Rancher v2.15.3-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/rancher:v2.15.3-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/rancher:v2.15.3-CE-ubuntu24.04-r1
  • Index digestsha256:79cb3e49cd0804c227a2ad46876174623c8b14fe15b8e1480d26cdbcfd48d0d5
  • linux/amd64 digestsha256:af840225c766507ce7493ed633c4b13abb4af52318e56a874c97ae91d1813ec5
  • ArchiveReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 now302f09e1fd4c220c285c5cf3360edda33fbff05bc75245428d4dcf3924bb3057
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T04:49:22Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.trail.json
ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.trail.jsonReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.trail.mdRancher product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductRancher (rancher) [MANIFEST.json]
  • Release tagv2.15.3-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/rancher:v2.15.3-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:79cb3e49cd0804c227a2ad46876174623c8b14fe15b8e1480d26cdbcfd48d0d5 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:af840225c766507ce7493ed633c4b13abb4af52318e56a874c97ae91d1813ec5 [ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.tar.gz (bytes 1289593793) [MANIFEST.json]
  • Archive sha256 at publish302f09e1fd4c220c285c5cf3360edda33fbff05bc75245428d4dcf3924bb3057 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/rancher/rancher.git [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv2.15.3 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit99ab89e90bf1d048f3f7acf7f05b132bf5a23a8e [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash389bc99573d35826f00bcdbf17d45800ba96c521d45afeac7186841c395e2833 (files 3081) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:dc44fc5f8e358840b63a7fee51ec4db18cf84f22e4e04c5db3ca845d9e9757ff [ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793279058 (utc 2026-10-29T13:04:18Z) [ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit c9b2cfb702f16a4b1ed477ccfcb627952bad2a67 · dirty yes · first drive 3724
    • commit debed1ff88426b9337ee3418aa295a436ca89365 · dirty yes · first drive 3778
    • commit 6a0c6c5f7eda9bf939476cbe90b2b4c99cba667b · dirty yes · first drive 3799
    • commit 21e2c6702a4d838f43dd7fa67a5efb86680ec1df · dirty yes · first drive 3817
    • commit 102f2cb2483a25dd5f31f98f8653ad1a9d42a282 · dirty yes · first drive 3923
    • commit ad5518ca1c1c954ca1b6beaf515310601159f544 · dirty yes · first drive 3936
    • commit cff175c7916b19e138784c06e8e05392550947fe · dirty yes · first drive 3939
    • commit 1432ad5c474910e63a4925b704dfe755a994b66f · dirty yes · first drive 3951
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain871 (created 2026-11-08T07:18:32Z · trigger customer_request · upstream version v2.15.3) [chains, chains #871]
  • Requestbuild request #561 (rebuild) (requested at 2026-11-08T06:35:33Z · requested by kitforge-agent · version v2.15.3) [build_requests, build_requests #561]
  • Reasonretarget to v2.15.3: a newer upstream release (rule 1) [build_requests, build_requests #561 request_reason]
  • Supersedesreadystack/rancher:v2.15.2-CE-ubuntu24.04-r3 (chain 753) [chains, chains #753]

The path through the harness

Fully recorded

1 chain · 8 drives · 18 stages · 4 rewinds

Chain 871 release · ready_to_ship

Created 2026-11-08T07:18:32Z, upstream v2.15.3, build request 561 [chains, chains #871]

DriveStartedMinutesBuild hostHow it stopped
37242026-11-08T07:19:27Z100.8build host 5 withhold-publish stage_failed at verdict; first failed check scout_verdict:release_check_passed; 7 ticks [drive_runs, drive_runs #3724]
37782026-11-08T11:26:25Z2.4build host 5 withhold-publish stage_failed at assemble_kit; first failed check exists:first_build_digest; 1 tick [drive_runs, drive_runs #3778]
37992026-11-08T12:32:48Z2.2build host 5 withhold-publish stage_failed at assemble_kit; first failed check exists:first_build_digest; 1 tick [drive_runs, drive_runs #3799]
38172026-11-08T14:12:39Z135build host 5 withhold-publish ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #3817]
39232026-11-09T02:12:09Z18build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3923]
39362026-11-09T03:26:26Z0.3build host 5 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3936]
39392026-11-09T03:41:21Z18.8build host 5 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3939]
39512026-11-09T04:29:15Z—build host 5 publish-held not recorded [drive_runs, drive_runs #3951]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-08T07:19:38Z2026-11-08T07:19:38Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 51c671ea18eb…
acquire 2026-11-08T07:20:11Z2026-11-08T07:20:13Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 30c9e537bce8…
license_file 809fa1ed2145…
custody_inputs b686bb88a0db…
source_tree_hash fa08b83f94b7…
source_file_manifest 087f2232f686…
plan 2026-11-08T07:21:09Z2026-11-08T07:21:10Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 607aafe2cf4a…
input_pin_plan 2e52f4c53666…
toolchain_lock 62bf3263f5fe…
assemble_kit 2026-11-08T07:56:11Z2026-11-08T14:33:25Z4
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 9e56c684059a…
build_recipe 261294b517bb…
system_pinning 853301e7237b…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 4e10a2d42784…
verify_offline_sh 3e8184ea230c…
base_image_digests 697556f7ac6d…
dockerfile_offline 9e56c684059a…
first_build_digest bcb213f8bbae…
remediate 2026-11-08T07:57:14Z2026-11-08T14:33:29Z2
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 08950c36d934…
security_report 43b8ce1d15ea…
build_kit 2026-11-08T08:51:58Z2026-11-08T15:26:22Z2
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 8f92b2759b6b…
locked_digest 0eda908c898b…
freeze_manifest dbf897c5d49c…
offline_rebuild_transcript a62a861f4dce…
verdict 2026-11-08T09:00:15Z2026-11-08T15:32:39Z2
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 25684d4b024c…
publish_image 2026-11-08T15:35:14Z2026-11-08T15:35:15Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 9785d2e997db…
promotion_record 30880f0c716a…
boot_instance 2026-11-08T15:36:27Z2026-11-08T15:36:30Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 427323ef8628…
sbom 2026-11-08T15:37:42Z2026-11-08T15:37:43Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 074bc1041851…
sbom_json c647e7e00a63…
schema_discovery 2026-11-08T15:37:46Z2026-11-08T15:37:47Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash cc0ffff503f7…
dependency_tree 5b0135338904…
table_classification e05f65fa9ab9…
admin_handbook 2026-11-08T15:37:58Z2026-11-08T15:37:59Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 5d246fb6fcc5…
admin_handbook c42d28a1f56c…
db_handbook 2026-11-08T15:38:14Z2026-11-08T15:38:14Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook e74762953219…
seed_isolation b619159b9061…
seed_data 2026-11-08T15:38:53Z2026-11-08T15:38:53Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 1c01795f9ad5…
seed_cases_json 6899bc38b88c…
seed_validate 2026-11-08T15:38:56Z2026-11-08T15:38:57Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 8df8ab6e3a73…
usecase_validate 2026-11-08T15:40:16Z2026-11-08T15:40:17Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests efb4afea398a…
test_results c45e1d3ec84b…
usecase_contract 0408d3632205…
finalize_docs 2026-11-08T15:40:23Z2026-11-08T15:40:24Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json e88f4ccba597…
release_notes 57bba4028ee8…
api_integration_guide c4ad192da170…
package_archive invalidated 2026-11-09T04:28:45Z 2026-11-08T16:27:31Z2026-11-09T04:00:10Z4
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 38589404261a…
checksums a414bd163ccb…
verify_md 6a1c9f9b01a3…
rebuild_md 3954e0670ee3…
manifest_txt de25bd68a8c3…
actions_jsonl fecc2f8c653c…
provenance_md f1ced0d50561…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 109d286c6866…

[stage_runs]

Rewinds

  • 2026-11-08T11:26:29Z: verdict to assemble_kit on strategy_changed (strategy changed (5afbe4c9f6ab -> 55cb9e21362f)) [stage_events, stage_events #26012]
  • 2026-11-09T00:35:56Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27700]
  • 2026-11-09T03:00:00Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27901]
  • 2026-11-09T04:28:45Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27983]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T04:00:10Z.

7 calls over 3 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 013168 —
remediate2001 017091 L-A08, L-038, L-036, L-034, L-032
usecase_validate3001 08042 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $1.93 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-08T16:30:45Z 05627 blocked to blocked [held_rounds, held_rounds #1528] $0.78 3 rounds, $40.00 ebbf63f66601…
22026-11-09T02:31:38Z 002 clean to repackage [held_rounds, held_rounds #1567] $0.56 3 rounds, $40.00 cfb6447386a5…
32026-11-09T04:01:56Z 001 clean to publish [held_rounds, held_rounds #1573] $0.59 3 rounds, $40.00 38589404261a…

Defects

Fully recorded
  • Ledger entries41 [defects, defects where product_slug=rancher and this tag or chain]
  • Disclosed in the archive41 [docs/defects/defects.json, entries]

41 ledger entries: by severity low 17, high 24; by status open 1, fixed-before-release 40.

DefectSeverityStatusFound byFixed in
RSD-rancher-4ddf78b1c8
The bundled system-upgrade-controller never starts on this release: its pod stays in ContainerCreating (`mkdir /etc/pki: permission denied`) [defects, defects #178954]		lowopenheld review (review model)—
RSD-rancher-f1888eb003
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180796]		lowfixed-before-releaseheld review (review model)—
RSD-rancher-b29402e52f
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180797]		lowfixed-before-releaseheld review (review model)—
RSD-rancher-4670c18354
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180798]		highfixed-before-releaseheld review (review model)—
RSD-rancher-c62d4c4e7f
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180799]		highfixed-before-releaseheld review (review model)—
RSD-rancher-e6f2c7565c
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180800]		lowfixed-before-releaseheld review (review model)—
RSD-rancher-aafc9b35d7
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180801]		lowfixed-before-releaseheld review (review model)—
RSD-rancher-8a543bb3b9
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180802]		lowfixed-before-releaseheld review (review model)—
RSD-rancher-472512bc43
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180803]		highfixed-before-releaseheld review (review model)—
RSD-rancher-1157250686
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180804]		highfixed-before-releaseheld review (review model)—
RSD-rancher-fd7478a114
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180805]		highfixed-before-releaseheld review (review model)—
RSD-rancher-9d8ee3d16f
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180806]		lowfixed-before-releaseheld review (review model)—
RSD-rancher-d1fd40c950
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180807]		lowfixed-before-releaseheld review (review model)—
RSD-rancher-12463a5c39
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180808]		lowfixed-before-releaseheld review (review model)—
RSD-rancher-09bf4a564f
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180809]		lowfixed-before-releaseheld review (review model)—
RSD-rancher-c7a7265004
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180810]		highfixed-before-releaseheld review (review model)—
RSD-rancher-0c40c529ea
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180811]		highfixed-before-releaseheld review (review model)—
RSD-rancher-d8752b9c43
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180812]		highfixed-before-releaseheld review (review model)—
RSD-rancher-da494e3e9a
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180813]		highfixed-before-releaseheld review (review model)—
RSD-rancher-61efdd5a37
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180814]		highfixed-before-releaseheld review (review model)—
RSD-rancher-43596b44a5
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180815]		highfixed-before-releaseheld review (review model)—
RSD-rancher-2a59efd0f7
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180816]		highfixed-before-releaseheld review (review model)—
RSD-rancher-eb628c5199
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180817]		highfixed-before-releaseheld review (review model)—
RSD-rancher-8b19687699
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180818]		highfixed-before-releaseheld review (review model)—
RSD-rancher-01780e1710
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180819]		highfixed-before-releaseheld review (review model)—
RSD-rancher-ffb3380408
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180820]		highfixed-before-releaseheld review (review model)—
RSD-rancher-15cd17b8cb
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180821]		highfixed-before-releaseheld review (review model)—
RSD-rancher-35fe4892d0
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180822]		lowfixed-before-releaseheld review (review model)—
RSD-rancher-f58cb0dbb8
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180823]		lowfixed-before-releaseheld review (review model)—
RSD-rancher-30f003e238
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180824]		highfixed-before-releaseheld review (review model)—
RSD-rancher-97a9815356
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180825]		highfixed-before-releaseheld review (review model)—
RSD-rancher-0098a5aa3b
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180826]		highfixed-before-releaseheld review (review model)—
RSD-rancher-7094158073
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180827]		highfixed-before-releaseheld review (review model)—
RSD-rancher-0242544471
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180828]		highfixed-before-releaseheld review (review model)—
RSD-rancher-fdba1e4c23
Admin handbook: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180829]		highfixed-before-releaseheld review (review model)—
RSD-rancher-acda519b59
API guide: Value is the v2.15.2 image's; this image's environment differs [defects, defects #180830]		lowfixed-before-releaseheld review (review model)—
RSD-rancher-7db9edf7f3
Admin handbook: New sentence says the three other upstream paths have no counterpart in this image; they are declared here too (and the table row above says only /var/lib/rancher) [defects, defects #180831]		highfixed-before-releaseheld review (review model)—
RSD-rancher-f548a701f7
API guide: Section promises a status table but lists no request [defects, defects #180832]		lowfixed-before-releaseheld review (review model)—
RSD-rancher-347ba7370a
Admin handbook: IMAGE_CONFIG.json Volumes = /var/lib/cni, /var/lib/kubelet, /var/lib/rancher, /var/log; docker inspect of the running container shows anonymous volumes at /var/log etc. [defects, defects #190735]		lowfixed-before-releaseheld review (review model)—
RSD-rancher-afa9c39784
API guide: The section 'Requests verified against this release' (lines 877-890) has a header-only table and its curl example ends after the login, so no verified request is listed (open defect… [defects, defects #190736]		lowfixed-before-releaseheld review (review model)—
RSD-rancher-240de300f3
API guide: Section 'Requests verified against this release' says requests were sent but lists none; the table is header-only. [defects, defects #192616]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:af840225c766507ce7493ed633c4b13abb4af52318e56a874c97ae91d1813ec5 · published digest sha256:af840225c766507ce7493ed633c4b13abb4af52318e56a874c97ae91d1813ec5 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 1532) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T04:30:20Z · failing Docker Scout counts 139 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T04:29:26Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3761223154 · transparency-log entry · integrated 2026-11-09T04:47:05Z) [ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:79cb3e49cd0804c227a2ad46876174623c8b14fe15b8e1480d26cdbcfd48d0d5 · state attached · log index 3761224464 · transparency-log entry
    • kind sbom · digest sha256:79cb3e49cd0804c227a2ad46876174623c8b14fe15b8e1480d26cdbcfd48d0d5 · state attached · log index 3761225208 · transparency-log entry
    • kind vsa · digest sha256:79cb3e49cd0804c227a2ad46876174623c8b14fe15b8e1480d26cdbcfd48d0d5 · state attached · log index 3761226638 · transparency-log entry
    • kind provenance · digest sha256:af840225c766507ce7493ed633c4b13abb4af52318e56a874c97ae91d1813ec5 · state attached · log index 3761227924 · transparency-log entry
    • kind sbom · digest sha256:af840225c766507ce7493ed633c4b13abb4af52318e56a874c97ae91d1813ec5 · state attached · log index 3761228789 · transparency-log entry
    • kind vsa · digest sha256:af840225c766507ce7493ed633c4b13abb4af52318e56a874c97ae91d1813ec5 · state attached · log index 3761229821 · transparency-log entry
    (at 2026-11-09T04:47:05Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/rancher/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-08T16:30:54Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:af840225c766507ce7493ed633c4b13abb4af52318e56a874c97ae91d1813ec5 [clean-room rebuild ledger, runs[660]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-08T15:35:15Z [stage_runs, stage_runs chain 871 stage publish_image]
  • Archive manifests written2026-11-09T04:37:51Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 1044 · probed 2026-11-08T15:00:28Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T04:49:22Z generated: by KitForge release/build_trail.py · generator commit 33cc96c2cc3645c7bfbc3866df5a3c028834af3e
  • 2026-11-09T04:53:29Z publication: promoted at 2026-11-09T04:50:08Z · promoted digest sha256:79cb3e49cd0804c227a2ad46876174623c8b14fe15b8e1480d26cdbcfd48d0d5 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 405 · checklist status complete · checklist at 2026-11-09T04:53:29Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/rancher/v2.15.3-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/rancher/v2.15.3-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/rancher/v2.15.3-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-rancher-v2.15.3-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/rancher/v2.15.3-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/rancher/v2.15.3-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)561
chainssadb, ReadyStack's engine database (not published)871
defectssadb, ReadyStack's engine database (not published)rancher v2.15.3-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 871
held_roundssadb, ReadyStack's engine database (not published)chain 871
lesson_recallssadb, ReadyStack's engine database (not published)chain 871
micro_step_runssadb, ReadyStack's engine database (not published)chain 871
release_imagessadb, ReadyStack's engine database (not published)rancher v2.15.3-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 871
stage_runssadb, ReadyStack's engine database (not published)chain 871
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—