Portainer 2.45.3-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/portainer:2.45.3-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/portainer:2.45.3-CE-ubuntu24.04-r2
  • Index digestsha256:075e7d9c83a5aaaddccbbcbd06419d2708f07fb72541e9b39a17bfaf7df18246
  • linux/amd64 digestsha256:a490310f9ea1e569bdbc7198b726c81ac3c186580a069f8ebf85a6bba1d28ad4
  • ArchiveReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now9105c96018f4328bbc8538fa3b82f31f390b94987e48a132b1055559cfa35dc4
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-08T12:07:22Z by KitForge release/build_trail.py
  • Sections9 sections, 7 fully recorded; 2 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.trail.json
ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.trail.jsonReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.trail.mdPortainer product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductPortainer (portainer) [MANIFEST.json]
  • Release tag2.45.3-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/portainer:2.45.3-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:075e7d9c83a5aaaddccbbcbd06419d2708f07fb72541e9b39a17bfaf7df18246 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:a490310f9ea1e569bdbc7198b726c81ac3c186580a069f8ebf85a6bba1d28ad4 [ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.tar.gz (bytes 490873264) [MANIFEST.json]
  • Archive sha256 at publish9105c96018f4328bbc8538fa3b82f31f390b94987e48a132b1055559cfa35dc4 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/portainer/portainer [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref2.45.3 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit0fa764dc81c76bb7914d65d8e62b026d7c746899 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashfc0d8c88ba3ecea1aac3b366fe50414c75b27220c0ae5e1371033d834f8d0a93 (files 5387) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:b8f039be76dcce8f331ea4234e24a67c7707254d92bbfcc721b66674f1748886 [ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1792624796 (utc 2026-10-21T23:19:56Z) [ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit ff3112bd2cb03ee39fd394ed644a9522854803de · dirty yes · first drive 3489
    • commit 1965bb7c468fd301b7164e27ef82448632bd34f4 · dirty yes · first drive 3644
    • commit 3d32cc1dd39bba72d2a0135dfa6216cfa284f64a · dirty yes · first drive 3770
    • commit 3f293445cabe810db9516d3ae7007081f497c8ca · dirty yes · first drive 3787
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain737 (created 2026-10-28T00:03:55Z · trigger customer_request · upstream version 2.45.3) [chains, chains #737]
  • Requestbuild request #421 (rebuild) (requested at 2026-10-27T20:11:04Z · requested by kitforge-agent · version 2.45.3) [build_requests, build_requests #421]
  • Reasonrevision 2.45.3-CE-ubuntu24.04-r2: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #421 request_reason]
  • Supersedesreadystack/portainer:2.45.3-CE-ubuntu24.04-r1 (chain 707) [chains, chains #707]

The path through the harness

Fully recorded

1 chain · 7 drives · 18 stages · 6 rewinds

Chain 737 release · ready_to_ship

Created 2026-10-28T00:03:55Z, upstream 2.45.3, build request 421 [chains, chains #737]

DriveStartedMinutesBuild hostHow it stopped
4592026-10-28T00:04:19Z39.6build host 2 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #459] rebuilt from a build line's log
4602026-10-28T00:47:34Z6.8build host 2 withhold-publish ready_to_ship [drive_runs, drive_runs #460] rebuilt from a build line's log
4632026-10-28T01:26:15Z3.4build host 2 withhold-publish ready_to_ship [drive_runs, drive_runs #463] rebuilt from a build line's log
34892026-11-03T09:47:06Z18.6build host 2 withhold-publish stage_failed at package_archive; first failed check g8; 15 ticks [drive_runs, drive_runs #3489]
36442026-11-07T10:49:16Z16.7build host 2 withhold-publish stage_failed at verdict; first failed check scout_verdict:release_check_passed; 4 ticks [drive_runs, drive_runs #3644]
37702026-11-08T11:04:19Z25.6build host 2 withhold-publish ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #3770]
37872026-11-08T12:02:23Z—build host 2 publish-held not recorded [drive_runs, drive_runs #3787]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-28T00:04:24Z2026-10-28T00:04:25Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-28T00:04:29Z2026-10-28T00:04:30Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-28T00:05:42Z2026-10-28T00:05:43Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-28T00:15:12Z2026-11-08T11:14:16Z4
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile cb063cc8c70c…
build_recipe 0a552952ebac…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 4527dc258961…
verify_offline_sh 3e8184ea230c…
base_image_digests 93df12635857…
dockerfile_offline cb063cc8c70c…
first_build_digest 25e6a0bfbd04…
remediate 2026-10-28T00:16:25Z2026-11-08T11:14:21Z4
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 21c377da0eba…
security_report e8062aaa8112…
build_kit 2026-10-28T00:22:13Z2026-11-08T11:20:24Z4
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 45d439c9da3b…
locked_digest 28d141d0bf98…
freeze_manifest a21e0f772652…
offline_rebuild_transcript cc20a713d0e4…
verdict 2026-10-28T00:22:55Z2026-11-08T11:21:31Z4
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 6456f85b2714…
publish_image 2026-10-28T00:23:29Z2026-11-08T11:22:03Z3
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme f94df0d9050c…
promotion_record bd37a1d8ca75…
boot_instance 2026-10-28T00:23:35Z2026-11-08T11:22:15Z6
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle d327d663c0fd…
sbom 2026-10-28T00:23:47Z2026-11-08T11:22:27Z3
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 9660a505c247…
sbom_json f5a486515758…
schema_discovery 2026-10-28T00:23:50Z2026-11-08T11:22:31Z3
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 764d84f328e3…
dependency_tree 9d20b1e37a93…
table_classification 8f322d8c44ce…
admin_handbook 2026-10-28T00:32:36Z2026-11-08T11:22:39Z3
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 6f47067753bf…
admin_handbook 67a9892f8f74…
db_handbook 2026-10-28T00:41:50Z2026-11-08T11:22:50Z3
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 8ba5b583c197…
seed_isolation 5d27f5c38139…
seed_data 2026-10-28T00:41:57Z2026-11-08T11:22:59Z3
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql f02025cd56e1…
seed_cases_json df05517a34a8…
seed_validate 2026-10-28T00:42:00Z2026-11-08T11:23:03Z3
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 145f2129b93c…
usecase_validate 2026-10-28T00:42:26Z2026-11-08T11:23:16Z3
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 42184651b3fe…
test_results c56e003580df…
usecase_contract e2ad9ac3a4f8…
finalize_docs 2026-10-28T00:42:32Z2026-11-08T11:23:24Z3
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 7580d8753821…
release_notes 06d038af0e3e…
api_integration_guide 8c2e3a840bbb…
package_archive invalidated 2026-11-08T12:01:59Z 2026-10-28T00:43:51Z2026-11-08T11:29:54Z5
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar a096a34f6d9c…
checksums 279e3ba9041b…
verify_md 999633cf38ef…
rebuild_md d71a99d763e8…
manifest_txt ead184da7c1a…
actions_jsonl 2f0ed4c08c72…
provenance_md 07b37ad6db25…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 96b358b94cd8…

[stage_runs]

Rewinds

  • 2026-10-28T01:18:22Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2199]
  • 2026-11-03T09:45:33Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive --allow-rebuild) [stage_events, stage_events #22418]
  • 2026-11-03T09:47:10Z: package_archive to assemble_kit on strategy_changed (strategy changed (dbb0e1a10e3d -> 205ad0f773fd)) [stage_events, stage_events #22433]
  • 2026-11-07T10:49:19Z: package_archive to assemble_kit on strategy_changed (strategy changed (205ad0f773fd -> ff2969f0a1ad)) [stage_events, stage_events #24596]
  • 2026-11-08T11:04:23Z: verdict to assemble_kit on strategy_changed (strategy changed (ff2969f0a1ad -> 987e8052cb3d)) [stage_events, stage_events #25939]
  • 2026-11-08T12:01:59Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26088]

Model work per stage

1 item not recorded

Role: writer model. Calls up to 2026-11-08T11:29:54Z.

103 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook491503 not recordednot recorded —
db_handbook471203 not recordednot recorded —
usecase_validate3001 01619 —

[micro_step_runs]

  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $7.11 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-10-28T00:55:57Z 23517 findings to repackage [held_rounds, held_rounds #147] rebuilt from a held-review state file $2.86 not recorded not recorded
22026-10-28T01:30:17Z 0014 clean to tests_broken [held_rounds, held_rounds #148] rebuilt from a held-review state file $2.54 not recorded 08083047d339…
32026-11-08T11:30:52Z 004 clean to publish [held_rounds, held_rounds #1507] $1.71 3 rounds, $40.00 a096a34f6d9c…

Defects

Fully recorded
  • Ledger entries58 [defects, defects where product_slug=portainer and this tag or chain]
  • Disclosed in the archive50 [docs/defects/defects.json, entries]

58 ledger entries: by severity low 44, critical 9, high 5; by status open 1, fixed-before-release 49, fixed-in-release 8.

DefectSeverityStatusFound byFixed in
RSD-portainer-6f521b53ff
Release notes: Claims a tested run of BUILD_OFFLINE.sh and VERIFY_OFFLINE.sh from the archive; the cited record shows only the rebuilt-digest comparison. [defects, defects #124073]		lowopenheld review (review model)—
RSD-portainer-2200114baa
Admin handbook: The documented command runs `tar` as the image ENTRYPOINT, but the chiselled r2 image has no tar (IMAGE_BINARIES.txt). [defects, defects #124987]		criticalfixed-before-releaseheld review (review model)—
RSD-portainer-efbfef3683
Admin handbook: The documented restore runs `tar xf` with --entrypoint tar, which does not exist in the r2 image, so the restore cannot be performed (the volume has already been removed and recreated empty at this… [defects, defects #124988]		criticalfixed-before-releaseheld review (review model)—
RSD-portainer-4017310c41
Admin handbook: The documented ownership repair runs --entrypoint chown, which does not exist in the r2 image (IMAGE_BINARIES.txt). [defects, defects #124989]		criticalfixed-before-releaseheld review (review model)—
RSD-portainer-35d222d71e
Admin handbook: The documented command runs `tar` as the image ENTRYPOINT, but the chiselled r2 image has no tar (IMAGE_BINARIES.txt). [defects, defects #124990]		criticalfixed-before-releaseheld review (review model)—
RSD-portainer-2ac5a17731
Admin handbook: Sentence describes the tar command that does not exist in the image. [defects, defects #124991]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-d73c8be96a
Admin handbook: The documented restore runs `tar xf` with --entrypoint tar, which does not exist in the r2 image, so the restore cannot be performed (the volume has already been removed and recreated empty at this… [defects, defects #124992]		criticalfixed-before-releaseheld review (review model)—
RSD-portainer-7432bed620
Admin handbook: The documented ownership repair runs --entrypoint chown, which does not exist in the r2 image (IMAGE_BINARIES.txt). [defects, defects #124993]		criticalfixed-before-releaseheld review (review model)—
RSD-portainer-05a5b894d0
Admin handbook: The paragraph describes tar commands that do not run on this image. [defects, defects #124994]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-819dfd6de2
Admin handbook: The documented command runs `tar` as the image ENTRYPOINT, but the chiselled r2 image has no tar (IMAGE_BINARIES.txt). [defects, defects #124995]		criticalfixed-before-releaseheld review (review model)—
RSD-portainer-6ec67d56d9
Admin handbook: Describes the tar-in-image command that does not run. [defects, defects #124996]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-4c46caa7b1
Admin handbook: Refers to the nonexistent tar restore command. [defects, defects #124997]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-374a37408d
Database handbook: Describes tar commands that do not run on this image. [defects, defects #124998]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-47ef1f4c89
Database handbook: The 'for example' command creates a tarball with a tar that this image does not contain; the next paragraph also says tar can be run with --entrypoint. [defects, defects #124999]		criticalfixed-before-releaseheld review (review model)—
RSD-portainer-1565e73d83
Database handbook: Command fails (no tar in the image) and the sentence says the backup is taken while Portainer runs, but the command stops it. [defects, defects #125000]		criticalfixed-before-releaseheld review (review model)—
RSD-portainer-e4bbf1c0da
Admin handbook: The example is presented as avoiding host ownership, but a root tar extract keeps the archive's uid (measured 1000), leaving files Portainer (uid 999) cannot write. [defects, defects #125001]		highfixed-before-releaseheld review (review model)—
RSD-portainer-11f113905f
Admin handbook: Misdescribes what POST /api/restore does. [defects, defects #125002]		highfixed-before-releaseheld review (review model)—
RSD-portainer-9e6364d5b5
Database handbook: Credential-change procedure is wrong: the admin cannot set another user's password through /passwd without the current password. [defects, defects #125003]		highfixed-before-releaseheld review (review model)—
RSD-portainer-6f521e0d08
Admin handbook: The example starts /bin/bash, which the image does not contain (also contradicts the handbook's own statement that it has no bash). [defects, defects #125004]		highfixed-before-releaseheld review (review model)—
RSD-portainer-09c233c94e
Database handbook: Tells the customer a backup utility or the reset helper can be run with docker exec in this image; neither exists there. [defects, defects #125005]		highfixed-before-releaseheld review (review model)—
RSD-portainer-03d7947b69
Admin handbook: Wrong interval. [defects, defects #125006]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-f7050b5057
Admin handbook: Tells the customer to use `id`, which is not in the image. [defects, defects #125007]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-cea989ccab
Database handbook: Tells the customer to use `id`, which is not in the image. [defects, defects #125008]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-d14882237a
Admin handbook: The example labelled as failing is a valid command; the failing form is not shown. [defects, defects #125009]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-09404d2918
Admin handbook: Says the frontend is built offline with vendored pnpm/webpack; the offline build runs neither. [defects, defects #125010]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-bb13ad4205
Admin handbook: This image declares 8000/tcp too. [defects, defects #125011]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-f86f9104dd
Admin handbook: Same error as the table row. [defects, defects #125012]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-1a940c9466
Database handbook: Cross-section contradiction. [defects, defects #125013]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-88032a76ae
Database handbook: Restore is not available after the timeout. [defects, defects #125014]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-61e5305aca
Database handbook: Portainer exits with code 2 on SIGTERM; 'cleanly' misleads anyone checking the exit status or a Restart policy. [defects, defects #125015]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-3356cd9abd
Database handbook: Contradicts the handbook's statement of the shell and coreutils. [defects, defects #125016]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-8a82269e5a
Release notes: The release notes say the unexercised check named a path that is not part of the product's API; /api/system/status is a real route (the check ran after the timeout and got 303). [defects, defects #125017]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-9a703f4b6a
Admin handbook: This image declares 8000/tcp too; the table says it declares only 9000 and 9443. [defects, defects #126346]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-44456076fc
Admin handbook: Same port error as the table row, still present after round 1. [defects, defects #126347]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-3177c16768
Admin handbook: 'The layouts differ' contradicts the table on the same page: the data path is /data in both images. [defects, defects #126348]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-05cfcbd692
Database handbook: The command shown at DB_HANDBOOK.md:1236 (`docker exec portainer /bin/sh`, also :1214) has no -i/-t, so it opens no shell. [defects, defects #126349]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-39197ab095
Database handbook: Without -it the shell gets no terminal and exits immediately. [defects, defects #126350]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-41d0436b50
Database handbook: The example under 'docker run --entrypoint <program>' is not an --entrypoint command. [defects, defects #126351]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-518284252d
Database handbook: Uses tar as the example program although the image has no tar, so `--entrypoint tar` would fail too. [defects, defects #126352]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-8fadeedd68
Admin handbook: Says restoring with `docker cp` leaves wrong ownership and the Fix tells the customer to avoid it, contradicting the documented docker cp restore, which keeps owner 999 (run end to end). [defects, defects #126353]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-649ca1c8ed
Admin handbook: Recommends replacing the docker cp restore with an alpine tar stream, contradicting the verified restore. [defects, defects #126354]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-dd7cd37431
Admin handbook: For a fresh host directory the quoted error is not the one Portainer prints. [defects, defects #126355]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-2c41aae25d
Admin handbook: Says the backup fails with Permission denied; the documented backup is docker cp, which is not blocked, as the same handbook says at 'Troubleshooting Backup and Restore'. [defects, defects #126356]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-3165c435f7
Database handbook: Implies that with an administrator the page is only for authenticated users; it is served to anyone. [defects, defects #126357]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-a4299e3fc2
Database handbook: Credentials are per user; they are not issued only by the administrator account. [defects, defects #126358]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-163c8be861
Release notes: The route is part of the product's API; round-1 finding not corrected. [defects, defects #126359]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-73c997e371
Admin handbook: The example /api/status response still shows the previous upstream version, contradicting the same handbook's Health check section. [defects, defects #175427]		lowfixed-in-releaseheld review (review model)2.45.3-CE-ubuntu24.04-r2
RSD-portainer-f5dd72060c
API guide: Troubleshooting maps 401 to an invalid, revoked or missing key and 403 to a valid key without permission. [defects, defects #175428]		lowfixed-in-releaseheld review (review model)2.45.3-CE-ubuntu24.04-r2
RSD-portainer-27439b9d89
API guide: Says the password-change endpoint needs a JWT for the user being changed. [defects, defects #175429]		lowfixed-in-releaseheld review (review model)2.45.3-CE-ubuntu24.04-r2
RSD-portainer-4925adaeb9
API guide: Tells customers that only administrators can call PUT /api/users/<id> and that a standard user always gets 403. [defects, defects #175430]		lowfixed-in-releaseheld review (review model)2.45.3-CE-ubuntu24.04-r2
RSD-portainer-8e3fc6279d
API guide: Says revoking a token requires a JWT. [defects, defects #175431]		lowfixed-in-releaseheld review (review model)2.45.3-CE-ubuntu24.04-r2
RSD-portainer-6db3a69631
Admin handbook: States a reverse proxy is a production requirement. [defects, defects #175432]		lowfixed-in-releaseheld review (review model)2.45.3-CE-ubuntu24.04-r2
RSD-portainer-12c063d086
Admin handbook: Presents the identity of the build's test container (no --group-add) as the identity inside the container. [defects, defects #175433]		lowfixed-in-releaseheld review (review model)2.45.3-CE-ubuntu24.04-r2
RSD-portainer-a107b1c4e9
Release notes: Claims ReadyStack ran ./BUILD_OFFLINE.sh then ./VERIFY_OFFLINE.sh before publishing. [defects, defects #175434]		lowfixed-in-releaseheld review (review model)2.45.3-CE-ubuntu24.04-r2
RSD-portainer-1ea9d91dd6
Database handbook: Round-2 finding (RSD-portainer-05cfcbd692) corrected only at :1236 (note added at :1239); :1214 still shows the command without -i/-t. [defects, defects #176106]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-3b914a3a68
Database handbook: Live on the held digest: POST /api/restore on an initialised instance returned 400 {"message":"Cannot restore already initialized instance"} with a valid, a wrong and no X-Setup-Token; 403 never… [defects, defects #176107]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-ffc69c4989
Database handbook: Live, 5 min 20 s after start with no administrator: / 307 -> /timeout.html; /api/system/status, /api/users/admin/check, /api/users, /api/auth, /api/endpoints, /api/users/admin/init and /api/restore… [defects, defects #176108]		lowfixed-before-releaseheld review (review model)—
RSD-portainer-31af267da2
API guide: validation/test-results.json portainer_root_get: GET / expect 200, actual 200, passed. [defects, defects #176109]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:a490310f9ea1e569bdbc7198b726c81ac3c186580a069f8ebf85a6bba1d28ad4 · published digest sha256:a490310f9ea1e569bdbc7198b726c81ac3c186580a069f8ebf85a6bba1d28ad4 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 167) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T12:02:45Z · failing Docker Scout counts 7 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T12:02:34Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3754875165 · transparency-log entry · integrated 2026-11-08T12:06:11Z) [ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:075e7d9c83a5aaaddccbbcbd06419d2708f07fb72541e9b39a17bfaf7df18246 · state attached · log index 3754875308 · transparency-log entry
    • kind sbom · digest sha256:075e7d9c83a5aaaddccbbcbd06419d2708f07fb72541e9b39a17bfaf7df18246 · state attached · log index 3754875387 · transparency-log entry
    • kind vsa · digest sha256:075e7d9c83a5aaaddccbbcbd06419d2708f07fb72541e9b39a17bfaf7df18246 · state attached · log index 3754875442 · transparency-log entry
    • kind provenance · digest sha256:a490310f9ea1e569bdbc7198b726c81ac3c186580a069f8ebf85a6bba1d28ad4 · state attached · log index 3754875556 · transparency-log entry
    • kind sbom · digest sha256:a490310f9ea1e569bdbc7198b726c81ac3c186580a069f8ebf85a6bba1d28ad4 · state attached · log index 3754875667 · transparency-log entry
    • kind vsa · digest sha256:a490310f9ea1e569bdbc7198b726c81ac3c186580a069f8ebf85a6bba1d28ad4 · state attached · log index 3754875768 · transparency-log entry
    (at 2026-11-08T12:06:12Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/portainer/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-10-28T00:55:59Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:e7e97c42d107e46c0aee285bb137ccc450142cbe6d56d543790cd4cc0aaf88eb [clean-room rebuild ledger, runs[500]]
  • 2026-11-08T11:30:56Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:a490310f9ea1e569bdbc7198b726c81ac3c186580a069f8ebf85a6bba1d28ad4 [clean-room rebuild ledger, runs[643]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-08T11:22:03Z [stage_runs, stage_runs chain 737 stage publish_image]
  • Archive manifests written2026-11-08T12:04:22Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 57 · probed 2026-11-07T11:02:07Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-08T12:07:22Z generated: by KitForge release/build_trail.py · generator commit 14ac19f4178268c2dbfa7e7cae4be76d466ea445
  • 2026-11-08T12:08:42Z publication: promoted at 2026-11-08T12:07:53Z · promoted digest sha256:075e7d9c83a5aaaddccbbcbd06419d2708f07fb72541e9b39a17bfaf7df18246 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 366 · checklist status complete · checklist at 2026-11-08T12:08:42Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

24 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/portainer/2.45.3-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/portainer/2.45.3-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/portainer/2.45.3-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-portainer-2.45.3-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/portainer/2.45.3-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/portainer/2.45.3-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)421
chainssadb, ReadyStack's engine database (not published)737
defectssadb, ReadyStack's engine database (not published)portainer 2.45.3-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 737
held_roundssadb, ReadyStack's engine database (not published)chain 737
micro_step_runssadb, ReadyStack's engine database (not published)chain 737
release_imagessadb, ReadyStack's engine database (not published)portainer 2.45.3-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 737
stage_runssadb, ReadyStack's engine database (not published)chain 737
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—