RabbitMQ 4.4.0-CE-ubuntu24.04-r5 build trail

How ReadyStack built readystack/rabbitmq:4.4.0-CE-ubuntu24.04-r5 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/rabbitmq:4.4.0-CE-ubuntu24.04-r5
  • Index digestsha256:3d591c179e18f0ed2a7936b4187355a39c191f453bca72c56ca2b496f41b3806
  • linux/amd64 digestsha256:7fe0d6905d79ad1dccf05f065f8f6a1e00f5ca35f8b8444ea0787aeea2cad214
  • ArchiveReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.tar.gz
  • Archive SHA-256 now181419563cca9395051692d55366cfd22f3f144b01c227486ca6620667ba4537
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-12T10:43:55Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.trail.json.sigstore ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.trail.json
ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.trail.jsonReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.trail.json.sigstoreReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.trail.mdRabbitMQ product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductRabbitMQ (rabbitmq) [MANIFEST.json]
  • Release tag4.4.0-CE-ubuntu24.04-r5 [MANIFEST.json]
  • Imagereadystack/rabbitmq:4.4.0-CE-ubuntu24.04-r5 [MANIFEST.json]
  • Image index digestsha256:3d591c179e18f0ed2a7936b4187355a39c191f453bca72c56ca2b496f41b3806 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:7fe0d6905d79ad1dccf05f065f8f6a1e00f5ca35f8b8444ea0787aeea2cad214 [ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.tar.gz (bytes 774758269) [MANIFEST.json]
  • Archive sha256 at publish181419563cca9395051692d55366cfd22f3f144b01c227486ca6620667ba4537 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/rabbitmq/rabbitmq-server [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv4.4.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit24d5157cd415ef396c8ecd40a2d08c4d7ad3da9f [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash6a00d40c7e109fbc79b2ea0c758e0a1f5379590218d64004836ba2e4b329ebdb (files 3718) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:9ca7127c280652340e774f30068a79e9e52860bd39a47d981ef97eca51a7e8af [ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794448319 (utc 2026-11-12T01:51:59Z) [ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
    [ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.rebuild.json, engine]
  • Engine commit(s)
    • commit 47c63b5a708a513f4d8bad7fb7b86da91cf0c944 · dirty yes · first drive 4343
    • commit 9efab228d712a2a7e9bb2eb226729f7f532c3d6a · dirty yes · first drive 4370
    • commit 90a06a5887bb1d16e24cf824619264064842b72d · dirty yes · first drive 4384
    • commit c8155eab7005e164326d14c384d473b047cfc227 · dirty yes · first drive 4400
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain1001 (created 2026-11-12T04:08:00Z · trigger customer_request · upstream version 4.4.0) [chains, chains #1001]
  • Requestbuild request #715 (rebuild) (requested at 2026-11-12T01:52:01Z · requested by kitforge-agent · version 4.4.0) [build_requests, build_requests #715]
  • Reasonrevision 4.4.0-CE-ubuntu24.04-r5: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #715 request_reason]
  • Supersedesreadystack/rabbitmq:4.4.0-CE-ubuntu24.04-r4 (chain 913) [chains, chains #913]

The path through the harness

Fully recorded

1 chain · 4 drives · 18 stages · 3 rewinds

Chain 1001 release · ready_to_ship

Created 2026-11-12T04:08:00Z, upstream 4.4.0, build request 715 [chains, chains #1001]

DriveStartedMinutesBuild hostHow it stopped
43432026-11-12T04:08:24Z82.7build host 2 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4343]
43702026-11-12T08:03:45Z4.6build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4370]
43842026-11-12T09:07:36Z4.4build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4384]
44002026-11-12T10:37:56Z—build host 2 publish-held not recorded [drive_runs, drive_runs #4400]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-12T04:08:34Z2026-11-12T04:08:35Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 28d49d86c5a4…
acquire 2026-11-12T04:08:41Z2026-11-12T04:08:42Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree df64d0ad5408…
license_file 02a4e44df118…
custody_inputs 15b43bc0e1c3…
source_tree_hash d03be5a62fdc…
source_file_manifest e525dc399f90…
plan 2026-11-12T04:09:26Z2026-11-12T04:09:27Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 3d2059f9a5d5…
input_pin_plan 5d11e44e091a…
toolchain_lock e541c336a428…
assemble_kit 2026-11-12T04:25:13Z2026-11-12T04:25:15Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile baa44c038408…
build_recipe 7cf42acde72b…
system_pinning aa8db05a9a8a…
build_offline_sh 6ab4f08a6ec7…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 75906c5b30c1…
verify_offline_sh 3e8184ea230c…
base_image_digests 1906b2aa4352…
dockerfile_offline baa44c038408…
first_build_digest 70d1454727d2…
remediate 2026-11-12T04:26:07Z2026-11-12T04:26:08Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log a19935e457e2…
security_report 44d4ec52c7bd…
build_kit 2026-11-12T04:53:56Z2026-11-12T04:53:57Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp f0e9869cff42…
locked_digest 452fc50959ed…
freeze_manifest 44454558950b…
offline_rebuild_transcript 0ff514ebc778…
verdict 2026-11-12T04:54:59Z2026-11-12T04:55:00Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 6e5b85cafc92…
publish_image 2026-11-12T04:55:43Z2026-11-12T04:55:44Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 1ad6fb8a755a…
promotion_record 607f90ecfb86…
boot_instance 2026-11-12T04:55:56Z2026-11-12T04:56:00Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle e20d4908223b…
sbom 2026-11-12T04:56:18Z2026-11-12T04:56:19Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 8edc4c329131…
sbom_json 16abec16a916…
schema_discovery 2026-11-12T04:56:21Z2026-11-12T04:56:22Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 7e524ebbf903…
dependency_tree 290fb5d4bd46…
table_classification 5a97eb5570ae…
admin_handbook 2026-11-12T05:01:02Z2026-11-12T05:01:03Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 5d6b9622215f…
admin_handbook 3ea307949892…
db_handbook 2026-11-12T05:06:20Z2026-11-12T05:06:21Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 31c0a81a2043…
seed_isolation 0fcd2bf6d0de…
seed_data 2026-11-12T05:06:28Z2026-11-12T05:06:29Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql d05c356dae95…
seed_cases_json afee76bfae11…
seed_validate 2026-11-12T05:06:31Z2026-11-12T05:06:32Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 96d93c2aa0f7…
usecase_validate 2026-11-12T05:06:54Z2026-11-12T05:06:55Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 12457f27323e…
test_results 0d78d112cfec…
usecase_contract ae57627b4cb4…
finalize_docs 2026-11-12T05:11:31Z2026-11-12T05:11:32Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json b997e02745f8…
release_notes a1969b9a0064…
api_integration_guide b37123167e0b…
package_archive invalidated 2026-11-12T10:37:33Z 2026-11-12T05:31:00Z2026-11-12T09:12:01Z3
36 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 unpack_files
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar ef4e85b003a3…
checksums 8eb0b789a6d9…
verify_md 80621a6bfe9a…
rebuild_md 7107a7b33cee…
manifest_txt 9fbc60f0d1eb…
actions_jsonl 27998fb8b2a4…
provenance_md e0652c05f254…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 4872d70c459e…

[stage_runs]

Rewinds

  • 2026-11-12T06:13:13Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33079]
  • 2026-11-12T08:35:02Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33265]
  • 2026-11-12T10:37:33Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #33483]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-12T09:12:01Z.

89 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 010936 —
remediate2001 013773 L-A08, L-038, L-036, L-034, L-032
admin_handbook25503 0125317 —
db_handbook32903 2158108 —
usecase_validate2001 03433 —
finalize_docs26603 0122719 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $5.46 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-12T05:31:50Z 256 findings to repackage [held_rounds, held_rounds #1780] $1.60 3 rounds, $40.00 1c64247a42de…
22026-11-12T08:08:51Z 0114 findings to repackage [held_rounds, held_rounds #1792] $1.84 3 rounds, $40.00 3f4d826d1917…
32026-11-12T09:12:46Z 0022 clean to publish [held_rounds, held_rounds #1800] $2.01 3 rounds, $40.00 ef4e85b003a3…

Defects

Fully recorded
  • Ledger entries52 [defects, defects where product_slug=rabbitmq and this tag or chain]
  • Disclosed in the archive52 [docs/defects/defects.json, entries]

52 ledger entries: by severity high 7, low 43, critical 2; by status open 4, fixed-before-release 48.

DefectSeverityStatusFound byFixed in
RSD-rabbitmq-f8a69b567f
Ships a known default credential (guest) [defects, defects #257832]		highopenbuild strategy record—
RSD-rabbitmq-3284f3a3a1
Security report: Directly follows the known default credential and reads as 'no defaults exist'. [defects, defects #257833]		lowopenheld review (review model)—
RSD-rabbitmq-77ee97491c
Admin handbook: The restore reads backup.tar on stdin but `docker run` has no -i, so stdin is not forwarded: tar fails and the new volume stays EMPTY; the next step then boots an empty broker (guest only) that… [defects, defects #258332]		criticalfixed-before-releaseheld review (review model)—
RSD-rabbitmq-4e0b31c414
Database handbook: Same defect as the admin restore: no -i, so tar gets no input, the restored volume is empty and the following docker run starts an empty broker. [defects, defects #258333]		criticalfixed-before-releaseheld review (review model)—
RSD-rabbitmq-e6ac7869cb
Admin handbook: `hostname` is not in the image (chiselled runtime), so the documented command fails exactly in the step a customer needs to recover data. [defects, defects #258334]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-bf16e7bd82
Admin handbook: The example container never boots: the node name's host part must resolve, and 'custom-host' is not the container's hostname. [defects, defects #258335]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-1be75286c1
Database handbook: The example `docker run IMAGE -detached` does not boot the broker normally; the entrypoint daemonises and PID 1 exits, so the container stops. [defects, defects #258336]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-f82ca3998f
Admin handbook: The stated prerequisite (Docker Engine 20.10) contradicts docs/REBUILD.md, which requires buildx 0.30 or later plus jq, tar and curl, linux/amd64, and `tar -xp`. [defects, defects #258337]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-68637aa2d5
Release notes: Replacing the container on the same volume with a default (random) hostname boots an EMPTY broker (only guest), leaving all queues, users and messages unused; the upgrade instruction omits the… [defects, defects #258338]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-7266b0a8ab
Admin handbook: Not every unpermitted operation returns 401: a user with the management tag and no vhost permission gets 404 from /api/queues/%2F. [defects, defects #258339]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-fa34cc0cd9
Admin handbook: `myuser` is never created in this procedure (the user created earlier is `myadmin`), so the command fails. [defects, defects #258340]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-d910f1a48a
Admin handbook: A host file mounted there with mode 600 owned by the host user (the default for many editors/docker cp) is unreadable by uid 999 and the broker will not boot; the document gives no warning. [defects, defects #258341]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-1bfbb17b4d
Database handbook: rabbitmqctl exists only inside the container; run on the host as written the command fails (every other rabbitmqctl command in the handbooks is prefixed with docker exec). [defects, defects #258342]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-6a0a62ba51
API guide: The working directory is `/`, not /var/lib/rabbitmq. [defects, defects #258343]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-5aab7c96d7
API guide: The endpoint serves Prometheus text format 0.0.4 and refuses OpenMetrics negotiation. [defects, defects #258344]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-c6dab3af13
Database handbook: The restore procedure ends with a docker run that reuses the name of the stopped original container, so it fails with a name conflict. [defects, defects #260946]		highfixed-before-releaseheld review (review model)—
RSD-rabbitmq-62cc78c6f5
Database handbook: The example starts rabbitmq-new on the same volume and hostname without first stopping or removing rabbitmq; Docker accepts it and two live brokers share one data directory. [defects, defects #260947]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-1e26a4213e
Admin handbook: The recovery step reads the hostname with docker inspect of the container being replaced, which fails once that container has been removed (the order the section describes). [defects, defects #260948]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-97f6c9b23b
Admin handbook: Says all /api/* paths require authentication; /api/index.html answers 200 without credentials, as the other handbooks state. [defects, defects #260949]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-9dbdd6f933
Admin handbook: Same contradiction as line 492. [defects, defects #260950]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-9147b2ab05
Admin handbook: Says the launcher and BEAM are the only processes, in the same paragraph that lists epmd, erl_child_setup and inet_gethost as running alongside. [defects, defects #260951]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-18f90bc2b5
Database handbook: Claims no separate processes run, contradicting the handbook's own list of epmd, erl_child_setup and inet_gethost. [defects, defects #260952]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-8fbe0e469f
API guide: Says the launcher is a child of the container's init, contradicting 'PID 1 is the /bin/sh launcher script' in the same paragraph. [defects, defects #260953]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-7dc0974cff
Admin handbook: States that words after the image name leave the broker running normally; -detached does not, as the handbook says elsewhere. [defects, defects #260954]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-7860e621a3
Admin handbook: Presents the plugin list as persisted without saying it is lost when the container is replaced, which the handbooks prescribe for upgrades. [defects, defects #260955]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-acc821afef
API guide: Claims all three health methods verify the same condition including that connections are accepted on 5672 and 15672; the probes check the node and the 15692 listener only. [defects, defects #260956]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-b5aaf42a10
API guide: The export example leaves the file only in the container's writable layer and never says to copy it out, so it is lost with the container. [defects, defects #260957]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-bda7413ead
Database handbook: Names OCF cluster-resource files as the Apache-licensed part, but the image ships none; the non-MPL parts are the bundled UI/Erlang libraries. [defects, defects #260958]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-eeaa9d823b
API guide: Same unsupported licence statement as in the DB handbook. [defects, defects #260959]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-7c6086743d
Docker Hub README: Advertises MQTT, STOMP and replicated queues for an image that enables neither protocol plugin and runs one node. [defects, defects #260960]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-443eec0f8d
Admin handbook: Example starts rabbitmq-new on the same volume and hostname without first stopping or removing rabbitmq (round-2 finding not fixed here). [defects, defects #263964]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-fab375c70a
Database handbook: Same example without removing the original container. [defects, defects #263965]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-59b41d5a62
API guide: Replacement example never removes the original container, so two live brokers can share one data directory. [defects, defects #263966]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-44b729becd
Admin handbook: Says only the direct BEAM broker process runs, contradicting the launcher-is-PID-1 sentence just above and the helper-process list at line 717. [defects, defects #263967]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-af33b5732c
Admin handbook: 'Runs RabbitMQ as a single process' in the rewritten Broker Processes section contradicts the handbook's own list of helper processes (line 717) -- same class as the round-2 process findings. [defects, defects #263968]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-a4868459c6
API guide: Says the broker runs as a single process, contradicting API_INTEGRATION_GUIDE.md:234 and :611 which list the helper processes. [defects, defects #263969]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-d6dcafd5ef
Database handbook: Says words after the image name leave the broker starting normally; -detached does not (round-2 finding, still present here). [defects, defects #263970]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-f7783bbce8
API guide: Claims rabbitmq-plugins fails in a new container; it succeeds offline. [defects, defects #263971]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-3a15c19540
API guide: The restore block hard-codes `--hostname broker-1`, which only matches if the reader had started the original with that name; with the guide's documented start command the restored broker is… [defects, defects #263972]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-cf4950ce44
Admin handbook: Round-2 finding class ('all /api/* paths require authentication'); 'All REST API calls ... [defects, defects #263973]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-ab9ee703d0
Admin handbook: Round-2 finding class ('all /api/* paths require authentication'); /api/index.html answers 200 unauthenticated. [defects, defects #263974]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-f7ef499868
Admin handbook: Round-2 finding class ('all /api/* paths require authentication'); same [defects, defects #263975]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-50e7cc10cd
Admin handbook: Round-2 finding class ('all /api/* paths require authentication'); same [defects, defects #263976]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-7c24cbd9b8
Database handbook: Says the API requires authentication, then lists /api/index.html (unauthenticated) as a key endpoint. [defects, defects #263977]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-dee0a8c8be
API guide: Table says all /api/* endpoints require credentials, contradicting line 110 and 334. [defects, defects #263978]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-438e8d88c9
API guide: Says all /api/* requests need authentication; /api/index.html does not. [defects, defects #263979]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-af366609c2
API guide: Says all API requests need credentials, then lists /api/index.html as unauthenticated. [defects, defects #263980]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-0d029ece94
API guide: Calls the metrics endpoint and login page the only unauthenticated endpoints; /api/index.html and static files are too (lines 110, 696). [defects, defects #263981]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-7fa2202f64
Admin handbook: TLS procedure ends with 'Restart the container' but the TLS ports were never published. [defects, defects #263982]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-7cc457536e
Admin handbook: Says the boot check confirms the broker 'accepts connections'; the script only asserts the health probe. [defects, defects #263983]		lowfixed-before-releaseheld review (review model)—
RSD-rabbitmq-27c6925d6c
Docker Hub README: The problem named by the open RSD-rabbitmq-7c6086743d stands: the README still advertises MQTT and STOMP, which the image does not enable. [defects, defects #263984]		lowopenheld review (review model)—
RSD-rabbitmq-468fad0515
Docker Hub README: 'a replicated queue keeps the orders safe if a broker node fails' is not possible on a one-node image (RSD-rabbitmq-7c6086743d). [defects, defects #263985]		lowopenheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:7fe0d6905d79ad1dccf05f065f8f6a1e00f5ca35f8b8444ea0787aeea2cad214 · published digest sha256:7fe0d6905d79ad1dccf05f065f8f6a1e00f5ca35f8b8444ea0787aeea2cad214 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 817) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T10:38:23Z · failing Docker Scout counts 17 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T10:38:06Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3830512403 · transparency-log entry · integrated 2026-11-12T10:42:35Z) [ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:3d591c179e18f0ed2a7936b4187355a39c191f453bca72c56ca2b496f41b3806 · state attached · log index 3830514916 · transparency-log entry
    • kind sbom · digest sha256:3d591c179e18f0ed2a7936b4187355a39c191f453bca72c56ca2b496f41b3806 · state attached · log index 3830516253 · transparency-log entry
    • kind vsa · digest sha256:3d591c179e18f0ed2a7936b4187355a39c191f453bca72c56ca2b496f41b3806 · state attached · log index 3830517798 · transparency-log entry
    • kind provenance · digest sha256:7fe0d6905d79ad1dccf05f065f8f6a1e00f5ca35f8b8444ea0787aeea2cad214 · state attached · log index 3830519284 · transparency-log entry
    • kind sbom · digest sha256:7fe0d6905d79ad1dccf05f065f8f6a1e00f5ca35f8b8444ea0787aeea2cad214 · state attached · log index 3830520534 · transparency-log entry
    • kind vsa · digest sha256:7fe0d6905d79ad1dccf05f065f8f6a1e00f5ca35f8b8444ea0787aeea2cad214 · state attached · log index 3830522467 · transparency-log entry
    (at 2026-11-12T10:42:36Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/rabbitmq/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-12T05:31:57Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:7fe0d6905d79ad1dccf05f065f8f6a1e00f5ca35f8b8444ea0787aeea2cad214 [clean-room rebuild ledger, runs[773]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-12T04:55:44Z [stage_runs, stage_runs chain 1001 stage publish_image]
  • Archive manifests written2026-11-12T10:40:34Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 183 · probed 2026-11-12T04:40:03Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-12T10:43:55Z generated: by KitForge release/build_trail.py · generator commit 8179ce1fe45ed3d29eb2493df831304e9064c094
  • 2026-11-12T10:45:31Z publication: promoted at 2026-11-12T10:44:35Z · promoted digest sha256:3d591c179e18f0ed2a7936b4187355a39c191f453bca72c56ca2b496f41b3806 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 496 · checklist status complete · checklist at 2026-11-12T10:45:31Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/rabbitmq/4.4.0-CE-ubuntu24.04-r5/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/rabbitmq/4.4.0-CE-ubuntu24.04-r5/), as staged for publishing—
ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.rebuild.jsonbeside the archive (prodasset /data/production/rabbitmq/4.4.0-CE-ubuntu24.04-r5/), as staged for publishing—
ReadyStack-rabbitmq-4.4.0-CE-ubuntu24.04-r5.rebuild.json.sigstorebeside the archive (prodasset /data/production/rabbitmq/4.4.0-CE-ubuntu24.04-r5/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/rabbitmq/4.4.0-CE-ubuntu24.04-r5/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)715
chainssadb, ReadyStack's engine database (not published)1001
defectssadb, ReadyStack's engine database (not published)rabbitmq 4.4.0-CE-ubuntu24.04-r5
drive_runssadb, ReadyStack's engine database (not published)chain 1001
held_roundssadb, ReadyStack's engine database (not published)chain 1001
lesson_recallssadb, ReadyStack's engine database (not published)chain 1001
micro_step_runssadb, ReadyStack's engine database (not published)chain 1001
release_imagessadb, ReadyStack's engine database (not published)rabbitmq 4.4.0-CE-ubuntu24.04-r5
stage_eventssadb, ReadyStack's engine database (not published)chain 1001
stage_runssadb, ReadyStack's engine database (not published)chain 1001
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—