PostgreSQL 18.7-CE-ubuntu24.04-r1 build trail
How ReadyStack built readystack/postgresql:18.7-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/postgresql:18.7-CE-ubuntu24.04-r1 - Index digestsha256:2dc03b128eae31a00087966c4640f5b97d95f76380ac96d5c0e577442efbb9e6
- linux/amd64 digestsha256:bdae6da0f98801629d04c33a4da257a6041af05c7590f7a032688f220b0207a6
- Archive
ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.tar.gz - Archive SHA-256 now4e503267bf606d84f93baa8bf31c6630a8e7670943981d2b1ba4f457ed8fe711
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-12T22:59:18Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductPostgreSQL (postgresql) [MANIFEST.json]
- Release tag18.7-CE-ubuntu24.04-r1 [MANIFEST.json]
- Imagereadystack/postgresql:18.7-CE-ubuntu24.04-r1 [MANIFEST.json]
- Image index digestsha256:2dc03b128eae31a00087966c4640f5b97d95f76380ac96d5c0e577442efbb9e6 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:bdae6da0f98801629d04c33a4da257a6041af05c7590f7a032688f220b0207a6 [ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.tar.gz (bytes 672513668) [MANIFEST.json]
- Archive sha256 at publish4e503267bf606d84f93baa8bf31c6630a8e7670943981d2b1ba4f457ed8fe711 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/postgres/postgres [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refREL_18_7 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commitf5c41f6681c910b3f69951bf6fb97c6d74605d25 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash0ed1d466cd2e03b9799e59833fc5b40f4d1f72a9100c46738a047751b9e41df3 (files 7352) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:d071328d75e83306fd4f42a7aabc93464b131e978616cd226ffdf74e7f606938 [ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794522143 (utc 2026-11-12T22:22:23Z) [ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.rebuild.json, engine]
- Engine commit(s)
- commit a8f9a7a13a5afbd6dd0df0a91e7d0fbee76954b4 · dirty yes · first drive 4486
- commit f90b852f37265087900c9acdca31849ac5b61408 · dirty yes · first drive 4503
Why this release exists
Fully recorded- Chain1043 (created 2026-11-12T22:23:29Z · trigger customer_request · upstream version 18.7) [chains, chains #1043]
- Requestbuild request #741 (rebuild) (requested at 2026-11-12T22:22:28Z · requested by kitforge-agent · version 18.7) [build_requests, build_requests #741]
- Reasonretarget to REL_18_7: a newer upstream release (rule 1) [build_requests, build_requests #741 request_reason]
- Supersedesreadystack/postgresql:18.6-CE-ubuntu24.04-r7 (chain 937) [chains, chains #937]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1043 release · ready_to_ship
Created 2026-11-12T22:23:29Z, upstream 18.7, build request 741 [chains, chains #1043]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4486 | 2026-11-12T22:23:57Z | 22.2 | build host 2 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4486] |
| 4503 | 2026-11-12T22:53:58Z | — | build host 2 publish-held | not recorded [drive_runs, drive_runs #4503] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-12T22:24:08Z | 2026-11-12T22:24:08Z | 1 | 4
|
order_json f505822106f9… |
acquire |
2026-11-12T22:24:19Z | 2026-11-12T22:24:21Z | 1 | 12
|
source_tree 7478c3fc9330…license_file 3d6af92ff8a4…custody_inputs 2879c8456e0c…source_tree_hash 0176da06064d…source_file_manifest 630eb977b893… |
plan |
2026-11-12T22:24:53Z | 2026-11-12T22:24:53Z | 1 | 10
|
recon_report 538579ccc910…input_pin_plan ec6e1122fde2…toolchain_lock b3f54e466522… |
assemble_kit |
2026-11-12T22:29:10Z | 2026-11-12T22:29:11Z | 1 | 27
|
dockerfile 76d5b2de28b6…build_recipe 334458375822…system_pinning aa8db05a9a8a…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health 02194e7ab379…verify_offline_sh 3e8184ea230c…base_image_digests bfca53c58fe0…dockerfile_offline 76d5b2de28b6…first_build_digest 72a69b5fcc44… |
remediate |
2026-11-12T22:29:48Z | 2026-11-12T22:29:49Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 8d2e33dfdfb8…security_report 435bbeb6c205… |
build_kit |
2026-11-12T22:36:15Z | 2026-11-12T22:36:16Z | 1 | 9
|
cosign_stamp 9fc4a95671f0…locked_digest d53836b7831e…freeze_manifest 806ebe510893…offline_rebuild_transcript 695a96405fe3… |
verdict |
2026-11-12T22:36:48Z | 2026-11-12T22:36:49Z | 1 | 8
|
scout_verdict cadfc73e9f35… |
publish_image |
2026-11-12T22:37:20Z | 2026-11-12T22:37:21Z | 1 | 7
|
hub_readme dc065d987929…promotion_record 22590ee8273a… |
boot_instance |
2026-11-12T22:37:32Z | 2026-11-12T22:37:37Z | 2 | 3
|
instance_handle 8d178ebabf3a… |
sbom |
2026-11-12T22:37:47Z | 2026-11-12T22:37:48Z | 1 | 5
|
sbom_md 32567b657803…sbom_json 6666015eb774… |
schema_discovery |
2026-11-12T22:37:51Z | 2026-11-12T22:37:52Z | 1 | 7
|
schema_hash f92ead06ae2c…dependency_tree 3f26a57f4ad4…table_classification 7b8645373abc… |
admin_handbook |
2026-11-12T22:37:58Z | 2026-11-12T22:37:59Z | 1 | 7
|
api_map f1755e13542c…admin_handbook d73bec5c84b9… |
db_handbook |
2026-11-12T22:38:09Z | 2026-11-12T22:38:10Z | 1 | 8
|
db_handbook 9d019ceec674…seed_isolation 62610e469e46… |
seed_data |
2026-11-12T22:38:15Z | 2026-11-12T22:38:16Z | 1 | 6
|
seed_data_sql ca9dd2e1818b…seed_cases_json 1ad408ee3b49… |
seed_validate |
2026-11-12T22:38:19Z | 2026-11-12T22:38:20Z | 1 | 3
|
seed_data_contract 41f2d619c7d9… |
usecase_validate |
2026-11-12T22:38:34Z | 2026-11-12T22:38:35Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 8973b575b7d9…test_results b2d6bf83579a…usecase_contract 0bd6d159cdb6… |
finalize_docs |
2026-11-12T22:38:42Z | 2026-11-12T22:38:43Z | 1 | 9
|
defects_json 0d441af17a28…release_notes 647993ce4529…api_integration_guide 314327e5030f… |
package_archive invalidated 2026-11-12T22:53:35Z |
2026-11-12T22:46:03Z | 2026-11-12T22:46:06Z | 1 | 37 (final gate PASS)
|
sale_tar 118e6504bf14…checksums 00b9abb8d853…verify_md 7a59489c361f…rebuild_md 7378740caece…manifest_txt 0910852d6039…actions_jsonl b2d4d96290a8…provenance_md d6d1c3007e39…assetchain_log_md e9eccaec0c0f…assetchain_log_json 85e4430cae79… |
[stage_runs]
Rewinds
- 2026-11-12T22:53:35Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #34800]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-12T22:46:06Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 6518 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 9632 | L-A08, L-038, L-036, L-034, L-032 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.38 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-12T22:46:39Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1842] | $0.38 | 3 rounds, $40.00 | 118e6504bf14… |
Defects
Fully recorded- Ledger entries1 [defects, defects where product_slug=postgresql and this tag or chain]
- Disclosed in the archive1 [docs/defects/defects.json, entries]
1 ledger entry: by severity low 1; by status open 1.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-postgresql-5e2114c4c5Seed data records: The archive's seed-data file says PostgreSQL has no SQL database and keeps its state in 'configuration / Kubernetes resources'. [defects, defects #275097] | low | open | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:bdae6da0f98801629d04c33a4da257a6041af05c7590f7a032688f220b0207a6 · published digest sha256:bdae6da0f98801629d04c33a4da257a6041af05c7590f7a032688f220b0207a6 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 174) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T22:54:20Z · failing Docker Scout counts 21 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T22:54:08Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3840547221 · transparency-log entry
- log index 3840547859 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3840831332 · transparency-log entry · integrated 2026-11-12T22:57:39Z) [ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:2dc03b128eae31a00087966c4640f5b97d95f76380ac96d5c0e577442efbb9e6 · state attached · log index 3840832558 · transparency-log entry
- kind sbom · digest sha256:2dc03b128eae31a00087966c4640f5b97d95f76380ac96d5c0e577442efbb9e6 · state attached · log index 3840833414 · transparency-log entry
- kind vsa · digest sha256:2dc03b128eae31a00087966c4640f5b97d95f76380ac96d5c0e577442efbb9e6 · state attached · log index 3840834211 · transparency-log entry
- kind provenance · digest sha256:bdae6da0f98801629d04c33a4da257a6041af05c7590f7a032688f220b0207a6 · state attached · log index 3840834983 · transparency-log entry
- kind sbom · digest sha256:bdae6da0f98801629d04c33a4da257a6041af05c7590f7a032688f220b0207a6 · state attached · log index 3840835945 · transparency-log entry
- kind vsa · digest sha256:bdae6da0f98801629d04c33a4da257a6041af05c7590f7a032688f220b0207a6 · state attached · log index 3840837083 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/postgresql/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-12T22:46:44Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:bdae6da0f98801629d04c33a4da257a6041af05c7590f7a032688f220b0207a6 [clean-room rebuild ledger, runs[809]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-12T22:37:21Z [stage_runs, stage_runs chain 1043 stage publish_image]
- Archive manifests written2026-11-12T22:56:09Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 210 · probed 2026-11-12T22:33:07Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-12T22:59:18Z generated: by KitForge release/build_trail.py · generator commit f90b852f37265087900c9acdca31849ac5b61408
- 2026-11-12T23:00:55Z publication: promoted at 2026-11-12T23:00:00Z · promoted digest sha256:2dc03b128eae31a00087966c4640f5b97d95f76380ac96d5c0e577442efbb9e6 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 524 · checklist status complete · checklist at 2026-11-12T23:00:55Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/postgresql/18.7-CE-ubuntu24.04-r1/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/postgresql/18.7-CE-ubuntu24.04-r1/), as staged for publishing | — |
ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.rebuild.json | beside the archive (prodasset /data/production/postgresql/18.7-CE-ubuntu24.04-r1/), as staged for publishing | — |
ReadyStack-postgresql-18.7-CE-ubuntu24.04-r1.rebuild.json.sigstore | beside the archive (prodasset /data/production/postgresql/18.7-CE-ubuntu24.04-r1/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/postgresql/18.7-CE-ubuntu24.04-r1/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 741 |
chains | sadb, ReadyStack's engine database (not published) | 1043 |
defects | sadb, ReadyStack's engine database (not published) | postgresql 18.7-CE-ubuntu24.04-r1 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1043 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1043 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1043 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1043 |
release_images | sadb, ReadyStack's engine database (not published) | postgresql 18.7-CE-ubuntu24.04-r1 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1043 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1043 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |