Perl 5.44.0-CE-ubuntu24.04-r4 build trail
How ReadyStack built readystack/perl:5.44.0-CE-ubuntu24.04-r4 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/perl:5.44.0-CE-ubuntu24.04-r4 - Index digestsha256:c8df5fd0fe4b8f12f0ae88d5cdf6d8af65da899099fa8646028a8cd450a64faf
- linux/amd64 digestsha256:8055b0c2e843f7b108b9fe51d434cf406b8d1261d46a5122b2502fdb0b075884
- Archive
ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.tar.gz - Archive SHA-256 now520fc1328e89769bdb701d79f98927706540821cbb584c0d0b47f165cb624d11
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-12T22:21:46Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.trail.json.sigstore ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductPerl (perl) [MANIFEST.json]
- Release tag5.44.0-CE-ubuntu24.04-r4 [MANIFEST.json]
- Imagereadystack/perl:5.44.0-CE-ubuntu24.04-r4 [MANIFEST.json]
- Image index digestsha256:c8df5fd0fe4b8f12f0ae88d5cdf6d8af65da899099fa8646028a8cd450a64faf [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:8055b0c2e843f7b108b9fe51d434cf406b8d1261d46a5122b2502fdb0b075884 [ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.tar.gz (bytes 287313666) [MANIFEST.json]
- Archive sha256 at publish520fc1328e89769bdb701d79f98927706540821cbb584c0d0b47f165cb624d11 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/Perl/perl5 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv5.44.0 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commite634cc838fb1785dfafb5d13b52807ea16b5c52c [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash798436621305c697a963e9634f981a1392eb03308f55a9a7653150306e9182cc (files 6949) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:0d1509406536528eba0670be3935bb01a19c01bc9f6eeb6691ffeea498218a12 [ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794448290 (utc 2026-11-12T01:51:30Z) [ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.rebuild.json, engine]
- Engine commit(s)
- commit 89246b3fdf7ea046df3d0e48f836a371a0c3bdf9 · dirty yes · first drive 4472
- commit 9bf62fc46cb5a4c666ae0d83ee6d1056e96b052a · dirty yes · first drive 4482
Why this release exists
Fully recorded- Chain1039 (created 2026-11-12T21:17:27Z · trigger customer_request · upstream version 5.44.0) [chains, chains #1039]
- Requestbuild request #711 (rebuild) (requested at 2026-11-12T01:51:31Z · requested by kitforge-agent · version 5.44.0) [build_requests, build_requests #711]
- Reasonrevision 5.44.0-CE-ubuntu24.04-r4: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #711 request_reason]
- Supersedesreadystack/perl:5.44.0-CE-ubuntu24.04-r3 (chain 947) [chains, chains #947]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1039 release · ready_to_ship
Created 2026-11-12T21:17:27Z, upstream 5.44.0, build request 711 [chains, chains #1039]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4472 | 2026-11-12T21:17:51Z | 35.7 | build host 5 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4472] |
| 4482 | 2026-11-12T22:17:16Z | — | build host 5 publish-held | not recorded [drive_runs, drive_runs #4482] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-12T21:18:02Z | 2026-11-12T21:18:03Z | 1 | 4
|
order_json f3a4157bfcd7… |
acquire |
2026-11-12T21:18:12Z | 2026-11-12T21:18:13Z | 1 | 12
|
source_tree 618ff8fb0193…license_file 8979e6dd6185…custody_inputs c559aca865a8…source_tree_hash 552706f33749…source_file_manifest 6bb2d9f97283… |
plan |
2026-11-12T21:18:50Z | 2026-11-12T21:18:51Z | 1 | 10
|
recon_report 50869a0d5b93…input_pin_plan 02716dea1a14…toolchain_lock 156aff5e4c4e… |
assemble_kit |
2026-11-12T21:26:27Z | 2026-11-12T21:26:28Z | 1 | 27
|
dockerfile 7bafda98de77…build_recipe 22ea29b9d01c…system_pinning 9d43656b2e3e…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health cfca7832b569…verify_offline_sh 3e8184ea230c…base_image_digests e3890dfded90…dockerfile_offline 7bafda98de77…first_build_digest e2029f8fb058… |
remediate |
2026-11-12T21:27:07Z | 2026-11-12T21:27:08Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 9863e5afc838…security_report 51c5bca61c71… |
build_kit |
2026-11-12T21:40:35Z | 2026-11-12T21:40:36Z | 1 | 9
|
cosign_stamp 3db19fab71d7…locked_digest 12fa76a0cd8a…freeze_manifest 6b02e4bb4774…offline_rebuild_transcript 6eb365b13144… |
verdict |
2026-11-12T21:41:28Z | 2026-11-12T21:41:29Z | 1 | 8
|
scout_verdict 0337c0c40d5b… |
publish_image |
2026-11-12T21:42:13Z | 2026-11-12T21:42:14Z | 1 | 7
|
hub_readme 5e9e4bf561b6…promotion_record 8ec86e0ce88d… |
boot_instance |
2026-11-12T21:42:19Z | 2026-11-12T21:42:23Z | 2 | 3
|
instance_handle ad490d30f7eb… |
sbom |
2026-11-12T21:42:35Z | 2026-11-12T21:42:36Z | 1 | 5
|
sbom_md 334a76754819…sbom_json b9a95603318d… |
schema_discovery |
2026-11-12T21:42:39Z | 2026-11-12T21:42:39Z | 1 | 7
|
schema_hash 45711b00c1cd…dependency_tree e957fcf6dc95…table_classification 121a8d418097… |
admin_handbook |
2026-11-12T21:42:50Z | 2026-11-12T21:42:51Z | 1 | 7
|
api_map c0eb47c49503…admin_handbook efb32220dbb3… |
db_handbook |
2026-11-12T21:42:56Z | 2026-11-12T21:42:57Z | 1 | 8
|
db_handbook a1cca584ffc0…seed_isolation cb11f2184f37… |
seed_data |
2026-11-12T21:43:14Z | 2026-11-12T21:43:15Z | 1 | 6
|
seed_data_sql 61aa8c0ce4df…seed_cases_json d88905914968… |
seed_validate |
2026-11-12T21:43:18Z | 2026-11-12T21:43:19Z | 1 | 3
|
seed_data_contract cd39e87b8be1… |
usecase_validate |
2026-11-12T21:43:51Z | 2026-11-12T21:43:53Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 87c4f659c3fd…test_results 2c126f801353…usecase_contract c58a201b78f0… |
finalize_docs |
2026-11-12T21:44:00Z | 2026-11-12T21:44:01Z | 1 | 9
|
defects_json 02419f2a53fc…release_notes 9f99d11929ea…api_integration_guide 5b5a47b1be5c… |
package_archive invalidated 2026-11-12T22:16:48Z |
2026-11-12T21:53:28Z | 2026-11-12T21:53:30Z | 1 | 37 (final gate PASS)
|
sale_tar f497474199e4…checksums 47b026fe818d…verify_md 6bd68ff5a447…rebuild_md 7647fc57b8ac…manifest_txt 0727b399e97e…actions_jsonl fdbe61eeba52…provenance_md aeb72e59ed78…assetchain_log_md e9eccaec0c0f…assetchain_log_json ddc1fa60daec… |
[stage_runs]
Rewinds
- 2026-11-12T22:16:48Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #34700]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-12T21:53:30Z.
5 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 8874 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 11694 | L-A08, L-038, L-036, L-034, L-032 |
admin_handbook | 1 | 0 | 0 | 1 | 0 | 2707 | — |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.18 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-12T21:54:23Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1839] | $0.18 | 3 rounds, $40.00 | f497474199e4… |
Defects
Fully recorded- Ledger entries0 [defects, defects where product_slug=perl and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
0 ledger entries.
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:8055b0c2e843f7b108b9fe51d434cf406b8d1261d46a5122b2502fdb0b075884 · published digest sha256:8055b0c2e843f7b108b9fe51d434cf406b8d1261d46a5122b2502fdb0b075884 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 386) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T22:17:42Z · failing Docker Scout counts 85 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T22:17:27Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3840020148 · transparency-log entry
- log index 3840021080 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3840333396 · transparency-log entry · integrated 2026-11-12T22:20:34Z) [ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:c8df5fd0fe4b8f12f0ae88d5cdf6d8af65da899099fa8646028a8cd450a64faf · state attached · log index 3840334434 · transparency-log entry
- kind sbom · digest sha256:c8df5fd0fe4b8f12f0ae88d5cdf6d8af65da899099fa8646028a8cd450a64faf · state attached · log index 3840335199 · transparency-log entry
- kind vsa · digest sha256:c8df5fd0fe4b8f12f0ae88d5cdf6d8af65da899099fa8646028a8cd450a64faf · state attached · log index 3840336209 · transparency-log entry
- kind provenance · digest sha256:8055b0c2e843f7b108b9fe51d434cf406b8d1261d46a5122b2502fdb0b075884 · state attached · log index 3840337149 · transparency-log entry
- kind sbom · digest sha256:8055b0c2e843f7b108b9fe51d434cf406b8d1261d46a5122b2502fdb0b075884 · state attached · log index 3840337782 · transparency-log entry
- kind vsa · digest sha256:8055b0c2e843f7b108b9fe51d434cf406b8d1261d46a5122b2502fdb0b075884 · state attached · log index 3840338444 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/perl/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-12T21:54:27Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:8055b0c2e843f7b108b9fe51d434cf406b8d1261d46a5122b2502fdb0b075884 [clean-room rebuild ledger, runs[808]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-12T21:42:14Z [stage_runs, stage_runs chain 1039 stage publish_image]
- Archive manifests written2026-11-12T22:18:56Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 775 · probed 2026-11-12T21:33:53Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-12T22:21:46Z generated: by KitForge release/build_trail.py · generator commit 9bf62fc46cb5a4c666ae0d83ee6d1056e96b052a
- 2026-11-12T22:23:20Z publication: promoted at 2026-11-12T22:22:24Z · promoted digest sha256:c8df5fd0fe4b8f12f0ae88d5cdf6d8af65da899099fa8646028a8cd450a64faf · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 523 · checklist status complete · checklist at 2026-11-12T22:23:20Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/perl/5.44.0-CE-ubuntu24.04-r4/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/perl/5.44.0-CE-ubuntu24.04-r4/), as staged for publishing | — |
ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.rebuild.json | beside the archive (prodasset /data/production/perl/5.44.0-CE-ubuntu24.04-r4/), as staged for publishing | — |
ReadyStack-perl-5.44.0-CE-ubuntu24.04-r4.rebuild.json.sigstore | beside the archive (prodasset /data/production/perl/5.44.0-CE-ubuntu24.04-r4/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/perl/5.44.0-CE-ubuntu24.04-r4/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 711 |
chains | sadb, ReadyStack's engine database (not published) | 1039 |
defects | sadb, ReadyStack's engine database (not published) | perl 5.44.0-CE-ubuntu24.04-r4 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1039 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1039 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1039 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1039 |
release_images | sadb, ReadyStack's engine database (not published) | perl 5.44.0-CE-ubuntu24.04-r4 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1039 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1039 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |