Perl 5.44.0-CE-ubuntu24.04-r3 build trail
How ReadyStack built readystack/perl:5.44.0-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/perl:5.44.0-CE-ubuntu24.04-r3 - Index digestsha256:fb9b85c2e709101df0b2f3241c71e94bda2d051343cba109244ff70db93d35b6
- linux/amd64 digestsha256:0baaa953601bc09c29c87a8114acd7a5044e0975be469e4de9e521f9c60ab094
- Archive
ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.tar.gz - Archive SHA-256 now51a59cfa297bd7818089129e7f17bfe8d970f26fb544ba302329ef537383ee94
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-10T23:09:31Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductPerl (perl) [MANIFEST.json]
- Release tag5.44.0-CE-ubuntu24.04-r3 [MANIFEST.json]
- Imagereadystack/perl:5.44.0-CE-ubuntu24.04-r3 [MANIFEST.json]
- Image index digestsha256:fb9b85c2e709101df0b2f3241c71e94bda2d051343cba109244ff70db93d35b6 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:0baaa953601bc09c29c87a8114acd7a5044e0975be469e4de9e521f9c60ab094 [ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.tar.gz (bytes 281966892) [MANIFEST.json]
- Archive sha256 at publish51a59cfa297bd7818089129e7f17bfe8d970f26fb544ba302329ef537383ee94 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/Perl/perl5 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv5.44.0 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commite634cc838fb1785dfafb5d13b52807ea16b5c52c [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash798436621305c697a963e9634f981a1392eb03308f55a9a7653150306e9182cc (files 6949) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:f87118fbe8158ac53cceab2ceaf2054eaf483a24eda314949c7e6926e894ddca [ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794290163 (utc 2026-11-10T05:56:03Z) [ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.rebuild.json, engine]
- Engine commit(s)
- commit e3eaace0a74e1a10fea82b44f3849ea9a0e2216a · dirty yes · first drive 4154
- commit 0a6af7719aec340e33c4a2a58520b171192844a6 · dirty yes · first drive 4200
- commit e05220953a8a35bb19afca75bce1637a21d4c290 · dirty yes · first drive 4210
Why this release exists
Fully recorded- Chain947 (created 2026-11-10T06:16:55Z · trigger customer_request · upstream version 5.44.0) [chains, chains #947]
- Requestbuild request #627 (rebuild) (requested at 2026-11-10T06:02:16Z · requested by kitforge-agent · version 5.44.0) [build_requests, build_requests #627]
- Reasonrevision 5.44.0-CE-ubuntu24.04-r3: same upstream version re-dated by its own release (owner 2026-11-10 "date images correctly") [build_requests, build_requests #627 request_reason]
- Supersedesreadystack/perl:5.44.0-CE-ubuntu24.04-r2 (chain 850) [chains, chains #850]
The path through the harness
Fully recorded1 chain · 3 drives · 18 stages · 1 rewind
Chain 947 release · ready_to_ship
Created 2026-11-10T06:16:55Z, upstream 5.44.0, build request 627 [chains, chains #947]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4154 | 2026-11-10T06:17:17Z | 6.6 | build host 2 withhold-publish | stage_failed at assemble_kit; first failed check exists:first_build_digest; 4 ticks [drive_runs, drive_runs #4154] |
| 4200 | 2026-11-10T22:24:56Z | 28 | build host 2 withhold-publish | ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #4200] |
| 4210 | 2026-11-10T23:05:39Z | — | build host 2 publish-held | not recorded [drive_runs, drive_runs #4210] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-10T06:17:28Z | 2026-11-10T06:17:28Z | 1 | 4
|
order_json 1720874bf69d… |
acquire |
2026-11-10T06:17:38Z | 2026-11-10T06:17:39Z | 1 | 12
|
source_tree 618ff8fb0193…license_file 8979e6dd6185…custody_inputs c559aca865a8…source_tree_hash 552706f33749…source_file_manifest 6bb2d9f97283… |
plan |
2026-11-10T06:18:16Z | 2026-11-10T06:18:17Z | 1 | 10
|
recon_report 92ee038d09f9…input_pin_plan 7135ca22b78f…toolchain_lock 3c0275bf4ddb… |
assemble_kit |
2026-11-10T06:23:52Z | 2026-11-10T22:30:43Z | 2 | 27
|
dockerfile b16419fa5cdb…build_recipe da0297ea9e3d…system_pinning 9d43656b2e3e…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health 998b2c24689d…verify_offline_sh 3e8184ea230c…base_image_digests e3890dfded90…dockerfile_offline b16419fa5cdb…first_build_digest 79d920fdd26f… |
remediate |
2026-11-10T22:31:30Z | 2026-11-10T22:31:31Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log e0be329ff5a5…security_report b4c754dd512d… |
build_kit |
2026-11-10T22:41:14Z | 2026-11-10T22:41:14Z | 1 | 9
|
cosign_stamp dde4bba32e4a…locked_digest 8ab0b611ac32…freeze_manifest c57faf7d5af6…offline_rebuild_transcript eb6c1a194680… |
verdict |
2026-11-10T22:41:52Z | 2026-11-10T22:41:53Z | 1 | 8
|
scout_verdict 81bba9d2b052… |
publish_image |
2026-11-10T22:42:30Z | 2026-11-10T22:42:30Z | 1 | 7
|
hub_readme 4869375d6b3a…promotion_record 836a290367ec… |
boot_instance |
2026-11-10T22:42:35Z | 2026-11-10T22:42:39Z | 2 | 3
|
instance_handle 604ca5ff14ff… |
sbom |
2026-11-10T22:42:49Z | 2026-11-10T22:42:50Z | 1 | 5
|
sbom_md b6962667651d…sbom_json b9bb3950145c… |
schema_discovery |
2026-11-10T22:42:52Z | 2026-11-10T22:42:53Z | 1 | 7
|
schema_hash 45711b00c1cd…dependency_tree e957fcf6dc95…table_classification 121a8d418097… |
admin_handbook |
2026-11-10T22:43:02Z | 2026-11-10T22:43:02Z | 1 | 7
|
api_map c0eb47c49503…admin_handbook 3f9218e7b975… |
db_handbook |
2026-11-10T22:43:07Z | 2026-11-10T22:43:07Z | 1 | 8
|
db_handbook 5b358afa9292…seed_isolation cb11f2184f37… |
seed_data |
2026-11-10T22:43:23Z | 2026-11-10T22:43:24Z | 1 | 6
|
seed_data_sql 61aa8c0ce4df…seed_cases_json de0765c4f34b… |
seed_validate |
2026-11-10T22:43:27Z | 2026-11-10T22:43:28Z | 1 | 3
|
seed_data_contract 189ff5b3387b… |
usecase_validate |
2026-11-10T22:43:55Z | 2026-11-10T22:43:55Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 87c4f659c3fd…test_results 2c126f801353…usecase_contract 1b2242fc8b9f… |
finalize_docs |
2026-11-10T22:44:04Z | 2026-11-10T22:44:05Z | 1 | 9
|
defects_json 6dc5a6d59ab3…release_notes 294f81325086…api_integration_guide 513d879b830a… |
package_archive invalidated 2026-11-10T23:05:15Z |
2026-11-10T22:52:54Z | 2026-11-10T22:52:56Z | 1 | 35 (final gate PASS)
|
sale_tar d1ee24847c2b…checksums 401d5e609dd6…verify_md 324dc4371658…rebuild_md 6a47deeec616…manifest_txt 0766572777cc…actions_jsonl 4a2a65317b79…provenance_md b285440d2809…assetchain_log_md e9eccaec0c0f…assetchain_log_json b0e09f9bead7… |
[stage_runs]
Rewinds
- 2026-11-10T23:05:15Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30905]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-10T22:52:56Z.
5 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 9017 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 12712 | L-A08, L-038, L-036, L-034, L-032 |
admin_handbook | 1 | 0 | 0 | 1 | 0 | 2646 | — |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.17 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-10T22:54:52Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1706] | $0.17 | 3 rounds, $40.00 | d1ee24847c2b… |
Defects
Fully recorded- Ledger entries1 [defects, defects where product_slug=perl and this tag or chain]
- Disclosed in the archive1 [docs/defects/defects.json, entries]
1 ledger entry: by severity low 1; by status fixed-before-release 1.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-perl-b0ae6034ccAdmin handbook: The Environment section is empty: the table renders no rows although the image sets five variables (strategy runtime_env). [defects, defects #234188] | low | fixed-before-release | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:0baaa953601bc09c29c87a8114acd7a5044e0975be469e4de9e521f9c60ab094 · published digest sha256:0baaa953601bc09c29c87a8114acd7a5044e0975be469e4de9e521f9c60ab094 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 273) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-10T23:06:00Z · failing Docker Scout counts 85 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-10T23:05:49Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3795244351 · transparency-log entry
- log index 3795246122 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3795881688 · transparency-log entry · integrated 2026-11-10T23:08:23Z) [ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:fb9b85c2e709101df0b2f3241c71e94bda2d051343cba109244ff70db93d35b6 · state attached · log index 3795884137 · transparency-log entry
- kind sbom · digest sha256:fb9b85c2e709101df0b2f3241c71e94bda2d051343cba109244ff70db93d35b6 · state attached · log index 3795886171 · transparency-log entry
- kind vsa · digest sha256:fb9b85c2e709101df0b2f3241c71e94bda2d051343cba109244ff70db93d35b6 · state attached · log index 3795888640 · transparency-log entry
- kind provenance · digest sha256:0baaa953601bc09c29c87a8114acd7a5044e0975be469e4de9e521f9c60ab094 · state attached · log index 3795891424 · transparency-log entry
- kind sbom · digest sha256:0baaa953601bc09c29c87a8114acd7a5044e0975be469e4de9e521f9c60ab094 · state attached · log index 3795893573 · transparency-log entry
- kind vsa · digest sha256:0baaa953601bc09c29c87a8114acd7a5044e0975be469e4de9e521f9c60ab094 · state attached · log index 3795895744 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/perl/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-10T22:54:56Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:0baaa953601bc09c29c87a8114acd7a5044e0975be469e4de9e521f9c60ab094 [clean-room rebuild ledger, runs[735]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-10T22:42:30Z [stage_runs, stage_runs chain 947 stage publish_image]
- Archive manifests written2026-11-10T23:07:03Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 775 · probed 2026-11-10T22:36:26Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-10T23:09:31Z generated: by KitForge release/build_trail.py · generator commit e05220953a8a35bb19afca75bce1637a21d4c290
- 2026-11-10T23:10:43Z publication: promoted at 2026-11-10T23:10:00Z · promoted digest sha256:fb9b85c2e709101df0b2f3241c71e94bda2d051343cba109244ff70db93d35b6 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 452 · checklist status complete · checklist at 2026-11-10T23:10:43Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/perl/5.44.0-CE-ubuntu24.04-r3/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/perl/5.44.0-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.rebuild.json | beside the archive (prodasset /data/production/perl/5.44.0-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-perl-5.44.0-CE-ubuntu24.04-r3.rebuild.json.sigstore | beside the archive (prodasset /data/production/perl/5.44.0-CE-ubuntu24.04-r3/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/perl/5.44.0-CE-ubuntu24.04-r3/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 627 |
chains | sadb, ReadyStack's engine database (not published) | 947 |
defects | sadb, ReadyStack's engine database (not published) | perl 5.44.0-CE-ubuntu24.04-r3 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 947 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 947 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 947 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 947 |
release_images | sadb, ReadyStack's engine database (not published) | perl 5.44.0-CE-ubuntu24.04-r3 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 947 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 947 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |