Prometheus v3.15.1-CE-ubuntu24.04-r2 build trail

• ProductPrometheus (prometheus) [MANIFEST.json]
• Release tagv3.15.1-CE-ubuntu24.04-r2 [MANIFEST.json]
• Imagereadystack/prometheus:v3.15.1-CE-ubuntu24.04-r2 [MANIFEST.json]
• Image index digestsha256:47be18493688e2a672de319e2bd20f49c5204249d502dc4b24db3a5943e9b70a [docs/provenance/LOCKED_DIGEST.txt]
• linux/amd64 image digestsha256:859f3a39ea35ec408206ed6e6f17f65a4242cf8b57b706a312814d7b1553274b [ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
• ArchiveReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r2.tar.gz (bytes 612483515) [MANIFEST.json]
• Archive sha256 at publish3ad117f34295b94ab90522cde61fd6d4e40a8489d41398cbce4d4f4abd71b7f3 [MANIFEST.json, repack_history[0].previous_tarball_sha256]
• Archive sha256 now7ccbffef598845ca04b2e3cc05a27e12225b162c531462e2030bb05e0ae35aa7 [MANIFEST.json, tarball_sha256]
• Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
• Repack history
  • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 3ad117f34295b94ab90522cde61fd6d4e40a8489d41398cbce4d4f4abd71b7f3 · sha256 7ccbffef598845ca04b2e3cc05a27e12225b162c531462e2030bb05e0ae35aa7 · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
  [MANIFEST.json, repack_history]
• Upstream repositoryhttps://github.com/prometheus/prometheus [docs/provenance/SOURCE_TREE_HASH.json]
• Upstream refv3.15.1 [docs/provenance/SOURCE_TREE_HASH.json]
• Upstream commitbae3eced0a5369e050e83ea73bc381d7c4b1a719 [docs/provenance/SOURCE_TREE_HASH.json]
• Source tree hashdf15b2df1714ceb83496ef7900b7bf861b419e46a7782c8faea5e7c81d4fbc01 (files 1686) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
• Kit tree hashsha256:e89bf532370884cff57115a5fc7ee95e2d08595ba2eed515def0145987f6271f [ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
• SOURCE_DATE_EPOCH1792589043 (utc 2026-10-21T13:24:03Z) [ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
• Base images
  • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
  • ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
  [ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r2.rebuild.json, bases]
• BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r2.rebuild.json, engine]

• Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

• Chain676 (created 2026-10-27T08:37:20Z · trigger customer_request · upstream version v3.15.1) [chains, chains #676]
• Requestbuild request #353 (rebuild) (requested at 2026-10-27T01:51:04Z · requested by kitforge-agent · version v3.15.1) [build_requests, build_requests #353]
• Reasonrevision v3.15.1-CE-ubuntu24.04-r2: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #353 request_reason]
• Supersedesreadystack/prometheus:v3.15.1-CE-ubuntu24.04-r1 (chain 604) [chains, chains #604]

1 chain · 2 drives · 18 stages · 1 rewind

Stages, in order

[stage_runs]

Rewinds

• 2026-10-27T09:42:43Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #498]

• Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
• Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Role: writer model. Calls up to 2026-10-27T09:52:38Z.

6 calls over 3 stages

[micro_step_runs]

• Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
• Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
• Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Role: review model.

1 round, 0 counted

• Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
• Not recorded: the round cap in force at each round (the state files did not keep it)

• Ledger entries1 [defects, defects where product_slug=prometheus and this tag or chain]
• Disclosed in the archive1 [docs/defects/defects.json, entries]

1 ledger entry: by severity high 1; by status open 1.

• Reproduced before publishingyes (rebuilt digest sha256:859f3a39ea35ec408206ed6e6f17f65a4242cf8b57b706a312814d7b1553274b · published digest sha256:859f3a39ea35ec408206ed6e6f17f65a4242cf8b57b706a312814d7b1553274b · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 341) [docs/provenance/REPRO_VERIFICATION.json, verified]
• Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 676 package_archive gate_result.g8.result]
• Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-27T09:43:27Z · failing Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
• First own scan of the releaseA (at 2026-10-27T09:52:48Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-27T06:30:41Z) [image_scans, image_scans #1321]
• Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-27T09:43:15Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
• Image signature transparency-log entries
  • log index 3511517646 · transparency-log entry
  • log index 3511520705 · transparency-log entry
  [docs/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
• rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3628691612 · transparency-log entry · integrated 2026-11-01T11:48:48Z) [ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]

Offline clean-room rebuilds

• 2026-10-27T09:18:17Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
  rebuilt sha256:859f3a39ea35ec408206ed6e6f17f65a4242cf8b57b706a312814d7b1553274b [clean-room rebuild ledger, runs[443]]

• Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
• Not recorded: the attestations' transparency-log entries (no attestation record in the release's workspace)
• Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

• Image pushed (internal tag), publish_image passed2026-10-27T09:01:03Z [stage_runs, stage_runs chain 676 stage publish_image]
• Archive manifests written2026-10-27T09:46:40Z [PUBLISH_MANIFEST.json, published_at]
• Archive cut over on prodasset, package_archive passed2026-10-27T09:52:38Z [stage_runs, stage_runs chain 676 stage package_archive]
• Cut-over markerpresent (chain 676) [.cutover.json]

• Not recorded: when the release tag was promoted (the promotion record in the archive was written before the promotion, and the release's workspace no longer holds this chain)
• Not recorded: the site event's time (the release checklist is in the chain's workspace, which no longer holds this chain)

• Packages in the image549 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
• x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 744 · probed 2026-11-02T17:07:55Z · source backfill) [release_images, isa_level_hard]

• 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records