Python 3.15.2-CE-ubuntu24.04-r3 build trail
How ReadyStack built readystack/python:3.15.2-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/python:3.15.2-CE-ubuntu24.04-r3 - Index digestsha256:43f57c5bf04669e0f1ae47bc21e0f345c9fe6aca52b73d2894c01974f3701c86
- linux/amd64 digestsha256:a18fbc506fe3cbdc82e57466f7aa221753f3de418e9091c75b1121cd2b3fec0e
- Archive
ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.tar.gz - Archive SHA-256 now967ee3966a2b28db9d4600f7d797feff75edd5336e984a3ef60962afbe8eb5d6
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-12T06:24:02Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductPython (python) [MANIFEST.json]
- Release tag3.15.2-CE-ubuntu24.04-r3 [MANIFEST.json]
- Imagereadystack/python:3.15.2-CE-ubuntu24.04-r3 [MANIFEST.json]
- Image index digestsha256:43f57c5bf04669e0f1ae47bc21e0f345c9fe6aca52b73d2894c01974f3701c86 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:a18fbc506fe3cbdc82e57466f7aa221753f3de418e9091c75b1121cd2b3fec0e [ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-python-3.15.2-CE-ubuntu24.04-r3.tar.gz (bytes 335550177) [MANIFEST.json]
- Archive sha256 at publish967ee3966a2b28db9d4600f7d797feff75edd5336e984a3ef60962afbe8eb5d6 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/python/cpython [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv3.15.2 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit5e58eaad7c58df58dfa8ea549c87996e01dd1077 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashc39e6ce79eef9148fe893ee08e13bf6cd2350f8549c20587afeed3c639740352 (files 5636) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:6030529612cff447b5712b1485806a7a9eb01affdb6ae848483af7a26e29cd14 [ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794448309 (utc 2026-11-12T01:51:49Z) [ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.rebuild.json, engine]
- Engine commit(s)
- commit 47c63b5a708a513f4d8bad7fb7b86da91cf0c944 · dirty yes · first drive 4342
- commit 00fbe06493ee6d169b853dbae9f5f18820685ba5 · dirty yes · first drive 4358
Why this release exists
Fully recorded- Chain1000 (created 2026-11-12T03:59:52Z · trigger customer_request · upstream version 3.15.2) [chains, chains #1000]
- Requestbuild request #714 (rebuild) (requested at 2026-11-12T01:51:51Z · requested by kitforge-agent · version 3.15.2) [build_requests, build_requests #714]
- Reasonrevision 3.15.2-CE-ubuntu24.04-r3: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #714 request_reason]
- Supersedesreadystack/python:3.15.2-CE-ubuntu24.04-r2 (chain 971) [chains, chains #971]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1000 release · ready_to_ship
Created 2026-11-12T03:59:52Z, upstream 3.15.2, build request 714 [chains, chains #1000]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4342 | 2026-11-12T04:00:23Z | 32.8 | build host 5 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4342] |
| 4358 | 2026-11-12T06:19:21Z | — | build host 5 publish-held | not recorded [drive_runs, drive_runs #4358] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-12T04:00:33Z | 2026-11-12T04:00:34Z | 1 | 4
|
order_json b031c216ea48… |
acquire |
2026-11-12T04:00:43Z | 2026-11-12T04:00:45Z | 1 | 12
|
source_tree 97bef397fbc0…license_file b0e25a78cffb…custody_inputs e7cdd40cbf3f…source_tree_hash 4a714b9067db…source_file_manifest eb1b5ca09759… |
plan |
2026-11-12T04:01:10Z | 2026-11-12T04:01:11Z | 1 | 10
|
recon_report 3cd797426f71…input_pin_plan 04943a2eaab8…toolchain_lock 995f3bd8467f… |
assemble_kit |
2026-11-12T04:10:21Z | 2026-11-12T04:10:22Z | 1 | 27
|
dockerfile fb9726974601…build_recipe b646214441e4…system_pinning 01ba4719c80b…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health e34c38fdbfba…verify_offline_sh 3e8184ea230c…base_image_digests 167b03637e3f…dockerfile_offline fb9726974601…first_build_digest 7eeaa6eb1f8c… |
remediate |
2026-11-12T04:10:46Z | 2026-11-12T04:10:47Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 1100fdd6b7f7…security_report d8c1f2d4f015… |
build_kit |
2026-11-12T04:20:44Z | 2026-11-12T04:20:44Z | 1 | 9
|
cosign_stamp 4e3e5db2b9a7…locked_digest d00875e38773…freeze_manifest 3c4b47acc3f1…offline_rebuild_transcript ca9c9d64612d… |
verdict |
2026-11-12T04:21:44Z | 2026-11-12T04:21:45Z | 1 | 8
|
scout_verdict db1e947e9287… |
publish_image |
2026-11-12T04:22:35Z | 2026-11-12T04:22:36Z | 1 | 7
|
hub_readme 7e55049886b2…promotion_record 5839f511b21d… |
boot_instance |
2026-11-12T04:22:42Z | 2026-11-12T04:22:47Z | 2 | 3
|
instance_handle 6d5f55e0dfe8… |
sbom |
2026-11-12T04:23:01Z | 2026-11-12T04:23:03Z | 1 | 5
|
sbom_md 7acf0e598ca7…sbom_json a4b3aa9cbe06… |
schema_discovery |
2026-11-12T04:23:06Z | 2026-11-12T04:23:07Z | 1 | 7
|
schema_hash b616172f431c…dependency_tree 0537819112e0…table_classification 3517749b1d4a… |
admin_handbook |
2026-11-12T04:23:28Z | 2026-11-12T04:23:29Z | 1 | 7
|
api_map bb4583efb3eb…admin_handbook f09207cdb95b… |
db_handbook |
2026-11-12T04:23:35Z | 2026-11-12T04:23:36Z | 1 | 8
|
db_handbook c0aa8a89cde9…seed_isolation c37278da86ee… |
seed_data |
2026-11-12T04:24:10Z | 2026-11-12T04:24:10Z | 1 | 6
|
seed_data_sql 56fc29851acb…seed_cases_json 186738656502… |
seed_validate |
2026-11-12T04:24:13Z | 2026-11-12T04:24:14Z | 1 | 3
|
seed_data_contract e251e20569c0… |
usecase_validate |
2026-11-12T04:24:54Z | 2026-11-12T04:24:55Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 40a01c398ed3…test_results 6767116d8974…usecase_contract daf3f2deed28… |
finalize_docs |
2026-11-12T04:25:05Z | 2026-11-12T04:25:07Z | 1 | 9
|
defects_json a59e4ee4924e…release_notes 97259ff4c1fd…api_integration_guide 96760eda69c4… |
package_archive invalidated 2026-11-12T06:18:51Z |
2026-11-12T04:33:07Z | 2026-11-12T04:33:09Z | 1 | 36 (final gate PASS)
|
sale_tar b9e7225dbc9d…checksums 42e0129a304b…verify_md 56486cc9f896…rebuild_md 6c40a973afb4…manifest_txt 119f5dbdbdd3…actions_jsonl 075d9236a1ff…provenance_md c4a4eeed1b69…assetchain_log_md e9eccaec0c0f…assetchain_log_json c5ac1f6d613c… |
[stage_runs]
Rewinds
- 2026-11-12T06:18:51Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33086]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-12T04:33:09Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 5248 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 5538 | L-A183, L-A15 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.20 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-12T04:33:44Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1775] | $0.20 | 3 rounds, $40.00 | b9e7225dbc9d… |
Defects
Fully recorded- Ledger entries0 [defects, defects where product_slug=python and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
0 ledger entries.
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:a18fbc506fe3cbdc82e57466f7aa221753f3de418e9091c75b1121cd2b3fec0e · published digest sha256:a18fbc506fe3cbdc82e57466f7aa221753f3de418e9091c75b1121cd2b3fec0e · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 261) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T06:19:47Z · failing Docker Scout counts 87 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T06:19:31Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3824514458 · transparency-log entry
- log index 3824517548 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3826706629 · transparency-log entry · integrated 2026-11-12T06:22:49Z) [ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:43f57c5bf04669e0f1ae47bc21e0f345c9fe6aca52b73d2894c01974f3701c86 · state attached · log index 3826708006 · transparency-log entry
- kind sbom · digest sha256:43f57c5bf04669e0f1ae47bc21e0f345c9fe6aca52b73d2894c01974f3701c86 · state attached · log index 3826709150 · transparency-log entry
- kind vsa · digest sha256:43f57c5bf04669e0f1ae47bc21e0f345c9fe6aca52b73d2894c01974f3701c86 · state attached · log index 3826710826 · transparency-log entry
- kind provenance · digest sha256:a18fbc506fe3cbdc82e57466f7aa221753f3de418e9091c75b1121cd2b3fec0e · state attached · log index 3826712953 · transparency-log entry
- kind sbom · digest sha256:a18fbc506fe3cbdc82e57466f7aa221753f3de418e9091c75b1121cd2b3fec0e · state attached · log index 3826715088 · transparency-log entry
- kind vsa · digest sha256:a18fbc506fe3cbdc82e57466f7aa221753f3de418e9091c75b1121cd2b3fec0e · state attached · log index 3826717406 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/python/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-12T04:33:49Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:a18fbc506fe3cbdc82e57466f7aa221753f3de418e9091c75b1121cd2b3fec0e [clean-room rebuild ledger, runs[771]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-12T04:22:36Z [stage_runs, stage_runs chain 1000 stage publish_image]
- Archive manifests written2026-11-12T06:21:06Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 791 · probed 2026-11-12T04:16:08Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-12T06:24:02Z generated: by KitForge release/build_trail.py · generator commit 00fbe06493ee6d169b853dbae9f5f18820685ba5
- 2026-11-12T06:25:23Z publication: promoted at 2026-11-12T06:24:32Z · promoted digest sha256:43f57c5bf04669e0f1ae47bc21e0f345c9fe6aca52b73d2894c01974f3701c86 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 487 · checklist status complete · checklist at 2026-11-12T06:25:23Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/python/3.15.2-CE-ubuntu24.04-r3/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/python/3.15.2-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.rebuild.json | beside the archive (prodasset /data/production/python/3.15.2-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-python-3.15.2-CE-ubuntu24.04-r3.rebuild.json.sigstore | beside the archive (prodasset /data/production/python/3.15.2-CE-ubuntu24.04-r3/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/python/3.15.2-CE-ubuntu24.04-r3/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 714 |
chains | sadb, ReadyStack's engine database (not published) | 1000 |
defects | sadb, ReadyStack's engine database (not published) | python 3.15.2-CE-ubuntu24.04-r3 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1000 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1000 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1000 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1000 |
release_images | sadb, ReadyStack's engine database (not published) | python 3.15.2-CE-ubuntu24.04-r3 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1000 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1000 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |