RabbitMQ 4.4.0-CE-ubuntu24.04-r4 build trail

How ReadyStack built readystack/rabbitmq:4.4.0-CE-ubuntu24.04-r4 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/rabbitmq:4.4.0-CE-ubuntu24.04-r4
  • Index digestsha256:324dbc18d0d6b665682d4472f3db4bfb587789659bfd93725e8f5b4a45dbc9dc
  • linux/amd64 digestsha256:6ac324e6b27674a08484540bee3dc6f42e3dd4e553528575ca19ca21c457de98
  • ArchiveReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.tar.gz
  • Archive SHA-256 now74674ceb82da4e4676acf159af2d5f5c479c2548580d78251e1a52e70d338afb
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T23:54:23Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.trail.json.sigstore ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.trail.json
ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.trail.jsonReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.trail.json.sigstoreReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.trail.mdRabbitMQ product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductRabbitMQ (rabbitmq) [MANIFEST.json]
  • Release tag4.4.0-CE-ubuntu24.04-r4 [MANIFEST.json]
  • Imagereadystack/rabbitmq:4.4.0-CE-ubuntu24.04-r4 [MANIFEST.json]
  • Image index digestsha256:324dbc18d0d6b665682d4472f3db4bfb587789659bfd93725e8f5b4a45dbc9dc [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:6ac324e6b27674a08484540bee3dc6f42e3dd4e553528575ca19ca21c457de98 [ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.tar.gz (bytes 772800790) [MANIFEST.json]
  • Archive sha256 at publish74674ceb82da4e4676acf159af2d5f5c479c2548580d78251e1a52e70d338afb [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/rabbitmq/rabbitmq-server [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv4.4.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit24d5157cd415ef396c8ecd40a2d08c4d7ad3da9f [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash6a00d40c7e109fbc79b2ea0c758e0a1f5379590218d64004836ba2e4b329ebdb (files 3718) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:34b702d6b98c738f26fcea702680dcc12ab464bf9bc49e38fafff38c8e4289e3 [ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1792218268 (utc 2026-10-17T06:24:28Z) [ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.rebuild.json, engine]
  • Engine commit(s)
    • commit 53eeaa1375fde24597366a5342db51d1d1fd7b52 · dirty yes · first drive 3976
    • commit 689d6317d30e65d62baa6df3341eadc3f62cb7de · dirty yes · first drive 3998
    • commit 8a45c451adfbe69e8aea57cade68ffc8092d055e · dirty yes · first drive 4028
    • commit caca4bc272d9fecfaa37251a791885a31c31a18a · dirty yes · first drive 4039
    • commit b5c9dcd9199edee322072a4a29a36a940f9c45a9 · dirty yes · first drive 4053
    • commit d28155d8ca5cbee1adc82a2bd6715600f48c577b · dirty yes · first drive 4063
    • commit af2b965a4592cf93f865060c2ed1124a061bab44 · dirty yes · first drive 4124
    • commit 74325e6b7be1da29339978fad8f76790b4961751 · dirty yes · first drive 4130
    • commit d4d740342d57534a5be731311b519ab879795663 · dirty yes · first drive 4138
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain913 (created 2026-11-09T07:05:34Z · trigger customer_request · upstream version 4.4.0) [chains, chains #913]
  • Requestbuild request #559 (rebuild) (requested at 2026-11-08T05:27:59Z · requested by kitforge-agent · version 4.4.0) [build_requests, build_requests #559]
  • Reasonrevision 4.4.0-CE-ubuntu24.04-r4: same upstream version rebuilt on the chiselled runtime (slim base, #208) [build_requests, build_requests #559 request_reason]
  • Supersedesreadystack/rabbitmq:4.4.0-CE-ubuntu24.04-r3 (chain 819) [chains, chains #819]

The path through the harness

Fully recorded

1 chain · 10 drives · 18 stages · 6 rewinds

Chain 913 release · ready_to_ship

Created 2026-11-09T07:05:34Z, upstream 4.4.0, build request 559 [chains, chains #913]

DriveStartedMinutesBuild hostHow it stopped
39762026-11-09T07:08:10Z79.6build host 5 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3976]
39982026-11-09T10:46:21Z71.4build host 5 withhold-publish ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #3998]
40282026-11-09T13:43:53Z5.7build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4028]
40392026-11-09T14:28:14Z5.8build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4039]
40532026-11-09T15:14:55Z1.2build host 5 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4053]
40632026-11-09T16:02:41Z0.9build host 5 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4063]
41242026-11-09T22:33:06Z1.5build host 5 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #4124]
41302026-11-09T23:05:48Z5.4build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4130]
41382026-11-09T23:35:23Z5.3build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4138]
41412026-11-09T23:47:36Z—build host 5 publish-held not recorded [drive_runs, drive_runs #4141]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-09T07:08:25Z2026-11-09T07:08:25Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 44afc0ca8394…
acquire 2026-11-09T07:08:46Z2026-11-09T07:08:48Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree df64d0ad5408…
license_file 02a4e44df118…
custody_inputs 15b43bc0e1c3…
source_tree_hash d03be5a62fdc…
source_file_manifest e525dc399f90…
plan 2026-11-09T07:09:40Z2026-11-09T07:09:41Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 759585b67477…
input_pin_plan 6b644a78d878…
toolchain_lock 1795aaa8fab4…
assemble_kit 2026-11-09T07:29:27Z2026-11-09T11:00:48Z2
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile fa7cbb0c29dd…
build_recipe b43896b29fdf…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 21ca09f4b336…
verify_offline_sh 3e8184ea230c…
base_image_digests 1906b2aa4352…
dockerfile_offline fa7cbb0c29dd…
first_build_digest d7ea35475570…
remediate 2026-11-09T07:30:13Z2026-11-09T11:00:52Z2
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 55b361c4a35c…
security_report 11dfb7461db4…
build_kit 2026-11-09T08:02:31Z2026-11-09T11:32:54Z2
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 47c180eac634…
locked_digest 187670b45219…
freeze_manifest 8402baa43eb8…
offline_rebuild_transcript f9ed2ef7392c…
verdict 2026-11-09T08:03:57Z2026-11-09T11:34:14Z2
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 186356aa902c…
publish_image 2026-11-09T08:04:46Z2026-11-09T11:35:00Z2
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme ec651225f716…
promotion_record de57e0db06a5…
boot_instance 2026-11-09T08:05:01Z2026-11-09T11:35:17Z4
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle a0c90e421631…
sbom 2026-11-09T08:05:31Z2026-11-09T11:35:43Z2
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md bc08760e477f…
sbom_json c0182354d93d…
schema_discovery 2026-11-09T08:05:35Z2026-11-09T11:35:46Z2
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 7e524ebbf903…
dependency_tree 290fb5d4bd46…
table_classification 5a97eb5570ae…
admin_handbook 2026-11-09T08:11:41Z2026-11-09T11:35:57Z2
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 5d6b9622215f…
admin_handbook 36e485915743…
db_handbook 2026-11-09T08:16:54Z2026-11-09T11:36:10Z2
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 508823af6850…
seed_isolation 0fcd2bf6d0de…
seed_data 2026-11-09T08:17:03Z2026-11-09T11:36:19Z2
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql d05c356dae95…
seed_cases_json ab08ab7fa55c…
seed_validate 2026-11-09T08:17:07Z2026-11-09T11:36:22Z2
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 2f9b195665a2…
usecase_validate 2026-11-09T08:17:30Z2026-11-09T11:36:41Z2
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 9109741aedc7…
test_results 0dd095b854c8…
usecase_contract 269e31cae244…
finalize_docs 2026-11-09T08:22:48Z2026-11-09T11:36:47Z2
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 631fafdcb43b…
release_notes 0df9c26954de…
api_integration_guide 028fa2a9ea6d…
package_archive invalidated 2026-11-09T23:47:11Z 2026-11-09T08:27:45Z2026-11-09T23:40:41Z9
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 1bcb6671d3a6…
checksums 15ec5c49cf76…
verify_md ac553420cbb4…
rebuild_md d91dc0fe8243…
manifest_txt 9f07ed206731…
actions_jsonl c8a6b990fe67…
provenance_md cb5e7f5fe3ea…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 4978e147e987…

[stage_runs]

Rewinds

  • 2026-11-09T10:46:26Z: package_archive to assemble_kit on strategy_changed (strategy changed (63cb1ce343d4 -> 1306f6ed3bc7)) [stage_events, stage_events #28743]
  • 2026-11-09T13:01:46Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28918]
  • 2026-11-09T14:25:36Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29119]
  • 2026-11-09T15:12:34Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29255]
  • 2026-11-09T23:34:05Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29976]
  • 2026-11-09T23:47:11Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29989]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T23:40:41Z.

145 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 010766 —
remediate2001 013135 L-A08, L-038, L-036, L-034, L-032
admin_handbook623103 11339948 —
db_handbook381303 3205286 —
usecase_validate3001 05085 —
finalize_docs381503 4190394 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

6 rounds, 5 counted, $6.49 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T11:58:49Z 884 findings to tests_broken [held_rounds, held_rounds #1613] $1.39 3 rounds, $40.00 b2c02ecd23a3…
2 not counted2026-11-09T12:47:56Z ——— blocked to blocked [held_rounds, held_rounds #1614] — 3 rounds, $40.00 b2c02ecd23a3…
32026-11-09T13:50:27Z 016 findings to repackage [held_rounds, held_rounds #1627] $1.24 3 rounds, $40.00 51addb6cdfdf…
42026-11-09T14:34:53Z 007 clean to repackage [held_rounds, held_rounds #1635] $1.74 3 rounds, $40.00 f4edc090f4ab…
52026-11-09T23:12:08Z 014 findings to repackage [held_rounds, held_rounds #1680] $1.31 3 rounds, $40.00 96a97440bfe2…
62026-11-09T23:41:36Z 000 clean to publish [held_rounds, held_rounds #1683] $0.80 3 rounds, $40.00 1bcb6671d3a6…

Defects

Fully recorded
  • Ledger entries41 [defects, defects where product_slug=rabbitmq and this tag or chain]
  • Disclosed in the archive41 [docs/defects/defects.json, entries]

41 ledger entries: by severity high 11, low 22, critical 8; by status open 2, fixed-before-release 39.

DefectSeverityStatusFound byFixed in
RSD-rabbitmq-262002155b
Ships a known default credential (guest) [defects, defects #202104]		highopenbuild strategy record—
RSD-rabbitmq-f17b7674c7
Security report: Directly follows the known default credential and reads as 'no defaults exist'. [defects, defects #204936]		lowopenheld review (review model)—
RSD-rabbitmq-80e44fcaf8
Admin handbook: The replacement command passes `-c 'rabbitmq-server -hostname <original-hostname>'` after the image. [defects, defects #206394]		criticalfixed-before-releaseheld review (review model)—
RSD-rabbitmq-396b52ff42
Admin handbook: Same defect in the restore procedure: `-c 'rabbitmq-server -hostname <original-hostname>'` does not set the node's hostname, so the restored volume is not found and an empty broker starts. [defects, defects #206395]		criticalfixed-before-releaseheld review (review model)—
RSD-rabbitmq-49f2248d2c
Admin handbook: The restore reads the archive on standard input but `docker run` has no `-i`, so tar receives nothing, fails, and the volume stays empty. [defects, defects #206396]		criticalfixed-before-releaseheld review (review model)—
RSD-rabbitmq-4f317120c1
Admin handbook: `tar -xf backup.tar -C /path/to/volume` extracts on the host as the host user, so the files in a bind-mounted directory belong to that user (not uid 999) and the broker cannot read `.erlang.cookie`;… [defects, defects #206397]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-ca54235684
Admin handbook: POST on /api/users is not a route of the management API; only GET (list) is recorded for this release. [defects, defects #206398]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-2b12e13748
Admin handbook: The status is not always 401: a user with the `management` tag and no permissions got HTTP 404 on `PUT /api/queues/%2F/qq`; an untagged user gets 401 'Not management user'. [defects, defects #206399]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-b6b65e3be1
Database handbook: `--entrypoint tar` is written after the image name, so Docker hands `--entrypoint tar -C ...` to the rabbitmq-server ENTRYPOINT as arguments. [defects, defects #206400]		criticalfixed-before-releaseheld review (review model)—
RSD-rabbitmq-23a873a1b6
Database handbook: Same flag-after-image defect: `backup.tar` receives the boot log of a new broker started on the volume, not a tar archive, so the backup is useless and a second broker touches the data. [defects, defects #206401]		criticalfixed-before-releaseheld review (review model)—
RSD-rabbitmq-9630ad7899
Database handbook: The restore runs `tar -xf backup.tar -C /var/lib/rabbitmq` on the host, where that directory does not exist; nothing reaches the `rabbitmq-data-restore` volume, which the next step mounts empty. [defects, defects #206402]		criticalfixed-before-releaseheld review (review model)—
RSD-rabbitmq-03551fc291
Database handbook: `docker exec` without `-i` does not forward standard input, so tar reads nothing and fails; the restore volume stays empty. [defects, defects #206403]		criticalfixed-before-releaseheld review (review model)—
RSD-rabbitmq-b66da6e882
Database handbook: Extracting with host tar into a host directory and bind-mounting it leaves the files owned by the host user (uid 1000 here), not uid 999. [defects, defects #206404]		criticalfixed-before-releaseheld review (review model)—
RSD-rabbitmq-8d9926913e
Database handbook: A customer is told a supported operation is impossible. [defects, defects #206405]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-29adc81cad
Database handbook: Definitions export contains no messages; a customer relying on it loses queued messages. [defects, defects #206406]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-60c5caa186
Database handbook: Same false claim: messages are not exported by export_definitions, so this is not a backup of messages. [defects, defects #206407]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-906cdae958
API guide: Arguments after the image name are not run as a command, and `rabbitmq-admin` does not exist in the image. [defects, defects #206408]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-403b0ea80c
API guide: Same false claim: a program name passed as an argument is not run, it breaks the server start. [defects, defects #206409]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-9044f43686
API guide: The broker does not start normally with arbitrary words, and they are not RabbitMQ configuration flags. [defects, defects #206410]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-3b3412e582
API guide: Contradicts ADMIN_HANDBOOK 'Managing Plugins' (no restart needed) and is wrong: disable/enable apply to the running broker. [defects, defects #206411]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-c778b5813b
API guide: A fresh volume (or new hostname) gets the default guest user; the sentence says it will not exist. [defects, defects #206412]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-07c470de26
Release notes: `id` is on the image's PATH. [defects, defects #206413]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-97d6a69d58
API guide: The sentence says an unrecognised word makes the VM fail to start; measured on the held digest, the broker boots normally with every word tried, so a customer is told the wrong failure mode and the… [defects, defects #211123]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-64cf1ace9f
API guide: 'only' is false: the management listener also serves its static assets (/js/*) unauthenticated. [defects, defects #211124]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-bef9573a19
Admin handbook: A customer is told a supported operation is impossible; --user with a writable mount works. [defects, defects #211125]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-19648e69e8
API guide: The cookie is not regenerated for a new hostname on the same volume. [defects, defects #211126]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-1933f897c4
Database handbook: Status is not always 401 (the same defect RSD-rabbitmq-2b12e13748 recorded for the admin handbook, now in the database handbook). [defects, defects #211127]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-4344faa262
Admin handbook: A fixed PID that was not measured on this release. [defects, defects #211128]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-1e01dcc301
Database handbook: A fixed PID that was not measured on this release. [defects, defects #211129]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-5a9c765107
Admin handbook: 'root redirect' does not exist: GET / answers 200 directly; the only redirect is /api -> /api/index.html, and that page (and the static assets) are served unauthenticated. [defects, defects #214294]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-75c3be9973
Admin handbook: Same defect as the round-3 'only' finding (API guide line 344, fixed there) paraphrased in the admin handbook: the list reads as exhaustive but static assets and /api/index.html are also… [defects, defects #214295]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-5e87eeed55
Admin handbook: 'All unauthenticated endpoints' is an exhaustive list that omits the static assets and /api/index.html, which are also served without credentials (round-3 'only' defect paraphrased). [defects, defects #214296]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-3bd0e43bf2
API guide: epmd does not run in the foreground; it is started with -daemon. [defects, defects #214297]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-4e89fbd624
Database handbook: Contradicts the same handbook (lines 389, 623, 764) and the running container: epmd (a helper daemon) and the BEAM VM run besides the launcher. [defects, defects #214298]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-2b84aa5bc7
API guide: The command that follows is a `docker exec` of check_port_connectivity: it connects from inside the container to the node's hostname and says nothing about the host's published ports or firewall. [defects, defects #214299]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-aa0cbf6acf
API guide: Tells the customer to mount the same data volume into a second container and to use the same hostname pattern; two nodes must not share a data volume and need distinct node names (rabbit@<hostname>,… [defects, defects #214300]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-0b1e5a2b27
API guide: The documented example for passing a setting with -e uses RABBITMQ_VM_MEMORY_HIGH_WATERMARK, which this broker does not read: the variable reaches the container but the memory limit stays at the… [defects, defects #227505]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-8c57f3f994
API guide: Sibling of the line-689 example: says environment variables control memory limits, which was measured not to hold for the memory watermark. [defects, defects #227506]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-c43cba6f7d
API guide: The list under this heading has one entry (GET /) and reads as complete; the static files and /api/index.html are also unauthenticated (the round-3/round-4 'exhaustive list' class). [defects, defects #227507]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-937d573074
API guide: One-entry list reads as exhaustive and contradicts line 327. [defects, defects #227508]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-124b4d47ef
Database handbook: The command fails as written (the path is not marked as a placeholder and does not exist), and no import command follows although the text says to import. [defects, defects #227509]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:6ac324e6b27674a08484540bee3dc6f42e3dd4e553528575ca19ca21c457de98 · published digest sha256:6ac324e6b27674a08484540bee3dc6f42e3dd4e553528575ca19ca21c457de98 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 940) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T23:48:16Z · failing Docker Scout counts 17 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T23:47:47Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3772884015 · transparency-log entry · integrated 2026-11-09T23:53:04Z) [ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:324dbc18d0d6b665682d4472f3db4bfb587789659bfd93725e8f5b4a45dbc9dc · state attached · log index 3772887150 · transparency-log entry
    • kind sbom · digest sha256:324dbc18d0d6b665682d4472f3db4bfb587789659bfd93725e8f5b4a45dbc9dc · state attached · log index 3772888607 · transparency-log entry
    • kind vsa · digest sha256:324dbc18d0d6b665682d4472f3db4bfb587789659bfd93725e8f5b4a45dbc9dc · state attached · log index 3772890313 · transparency-log entry
    • kind provenance · digest sha256:6ac324e6b27674a08484540bee3dc6f42e3dd4e553528575ca19ca21c457de98 · state attached · log index 3772891881 · transparency-log entry
    • kind sbom · digest sha256:6ac324e6b27674a08484540bee3dc6f42e3dd4e553528575ca19ca21c457de98 · state attached · log index 3772893221 · transparency-log entry
    • kind vsa · digest sha256:6ac324e6b27674a08484540bee3dc6f42e3dd4e553528575ca19ca21c457de98 · state attached · log index 3772894578 · transparency-log entry
    (at 2026-11-09T23:53:04Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/rabbitmq/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T11:58:54Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:6ac324e6b27674a08484540bee3dc6f42e3dd4e553528575ca19ca21c457de98 [clean-room rebuild ledger, runs[697]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-09T11:35:00Z [stage_runs, stage_runs chain 913 stage publish_image]
  • Archive manifests written2026-11-09T23:50:38Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 183 · probed 2026-11-09T11:16:54Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T23:54:23Z generated: by KitForge release/build_trail.py · generator commit 46b5af2067e0dce3119516953acc221a4a6124d6
  • 2026-11-09T23:56:03Z publication: promoted at 2026-11-09T23:55:00Z · promoted digest sha256:324dbc18d0d6b665682d4472f3db4bfb587789659bfd93725e8f5b4a45dbc9dc · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 441 · checklist status complete · checklist at 2026-11-09T23:56:03Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/rabbitmq/4.4.0-CE-ubuntu24.04-r4/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/rabbitmq/4.4.0-CE-ubuntu24.04-r4/), as staged for publishing—
ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.rebuild.jsonbeside the archive (prodasset /data/production/rabbitmq/4.4.0-CE-ubuntu24.04-r4/), as staged for publishing—
ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r4.rebuild.json.sigstorebeside the archive (prodasset /data/production/rabbitmq/4.4.0-CE-ubuntu24.04-r4/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/rabbitmq/4.4.0-CE-ubuntu24.04-r4/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)559
chainssadb, ReadyStack's engine database (not published)913
defectssadb, ReadyStack's engine database (not published)rabbitmq 4.4.0-CE-ubuntu24.04-r4
drive_runssadb, ReadyStack's engine database (not published)chain 913
held_roundssadb, ReadyStack's engine database (not published)chain 913
lesson_recallssadb, ReadyStack's engine database (not published)chain 913
micro_step_runssadb, ReadyStack's engine database (not published)chain 913
release_imagessadb, ReadyStack's engine database (not published)rabbitmq 4.4.0-CE-ubuntu24.04-r4
stage_eventssadb, ReadyStack's engine database (not published)chain 913
stage_runssadb, ReadyStack's engine database (not published)chain 913
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—