) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T14:12:28Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3832935183 · transparency-log entry
- log index 3832936742 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3834089714 · transparency-log entry · integrated 2026-11-12T14:30:12Z) [ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:e7e34edf84a221cf43fe292f9d57afac5114d28007a4e10deed6830928c5545f · state attached · log index 3834093114 · transparency-log entry
- kind sbom · digest sha256:e7e34edf84a221cf43fe292f9d57afac5114d28007a4e10deed6830928c5545f · state attached · log index 3834094247 · transparency-log entry
- kind vsa · digest sha256:e7e34edf84a221cf43fe292f9d57afac5114d28007a4e10deed6830928c5545f · state attached · log index 3834095704 · transparency-log entry
- kind provenance · digest sha256:39b20037974906d639869d1cdd3b41a9312b80ff11b134ee68f817abfc7b72a8 · state attached · log index 3834097562 · transparency-log entry
- kind sbom · digest sha256:39b20037974906d639869d1cdd3b41a9312b80ff11b134ee68f817abfc7b72a8 · state attached · log index 3834098970 · transparency-log entry
- kind vsa · digest sha256:39b20037974906d639869d1cdd3b41a9312b80ff11b134ee68f817abfc7b72a8 · state attached · log index 3834100617 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/paperlessngx/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-12T13:50:43Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:39b20037974906d639869d1cdd3b41a9312b80ff11b134ee68f817abfc7b72a8 [clean-room rebuild ledger, runs[793]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-12T13:14:55Z [stage_runs, stage_runs chain 1023 stage publish_image]
- Archive manifests written2026-11-12T14:21:14Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 1671 · probed 2026-11-12T12:44:48Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-12T14:32:36Z generated: by KitForge release/build_trail.py · generator commit 4ec06344cf47f5b6c4f1894a79db5611e589923c
- 2026-11-12T14:36:47Z publication: promoted at 2026-11-12T14:33:42Z · promoted digest sha256:e7e34edf84a221cf43fe292f9d57afac5114d28007a4e10deed6830928c5545f · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 510 · checklist status complete · checklist at 2026-11-12T14:36:47Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/paperlessngx/v3.4.1-CE-ubuntu24.04-r3/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/paperlessngx/v3.4.1-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.rebuild.json | beside the archive (prodasset /data/production/paperlessngx/v3.4.1-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-paperlessngx-v3.4.1-CE-ubuntu24.04-r3.rebuild.json.sigstore | beside the archive (prodasset /data/production/paperlessngx/v3.4.1-CE-ubuntu24.04-r3/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/paperlessngx/v3.4.1-CE-ubuntu24.04-r3/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 675 |
chains | sadb, ReadyStack's engine database (not published) | 1023 |
defects | sadb, ReadyStack's engine database (not published) | paperlessngx v3.4.1-CE-ubuntu24.04-r3 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1023 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1023 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1023 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1023 |
release_images | sadb, ReadyStack's engine database (not published) | paperlessngx v3.4.1-CE-ubuntu24.04-r3 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1023 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1023 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |