Prometheus v3.15.1-CE-ubuntu24.04-r3 build trail

How ReadyStack built readystack/prometheus:v3.15.1-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/prometheus:v3.15.1-CE-ubuntu24.04-r3
  • Index digestsha256:6987632178755b6617f8469b564321a2fabf9dc3cd8dd9bfa09f8eb2c234a6f6
  • linux/amd64 digestsha256:89e69e8052d00bed9f3744f44d6f273f0eb2c4a9b3510742059df62e556e3c6e
  • ArchiveReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.tar.gz
  • Archive SHA-256 nowb9e5f58682249a0570d46d9f71fca44378976cfed7acd12a54807ca335174203
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-05T07:09:31Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.trail.json
ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.trail.jsonReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.trail.json.sigstoreReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.trail.mdPrometheus product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductPrometheus (prometheus) [MANIFEST.json]
  • Release tagv3.15.1-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Imagereadystack/prometheus:v3.15.1-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Image index digestsha256:6987632178755b6617f8469b564321a2fabf9dc3cd8dd9bfa09f8eb2c234a6f6 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:89e69e8052d00bed9f3744f44d6f273f0eb2c4a9b3510742059df62e556e3c6e [ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.tar.gz (bytes 615116160) [MANIFEST.json]
  • Archive sha256 at publishb9e5f58682249a0570d46d9f71fca44378976cfed7acd12a54807ca335174203 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/prometheus/prometheus [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv3.15.1 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitbae3eced0a5369e050e83ea73bc381d7c4b1a719 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashdf15b2df1714ceb83496ef7900b7bf861b419e46a7782c8faea5e7c81d4fbc01 (files 1686) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:3d5017243b23e06dbfafa0bfd8ceb68cf5a411c66df0ddace1af16c1166ce859 [ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1792589043 (utc 2026-10-21T13:24:03Z) [ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.rebuild.json, engine]
  • Engine commit(s)
    • commit d7ccff446f52731f23cbe85c44adc1730f1c2bef · dirty yes · first drive 3477
    • commit cf81a3d6ffd824c2a54d50e13d30f5b737ddde58 · dirty yes · first drive 3492
    • commit 4c39d704ee5965c744d74b3e5d43aef7521363ba · dirty yes · first drive 3498
    • commit aa56bde09a04e7b2222f73a15f4347569329e089 · dirty yes · first drive 3504
    • commit 09eb4dc7a5fd5e3015ad6d0868fadf9d74e863d0 · dirty yes · first drive 3513
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain730 (created 2026-10-27T22:32:10Z · trigger customer_request · upstream version v3.15.1) [chains, chains #730]
  • Requestbuild request #431 (rebuild) (requested at 2026-10-27T22:17:16Z · requested by kitforge-agent · version v3.15.1) [build_requests, build_requests #431]
  • Reasonrevision v3.15.1-CE-ubuntu24.04-r3: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #431 request_reason]
  • Supersedesreadystack/prometheus:v3.15.1-CE-ubuntu24.04-r2 (chain 676) [chains, chains #676]

The path through the harness

Fully recorded

1 chain · 7 drives · 18 stages · 5 rewinds

Chain 730 release · ready_to_ship

Created 2026-10-27T22:32:10Z, upstream v3.15.1, build request 431 [chains, chains #730]

DriveStartedMinutesBuild hostHow it stopped
9862026-10-27T22:32:56Z56.8build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #986] rebuilt from a build line's log
9882026-10-28T00:21:08Z0.8build host 5 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #988] rebuilt from a build line's log
34772026-11-03T04:52:18Z46.8build host 5 withhold-publish stage_failed at package_archive; first failed check g8; 15 ticks [drive_runs, drive_runs #3477]
34922026-11-05T04:16:44Z7.7build host 5 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3492]
34982026-11-05T04:42:58Z33.1build host 5 withhold-publish stage_failed at verdict; first failed check scout_verdict:release_check_passed; 4 ticks [drive_runs, drive_runs #3498]
35042026-11-05T05:39:35Z51.7build host 5 withhold-publish ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #3504]
35132026-11-05T06:59:58Z—build host 5 publish-held not recorded [drive_runs, drive_runs #3513]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-27T22:33:06Z2026-10-27T22:33:07Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-27T22:33:15Z2026-10-27T22:33:16Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-27T22:33:47Z2026-10-27T22:33:48Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-27T22:50:50Z2026-11-05T05:56:19Z4
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 4eed746f7e94…
build_recipe 0d4afb1f214b…
system_pinning fa091140511e…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health b5fb784256af…
verify_offline_sh 3e8184ea230c…
base_image_digests 57c8cb73a230…
dockerfile_offline 4eed746f7e94…
first_build_digest 198161000092…
remediate 2026-10-27T22:52:03Z2026-11-05T05:56:23Z4
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 8ea0abaf578c…
security_report a226fdb34575…
build_kit 2026-10-27T23:08:05Z2026-11-05T06:12:14Z4
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 7b581f51ce5b…
locked_digest e01897b1348b…
freeze_manifest ae7f17062a5a…
offline_rebuild_transcript a28e89999282…
verdict 2026-10-27T23:09:28Z2026-11-05T06:13:27Z4
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict f2a417526a73…
publish_image 2026-10-27T23:10:32Z2026-11-05T06:14:14Z3
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme bd410d8bcf61…
promotion_record 30047a54a83d…
boot_instance 2026-10-27T23:10:39Z2026-11-05T06:14:30Z6
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle b9142e7a8398…
sbom 2026-10-27T23:11:00Z2026-11-05T06:14:51Z3
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 2cdda857c621…
sbom_json 00de72951591…
schema_discovery 2026-10-27T23:11:03Z2026-11-05T06:14:54Z3
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash d311e2886763…
dependency_tree 77fe7001d873…
table_classification c75fa9c5e1a8…
admin_handbook 2026-10-27T23:11:13Z2026-11-05T06:15:03Z3
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 87a4a1a5f7f8…
admin_handbook 594fc7abb5ea…
db_handbook 2026-10-27T23:11:27Z2026-11-05T06:15:14Z3
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook c63bad1ff3f6…
seed_isolation ece6e82a0623…
seed_data 2026-10-27T23:11:37Z2026-11-05T06:15:21Z3
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 4857e7c347b3…
seed_cases_json a96ba0553fe6…
seed_validate 2026-10-27T23:11:40Z2026-11-05T06:15:25Z3
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract f4afe926efb1…
usecase_validate 2026-10-27T23:12:09Z2026-11-05T06:15:39Z3
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests fd20a651750b…
test_results fe5b45520413…
usecase_contract bf3192a91c97…
finalize_docs 2026-10-27T23:12:16Z2026-11-05T06:15:45Z3
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 484487c4fd31…
release_notes 3e46f7bdc2b6…
api_integration_guide fa672712f1e8…
package_archive invalidated 2026-11-05T06:59:00Z 2026-10-27T23:29:40Z2026-11-05T06:31:16Z5
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar a091ee03c2be…
checksums 8fd3aa964592…
verify_md 46d05ba9c9d9…
rebuild_md 2d313ad20fec…
manifest_txt 35d379035055…
actions_jsonl b4af978b54df…
provenance_md 8d3608ea067b…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json a57aabde0a28…

[stage_runs]

Rewinds

  • 2026-10-27T23:48:43Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2211]
  • 2026-11-03T04:52:25Z: package_archive to assemble_kit on strategy_changed (strategy changed (27cb0759de9b -> b076109ba77f)) [stage_events, stage_events #22156]
  • 2026-11-05T04:43:02Z: package_archive to assemble_kit on strategy_changed (strategy changed (b076109ba77f -> 95b322a21c88)) [stage_events, stage_events #22609]
  • 2026-11-05T05:39:39Z: verdict to assemble_kit on strategy_changed (strategy changed (95b322a21c88 -> c5e59841badc)) [stage_events, stage_events #22781]
  • 2026-11-05T06:59:00Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #22894]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-05T06:31:16Z.

19 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook10001 035063 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook1001 not recordednot recorded —
usecase_validate2001 not recordednot recorded —
finalize_docs2001 not recordednot recorded —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $1.12 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-10-27T23:31:23Z 0120 findings to repackage [held_rounds, held_rounds #152] rebuilt from a held-review state file $0.66 not recorded 9a77b4700aaf…
22026-11-05T06:33:17Z 001 clean to publish [held_rounds, held_rounds #1403] $0.46 3 rounds, $40.00 a091ee03c2be…

Defects

Fully recorded
  • Ledger entries14 [defects, defects where product_slug=prometheus and this tag or chain]
  • Disclosed in the archive14 [docs/defects/defects.json, entries]

14 ledger entries: by severity high 13, low 1; by status open 1, fixed-before-release 13.

DefectSeverityStatusFound byFixed in
RSD-prometheus-2cc5360caa
Unauthenticated access by default [defects, defects #121788]		highopenbuild strategy record—
RSD-prometheus-e8b1e853d1
Admin handbook: Runtime identity section still lists uid 999, contradicting the id output shown just below it and the rest of the handbook. [defects, defects #122145]		highfixed-before-releaseheld review (review model)—
RSD-prometheus-9d1ca66968
Admin handbook: GID is 65534 (nogroup), not 999. [defects, defects #122146]		highfixed-before-releaseheld review (review model)—
RSD-prometheus-8c2fca9a8b
Admin handbook: User is nobody, not prometheus; this image creates no prometheus account. [defects, defects #122147]		highfixed-before-releaseheld review (review model)—
RSD-prometheus-72918ab784
Admin handbook: Group is nogroup, not prometheus. [defects, defects #122148]		highfixed-before-releaseheld review (review model)—
RSD-prometheus-d163d1eb4c
Admin handbook: Restore warning names uid 999; the process runs as 65534. [defects, defects #122149]		highfixed-before-releaseheld review (review model)—
RSD-prometheus-bc0eef2b9b
Admin handbook: Same bullet says uid 999 then uid 65534; a customer chowning to 999 gets permission denied. [defects, defects #122150]		highfixed-before-releaseheld review (review model)—
RSD-prometheus-64259a01eb
Admin handbook: Container name is prometheus; 'nobody' was a user-name substitution error and a customer following it would not remove the real container, then docker run fails with name in use. [defects, defects #122151]		highfixed-before-releaseheld review (review model)—
RSD-prometheus-feaf04ea6d
Admin handbook: Container name is prometheus; the following command uses 'docker exec prometheus', so this sentence contradicts it. [defects, defects #122152]		highfixed-before-releaseheld review (review model)—
RSD-prometheus-12c7b0b609
API guide: API guide names user/group prometheus; the image's user is nobody/nogroup. [defects, defects #122153]		highfixed-before-releaseheld review (review model)—
RSD-prometheus-bc2bd948f9
API guide: Supplementary group is 65534(nogroup); 999(prometheus) does not exist in this image. [defects, defects #122154]		highfixed-before-releaseheld review (review model)—
RSD-prometheus-3c3e799e12
Database handbook: Names account prometheus, which does not exist; id prints nobody/nogroup. [defects, defects #122155]		highfixed-before-releaseheld review (review model)—
RSD-prometheus-acd486761c
Database handbook: Bind-mount advice names uid 999; a directory prepared for 999 is not writable by the process (65534). [defects, defects #122156]		highfixed-before-releaseheld review (review model)—
RSD-prometheus-715aeb478b
Admin handbook: Empty '##' heading and duplicated 'Configuration Management' heading (and duplicate TOC entry) left by the section rewrite. [defects, defects #155415]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:89e69e8052d00bed9f3744f44d6f273f0eb2c4a9b3510742059df62e556e3c6e · published digest sha256:89e69e8052d00bed9f3744f44d6f273f0eb2c4a9b3510742059df62e556e3c6e · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 445) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-05T07:00:27Z · failing Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-05T07:00:08Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3692783286 · transparency-log entry · integrated 2026-11-05T07:07:44Z) [ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:6987632178755b6617f8469b564321a2fabf9dc3cd8dd9bfa09f8eb2c234a6f6 · state attached · log index 3692783603 · transparency-log entry
    • kind sbom · digest sha256:6987632178755b6617f8469b564321a2fabf9dc3cd8dd9bfa09f8eb2c234a6f6 · state attached · log index 3692783668 · transparency-log entry
    • kind vsa · digest sha256:6987632178755b6617f8469b564321a2fabf9dc3cd8dd9bfa09f8eb2c234a6f6 · state attached · log index 3692783792 · transparency-log entry
    • kind provenance · digest sha256:89e69e8052d00bed9f3744f44d6f273f0eb2c4a9b3510742059df62e556e3c6e · state attached · log index 3692783933 · transparency-log entry
    • kind sbom · digest sha256:89e69e8052d00bed9f3744f44d6f273f0eb2c4a9b3510742059df62e556e3c6e · state attached · log index 3692784056 · transparency-log entry
    • kind vsa · digest sha256:89e69e8052d00bed9f3744f44d6f273f0eb2c4a9b3510742059df62e556e3c6e · state attached · log index 3692784210 · transparency-log entry
    (at 2026-11-05T07:07:45Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/prometheus/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-10-27T23:31:26Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:d37f01084582e29e168e7fe4cb441154633b394bb0cc2f8ef7f713ad7bb36bf9 [clean-room rebuild ledger, runs[494]]
  • 2026-11-05T06:33:23Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:89e69e8052d00bed9f3744f44d6f273f0eb2c4a9b3510742059df62e556e3c6e [clean-room rebuild ledger, runs[586]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-05T06:14:14Z [stage_runs, stage_runs chain 730 stage publish_image]
  • Archive manifests written2026-11-05T07:04:02Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 744 · probed 2026-11-05T06:04:27Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-05T07:09:31Z generated: by KitForge release/build_trail.py · generator commit 6731d5408ede859271a408248219e201ad636916
  • 2026-11-05T07:11:48Z publication: promoted at 2026-11-05T07:10:06Z · promoted digest sha256:6987632178755b6617f8469b564321a2fabf9dc3cd8dd9bfa09f8eb2c234a6f6 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 317 · checklist status complete · checklist at 2026-11-05T07:11:48Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/prometheus/v3.15.1-CE-ubuntu24.04-r3/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/prometheus/v3.15.1-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.rebuild.jsonbeside the archive (prodasset /data/production/prometheus/v3.15.1-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-prometheus-v3.15.1-CE-ubuntu24.04-r3.rebuild.json.sigstorebeside the archive (prodasset /data/production/prometheus/v3.15.1-CE-ubuntu24.04-r3/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/prometheus/v3.15.1-CE-ubuntu24.04-r3/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)431
chainssadb, ReadyStack's engine database (not published)730
defectssadb, ReadyStack's engine database (not published)prometheus v3.15.1-CE-ubuntu24.04-r3
drive_runssadb, ReadyStack's engine database (not published)chain 730
held_roundssadb, ReadyStack's engine database (not published)chain 730
lesson_recallssadb, ReadyStack's engine database (not published)chain 730
micro_step_runssadb, ReadyStack's engine database (not published)chain 730
release_imagessadb, ReadyStack's engine database (not published)prometheus v3.15.1-CE-ubuntu24.04-r3
stage_eventssadb, ReadyStack's engine database (not published)chain 730
stage_runssadb, ReadyStack's engine database (not published)chain 730
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—