Portainer 2.45.3-CE-ubuntu24.04-r1 build trail

• ProductPortainer (portainer) [MANIFEST.json]
• Release tag2.45.3-CE-ubuntu24.04-r1 [MANIFEST.json]
• Imagereadystack/portainer:2.45.3-CE-ubuntu24.04-r1 [MANIFEST.json]
• Image index digestsha256:ced8888be99cd55db0efe6913a5ea8b0face53310fa0b58fbd87671798d7b0a1 [docs/provenance/LOCKED_DIGEST.txt]
• linux/amd64 image digestsha256:a2cbe2d511c57174efe65263c59e63f50b081168921f328977e8665e8b3c9e34 [ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
• ArchiveReadyStack-portainer-2.45.3-CE-ubuntu24.04-r1.tar.gz (bytes 481108411) [MANIFEST.json]
• Archive sha256 at publishc5fa07330063029ee3117719fd58cee2fbf27889d957c54dd5d5c203007fcf20 [MANIFEST.json, repack_history[0].previous_tarball_sha256]
• Archive sha256 now20bd23d0df73ab420d0a32f53d1a4267a08783b1f6d6f25041070e3ea1a435d4 [MANIFEST.json, tarball_sha256]
• Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
• Repack history
  • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 c5fa07330063029ee3117719fd58cee2fbf27889d957c54dd5d5c203007fcf20 · sha256 20bd23d0df73ab420d0a32f53d1a4267a08783b1f6d6f25041070e3ea1a435d4 · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
  [MANIFEST.json, repack_history]
• Upstream repositoryhttps://github.com/portainer/portainer [docs/provenance/SOURCE_TREE_HASH.json]
• Upstream ref2.45.3 [docs/provenance/SOURCE_TREE_HASH.json]
• Upstream commit0fa764dc81c76bb7914d65d8e62b026d7c746899 [docs/provenance/SOURCE_TREE_HASH.json]
• Source tree hashfc0d8c88ba3ecea1aac3b366fe50414c75b27220c0ae5e1371033d834f8d0a93 (files 5387) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
• Kit tree hashsha256:1892c2597d6ac05a8ee9c30ff766ac98ff088a0c93cf65b1042ccfab75e88629 [ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
• SOURCE_DATE_EPOCH1792624796 (utc 2026-10-21T23:19:56Z) [ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
• Base images
  • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
  • ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
  [ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r1.rebuild.json, bases]
• BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r1.rebuild.json, engine]

• Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

• Chain707 (created 2026-10-27T16:07:43Z · trigger customer_request · upstream version 2.45.3) [chains, chains #707]
• Requestbuild request #383 (rebuild) (requested at 2026-10-27T04:38:31Z · requested by kitforge-agent · version 2.45.3) [build_requests, build_requests #383]
• Reasonretarget to 2.45.3: a newer upstream release (rule 1) [build_requests, build_requests #383 request_reason]
• Supersedesreadystack/portainer:2.45.2-CE-ubuntu24.04-r2 (chain 585) [chains, chains #585]

1 chain · 2 drives · 18 stages · 1 rewind

Stages, in order

[stage_runs]

Rewinds

• 2026-10-27T17:09:48Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #722]

• Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
• Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Role: writer model. Calls up to 2026-10-27T17:16:17Z.

6 calls over 3 stages

[micro_step_runs]

• Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
• Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
• Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Role: review model.

1 round, 1 counted, $0.45 recorded cost

• Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
• Not recorded: the round cap in force at each round (the state files did not keep it)

• Ledger entries2 [defects, defects where product_slug=portainer and this tag or chain]
• Disclosed in the archive2 [docs/defects/defects.json, entries]

2 ledger entries: by severity low 2; by status open 2.

• Reproduced before publishingyes (rebuilt digest sha256:a2cbe2d511c57174efe65263c59e63f50b081168921f328977e8665e8b3c9e34 · published digest sha256:a2cbe2d511c57174efe65263c59e63f50b081168921f328977e8665e8b3c9e34 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 153) [docs/provenance/REPRO_VERIFICATION.json, verified]
• Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 707 package_archive gate_result.g8.result]
• Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-27T17:10:34Z · failing Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
• First own scan of the releaseA (at 2026-10-27T17:16:27Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-27T06:30:41Z) [image_scans, image_scans #1346]
• Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-27T17:10:21Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
• Image signature transparency-log entries
  • log index 3521323262 · transparency-log entry
  • log index 3521324763 · transparency-log entry
  [docs/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
• rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3633115183 · transparency-log entry · integrated 2026-11-01T15:00:35Z) [ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]

Offline clean-room rebuilds

• 2026-10-27T16:36:34Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
  rebuilt sha256:a2cbe2d511c57174efe65263c59e63f50b081168921f328977e8665e8b3c9e34 [clean-room rebuild ledger, runs[475]]

• Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
• Not recorded: the attestations' transparency-log entries (no attestation record in the release's workspace)
• Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

• Image pushed (internal tag), publish_image passed2026-10-27T16:27:26Z [stage_runs, stage_runs chain 707 stage publish_image]
• Archive manifests written2026-10-27T17:12:13Z [PUBLISH_MANIFEST.json, published_at]
• Archive cut over on prodasset, package_archive passed2026-10-27T17:16:17Z [stage_runs, stage_runs chain 707 stage package_archive]
• Cut-over markerpresent (chain 707) [.cutover.json]

• Not recorded: when the release tag was promoted (the promotion record in the archive was written before the promotion, and the release's workspace no longer holds this chain)
• Not recorded: the site event's time (the release checklist is in the chain's workspace, which no longer holds this chain)

• Packages in the image425 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
• x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 743 · probed 2026-11-02T17:09:08Z · source backfill) [release_images, isa_level_hard]

• 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records