PostgreSQL 18.6-CE-ubuntu24.04-r7 build trail
How ReadyStack built readystack/postgresql:18.6-CE-ubuntu24.04-r7 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/postgresql:18.6-CE-ubuntu24.04-r7 - Index digestsha256:40e4f6ae03f117439b82aebf1bee0ab33b8c1a57faf077bbb635ea18931d5595
- linux/amd64 digestsha256:be6bec2d8f2387492731f73dbc17d0faf4832c1fb1389b9cad70fd34fb142776
- Archive
ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.tar.gz - Archive SHA-256 now21b211925b427023ca5571457e52495dd9c6fb149252f16c509fa50d842e692f
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-10T21:28:17Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.trail.json.sigstore ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductPostgreSQL (postgresql) [MANIFEST.json]
- Release tag18.6-CE-ubuntu24.04-r7 [MANIFEST.json]
- Imagereadystack/postgresql:18.6-CE-ubuntu24.04-r7 [MANIFEST.json]
- Image index digestsha256:40e4f6ae03f117439b82aebf1bee0ab33b8c1a57faf077bbb635ea18931d5595 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:be6bec2d8f2387492731f73dbc17d0faf4832c1fb1389b9cad70fd34fb142776 [ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.tar.gz (bytes 666843215) [MANIFEST.json]
- Archive sha256 at publish21b211925b427023ca5571457e52495dd9c6fb149252f16c509fa50d842e692f [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/postgres/postgres [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refREL_18_6 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit724edf9bde9d356724ad384a2e196edc3c9f80f7 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash3077b76a2ae1976dc6a019f4e71c840935e7acb8b0240b33a383936e4a47a32d (files 7284) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:60319e3de224dfa30ed2bf792edc622daeef02d4f149849ce8a8204ea1bb2d90 [ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794290164 (utc 2026-11-10T05:56:04Z) [ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.rebuild.json, engine]
- Engine commit(s)
- commit e3eaace0a74e1a10fea82b44f3849ea9a0e2216a · dirty yes · first drive 4145
- commit 4c9b9ae57bdaa41861e468b83c8303059b789f97 · dirty yes · first drive 4181
- commit 445acd65b3ea96b7ca776db8722a0caee2c49a21 · dirty yes · first drive 4187
Why this release exists
Fully recorded- Chain937 (created 2026-11-10T06:03:54Z · trigger customer_request · upstream version 18.6) [chains, chains #937]
- Requestbuild request #618 (rebuild) (requested at 2026-11-10T06:02:01Z · requested by kitforge-agent · version 18.6) [build_requests, build_requests #618]
- Reasonrevision 18.6-CE-ubuntu24.04-r7: same upstream version re-dated by its own release (owner 2026-11-10 "date images correctly") [build_requests, build_requests #618 request_reason]
- Supersedesreadystack/postgresql:18.6-CE-ubuntu24.04-r6 (chain 922) [chains, chains #922]
The path through the harness
Fully recorded1 chain · 3 drives · 18 stages · 1 rewind
Chain 937 release · ready_to_ship
Created 2026-11-10T06:03:54Z, upstream 18.6, build request 618 [chains, chains #937]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4145 | 2026-11-10T06:04:23Z | 3.1 | build host 2 withhold-publish | stage_failed at assemble_kit; first failed check exists:first_build_digest; 4 ticks [drive_runs, drive_runs #4145] |
| 4181 | 2026-11-10T20:45:46Z | 20.8 | build host 2 withhold-publish | ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #4181] |
| 4187 | 2026-11-10T21:22:20Z | — | build host 2 publish-held | not recorded [drive_runs, drive_runs #4187] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-10T06:04:33Z | 2026-11-10T06:04:34Z | 1 | 4
|
order_json 42036bc613e5… |
acquire |
2026-11-10T06:04:45Z | 2026-11-10T06:04:47Z | 1 | 12
|
source_tree 0e6e62326659…license_file 3d6af92ff8a4…custody_inputs 260a85082e25…source_tree_hash 5ec2c0242542…source_file_manifest 721d1f2ab2f3… |
plan |
2026-11-10T06:05:16Z | 2026-11-10T06:05:16Z | 1 | 10
|
recon_report fdf6185a9922…input_pin_plan 2a83892917b4…toolchain_lock 72d71aa1ab63… |
assemble_kit |
2026-11-10T06:07:28Z | 2026-11-10T20:50:07Z | 2 | 27
|
dockerfile 232a3f969611…build_recipe 89b0ac11be3b…system_pinning aa8db05a9a8a…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health 04b26a7f3a74…verify_offline_sh 3e8184ea230c…base_image_digests bfca53c58fe0…dockerfile_offline 232a3f969611…first_build_digest fa7d46d9202d… |
remediate |
2026-11-10T20:50:45Z | 2026-11-10T20:50:46Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 60c9498563b6…security_report 9ef8eac13dc0… |
build_kit |
2026-11-10T20:57:12Z | 2026-11-10T20:57:12Z | 1 | 9
|
cosign_stamp b7835bad58ea…locked_digest 7b1a02015ab9…freeze_manifest dee14dfe31aa…offline_rebuild_transcript 10cad3511839… |
verdict |
2026-11-10T20:57:47Z | 2026-11-10T20:57:48Z | 1 | 8
|
scout_verdict 6c5d417b5309… |
publish_image |
2026-11-10T20:58:20Z | 2026-11-10T20:58:21Z | 1 | 7
|
hub_readme fe224bd7b755…promotion_record 70b5f8915512… |
boot_instance |
2026-11-10T20:58:32Z | 2026-11-10T20:58:37Z | 2 | 3
|
instance_handle 7d97aa9fd199… |
sbom |
2026-11-10T20:58:47Z | 2026-11-10T20:58:48Z | 1 | 5
|
sbom_md 0c0e229ffa15…sbom_json 16e7bdf0fb7d… |
schema_discovery |
2026-11-10T20:58:51Z | 2026-11-10T20:58:51Z | 1 | 7
|
schema_hash f92ead06ae2c…dependency_tree 3f26a57f4ad4…table_classification 7b8645373abc… |
admin_handbook |
2026-11-10T20:58:58Z | 2026-11-10T20:58:59Z | 1 | 7
|
api_map f1755e13542c…admin_handbook a1c115996f4a… |
db_handbook |
2026-11-10T20:59:09Z | 2026-11-10T20:59:09Z | 1 | 8
|
db_handbook b9a320a51f2e…seed_isolation 62610e469e46… |
seed_data |
2026-11-10T20:59:16Z | 2026-11-10T20:59:17Z | 1 | 6
|
seed_data_sql ca9dd2e1818b…seed_cases_json 36a2fe492bea… |
seed_validate |
2026-11-10T20:59:19Z | 2026-11-10T20:59:20Z | 1 | 3
|
seed_data_contract f07701136e19… |
usecase_validate |
2026-11-10T20:59:36Z | 2026-11-10T20:59:36Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 8973b575b7d9…test_results f5a5bc91d41d…usecase_contract a7f144dc5b79… |
finalize_docs |
2026-11-10T20:59:43Z | 2026-11-10T20:59:44Z | 1 | 9
|
defects_json 7db0f5fb3e5f…release_notes 157f4278b9d3…api_integration_guide a3c38bbfd267… |
package_archive invalidated 2026-11-10T21:21:52Z |
2026-11-10T21:06:33Z | 2026-11-10T21:06:35Z | 1 | 35 (final gate PASS)
|
sale_tar a4d96e42beec…checksums 923e6727bf08…verify_md b365abc93387…rebuild_md cac79f10e9ed…manifest_txt cc64da238837…actions_jsonl 7cf0a208d51c…provenance_md 025be8d535e4…assetchain_log_md e9eccaec0c0f…assetchain_log_json aaa0fe61149b… |
[stage_runs]
Rewinds
- 2026-11-10T21:21:52Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30644]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-10T21:06:35Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 6419 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 9611 | L-A08, L-038, L-036, L-034, L-032 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.34 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-10T21:08:31Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1695] | $0.34 | 3 rounds, $40.00 | a4d96e42beec… |
Defects
Fully recorded- Ledger entries1 [defects, defects where product_slug=postgresql and this tag or chain]
- Disclosed in the archive1 [docs/defects/defects.json, entries]
1 ledger entry: by severity low 1; by status open 1.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-postgresql-123bd11a22Seed data records: The archive's seed-data file says PostgreSQL has no SQL database and keeps its state in 'configuration / Kubernetes resources'. [defects, defects #230550] | low | open | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:be6bec2d8f2387492731f73dbc17d0faf4832c1fb1389b9cad70fd34fb142776 · published digest sha256:be6bec2d8f2387492731f73dbc17d0faf4832c1fb1389b9cad70fd34fb142776 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 179) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-10T21:22:43Z · failing Docker Scout counts 21 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-10T21:22:31Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3793429099 · transparency-log entry
- log index 3793430218 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3793904908 · transparency-log entry · integrated 2026-11-10T21:26:52Z) [ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:40e4f6ae03f117439b82aebf1bee0ab33b8c1a57faf077bbb635ea18931d5595 · state attached · log index 3793908165 · transparency-log entry
- kind sbom · digest sha256:40e4f6ae03f117439b82aebf1bee0ab33b8c1a57faf077bbb635ea18931d5595 · state attached · log index 3793909688 · transparency-log entry
- kind vsa · digest sha256:40e4f6ae03f117439b82aebf1bee0ab33b8c1a57faf077bbb635ea18931d5595 · state attached · log index 3793911943 · transparency-log entry
- kind provenance · digest sha256:be6bec2d8f2387492731f73dbc17d0faf4832c1fb1389b9cad70fd34fb142776 · state attached · log index 3793914682 · transparency-log entry
- kind sbom · digest sha256:be6bec2d8f2387492731f73dbc17d0faf4832c1fb1389b9cad70fd34fb142776 · state attached · log index 3793916608 · transparency-log entry
- kind vsa · digest sha256:be6bec2d8f2387492731f73dbc17d0faf4832c1fb1389b9cad70fd34fb142776 · state attached · log index 3793918977 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/postgresql/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-10T21:08:37Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:be6bec2d8f2387492731f73dbc17d0faf4832c1fb1389b9cad70fd34fb142776 [clean-room rebuild ledger, runs[725]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-10T20:58:21Z [stage_runs, stage_runs chain 937 stage publish_image]
- Archive manifests written2026-11-10T21:25:07Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 210 · probed 2026-11-10T20:53:55Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-10T21:28:17Z generated: by KitForge release/build_trail.py · generator commit 445acd65b3ea96b7ca776db8722a0caee2c49a21
- 2026-11-10T21:29:51Z publication: promoted at 2026-11-10T21:28:58Z · promoted digest sha256:40e4f6ae03f117439b82aebf1bee0ab33b8c1a57faf077bbb635ea18931d5595 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 449 · checklist status complete · checklist at 2026-11-10T21:29:51Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/postgresql/18.6-CE-ubuntu24.04-r7/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/postgresql/18.6-CE-ubuntu24.04-r7/), as staged for publishing | — |
ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.rebuild.json | beside the archive (prodasset /data/production/postgresql/18.6-CE-ubuntu24.04-r7/), as staged for publishing | — |
ReadyStack-postgresql-18.6-CE-ubuntu24.04-r7.rebuild.json.sigstore | beside the archive (prodasset /data/production/postgresql/18.6-CE-ubuntu24.04-r7/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/postgresql/18.6-CE-ubuntu24.04-r7/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 618 |
chains | sadb, ReadyStack's engine database (not published) | 937 |
defects | sadb, ReadyStack's engine database (not published) | postgresql 18.6-CE-ubuntu24.04-r7 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 937 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 937 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 937 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 937 |
release_images | sadb, ReadyStack's engine database (not published) | postgresql 18.6-CE-ubuntu24.04-r7 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 937 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 937 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |