Redash v26.9.0-CE-ubuntu24.04-r6 build trail
How ReadyStack built readystack/redash:v26.9.0-CE-ubuntu24.04-r6 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/redash:v26.9.0-CE-ubuntu24.04-r6 - Index digestsha256:e0c85ba45d4770fbe16ef1c5171712df365cacb69e4505a38369efc5883f9f91
- linux/amd64 digestsha256:0d868f4f8f3713ca692cef0ed470f910db9707ce3c971aa038b962948ffafda8
- Archive
ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.tar.gz - Archive SHA-256 now9d04e5451c32928562a564a48eb0aae3866106757a011a86b16bfa5d5cfb0b88
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-10T08:14:35Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.trail.json.sigstore ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductRedash (redash) [MANIFEST.json]
- Release tagv26.9.0-CE-ubuntu24.04-r6 [MANIFEST.json]
- Imagereadystack/redash:v26.9.0-CE-ubuntu24.04-r6 [MANIFEST.json]
- Image index digestsha256:e0c85ba45d4770fbe16ef1c5171712df365cacb69e4505a38369efc5883f9f91 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:0d868f4f8f3713ca692cef0ed470f910db9707ce3c971aa038b962948ffafda8 [ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.tar.gz (bytes 576178899) [MANIFEST.json]
- Archive sha256 at publish9d04e5451c32928562a564a48eb0aae3866106757a011a86b16bfa5d5cfb0b88 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/getredash/redash [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv26.9.0 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit42fdf9d4a0fdb83841130ab78f69899a224f281b [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash973cb2459034cd07deb972d5e4ede590ec4baf788e37a7b13356be9f19233577 (files 1288) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:51c3670fa695fd51a43cf34feea590ce3dd5edab544b2f6b8b3fb943192fa406 [ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794290164 (utc 2026-11-10T05:56:04Z) [ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.rebuild.json, engine]
- Engine commit(s)
- commit 6fed961ca4c69b080b8235683aad09bec590f2c6 · dirty yes · first drive 4159
- commit 8f330f31aa066ed1381d543d473df5415ecba80a · dirty yes · first drive 4164
Why this release exists
Fully recorded- Chain951 (created 2026-11-10T07:10:28Z · trigger customer_request · upstream version v26.9.0) [chains, chains #951]
- Requestbuild request #631 (rebuild) (requested at 2026-11-10T06:02:23Z · requested by kitforge-agent · version v26.9.0) [build_requests, build_requests #631]
- Reasonrevision v26.9.0-CE-ubuntu24.04-r6: same upstream version re-dated by its own release (owner 2026-11-10 "date images correctly") [build_requests, build_requests #631 request_reason]
- Supersedesreadystack/redash:v26.9.0-CE-ubuntu24.04-r5 (chain 853) [chains, chains #853]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 951 release · ready_to_ship
Created 2026-11-10T07:10:28Z, upstream v26.9.0, build request 631 [chains, chains #951]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4159 | 2026-11-10T07:10:52Z | 39.3 | build host 2 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4159] |
| 4164 | 2026-11-10T08:08:11Z | — | build host 2 publish-held | not recorded [drive_runs, drive_runs #4164] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-10T07:11:02Z | 2026-11-10T07:11:03Z | 1 | 4
|
order_json 8e687cc04be3… |
acquire |
2026-11-10T07:11:07Z | 2026-11-10T07:11:08Z | 1 | 12
|
source_tree febfda1cb0e7…license_file 2a7d677256ef…custody_inputs 3840a7648723…source_tree_hash cc112acdc21e…source_file_manifest 8684309723c1… |
plan |
2026-11-10T07:11:40Z | 2026-11-10T07:11:41Z | 1 | 10
|
recon_report 5a362d2150f6…input_pin_plan 59aca61355be…toolchain_lock a67091947055… |
assemble_kit |
2026-11-10T07:26:39Z | 2026-11-10T07:26:39Z | 1 | 27
|
dockerfile 59dccf84f8e9…build_recipe f010b25e9b29…system_pinning 01ba4719c80b…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health 8a6f17a670b1…verify_offline_sh 3e8184ea230c…base_image_digests 712ff1bab6b7…dockerfile_offline 59dccf84f8e9…first_build_digest a1be9b539544… |
remediate |
2026-11-10T07:27:31Z | 2026-11-10T07:27:32Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 1f5cac50d9a2…security_report dad31dc8aa2f… |
build_kit |
2026-11-10T07:36:39Z | 2026-11-10T07:36:40Z | 1 | 9
|
cosign_stamp 471631c2bbcb…locked_digest 18021276aeee…freeze_manifest 0a739da8a655…offline_rebuild_transcript 4524a879edab… |
verdict |
2026-11-10T07:38:13Z | 2026-11-10T07:38:14Z | 1 | 8
|
scout_verdict 37b6cceb52c8… |
publish_image |
2026-11-10T07:39:10Z | 2026-11-10T07:39:10Z | 1 | 7
|
hub_readme c1c9d5300e36…promotion_record acb7081fa989… |
boot_instance |
2026-11-10T07:39:55Z | 2026-11-10T07:39:58Z | 2 | 3
|
instance_handle 5391d89b792f… |
sbom |
2026-11-10T07:40:19Z | 2026-11-10T07:40:19Z | 1 | 5
|
sbom_md 8f661bd017db…sbom_json e57313d3f438… |
schema_discovery |
2026-11-10T07:40:22Z | 2026-11-10T07:40:23Z | 1 | 7
|
schema_hash 34f3ceac6a90…dependency_tree 42cb610ae857…table_classification d0a1f7659dbc… |
admin_handbook |
2026-11-10T07:40:29Z | 2026-11-10T07:40:30Z | 1 | 7
|
api_map 3f73293c30ec…admin_handbook 8c4c407da25c… |
db_handbook |
2026-11-10T07:40:37Z | 2026-11-10T07:40:38Z | 1 | 8
|
db_handbook fdb5c7787a0b…seed_isolation 11e047a12840… |
seed_data |
2026-11-10T07:40:43Z | 2026-11-10T07:40:44Z | 1 | 6
|
seed_data_sql 8960dd35912e…seed_cases_json 95ac54a22bd0… |
seed_validate |
2026-11-10T07:40:46Z | 2026-11-10T07:40:47Z | 1 | 3
|
seed_data_contract 0cf23adbba33… |
usecase_validate |
2026-11-10T07:41:01Z | 2026-11-10T07:41:02Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests c71f63ce0958…test_results d50646381108…usecase_contract b99a81dba95f… |
finalize_docs |
2026-11-10T07:41:08Z | 2026-11-10T07:41:09Z | 1 | 9
|
defects_json bde342aa20fc…release_notes ab6b5c2d20fc…api_integration_guide aabbd388c6e4… |
package_archive invalidated 2026-11-10T08:07:35Z |
2026-11-10T07:50:09Z | 2026-11-10T07:50:11Z | 1 | 35 (final gate PASS)
|
sale_tar 166637594f1d…checksums a0172563e478…verify_md 25572765bf92…rebuild_md 00e09e32547f…manifest_txt d1950c4ad3e9…actions_jsonl 2c98367fa153…provenance_md 012f74233a89…assetchain_log_md e9eccaec0c0f…assetchain_log_json 281472b33045… |
[stage_runs]
Rewinds
- 2026-11-10T08:07:35Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30396]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-10T07:50:11Z.
5 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 6470 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 10534 | L-A08, L-038, L-036, L-034, L-032 |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 1482 | — |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.31 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-10T07:52:11Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1690] | $0.31 | 3 rounds, $40.00 | 166637594f1d… |
Defects
Fully recorded- Ledger entries1 [defects, defects where product_slug=redash and this tag or chain]
- Disclosed in the archive1 [docs/defects/defects.json, entries]
1 ledger entry: by severity high 1; by status open 1.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-redash-e70ea35925First visitor can claim the administrator account until setup is completed [defects, defects #229419] | high | open | build strategy record | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:0d868f4f8f3713ca692cef0ed470f910db9707ce3c971aa038b962948ffafda8 · published digest sha256:0d868f4f8f3713ca692cef0ed470f910db9707ce3c971aa038b962948ffafda8 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 236) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-10T08:08:46Z · failing Docker Scout counts 104 packages with copyleft licences (GPL, LGPL, MPL), 103 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-10T08:08:21Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3781197456 · transparency-log entry
- log index 3781199633 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3781837563 · transparency-log entry · integrated 2026-11-10T08:13:20Z) [ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:e0c85ba45d4770fbe16ef1c5171712df365cacb69e4505a38369efc5883f9f91 · state attached · log index 3781839758 · transparency-log entry
- kind sbom · digest sha256:e0c85ba45d4770fbe16ef1c5171712df365cacb69e4505a38369efc5883f9f91 · state attached · log index 3781841590 · transparency-log entry
- kind vsa · digest sha256:e0c85ba45d4770fbe16ef1c5171712df365cacb69e4505a38369efc5883f9f91 · state attached · log index 3781843479 · transparency-log entry
- kind provenance · digest sha256:0d868f4f8f3713ca692cef0ed470f910db9707ce3c971aa038b962948ffafda8 · state attached · log index 3781845326 · transparency-log entry
- kind sbom · digest sha256:0d868f4f8f3713ca692cef0ed470f910db9707ce3c971aa038b962948ffafda8 · state attached · log index 3781847174 · transparency-log entry
- kind vsa · digest sha256:0d868f4f8f3713ca692cef0ed470f910db9707ce3c971aa038b962948ffafda8 · state attached · log index 3781849445 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/redash/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-10T07:52:16Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:0d868f4f8f3713ca692cef0ed470f910db9707ce3c971aa038b962948ffafda8 [clean-room rebuild ledger, runs[722]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-10T07:39:10Z [stage_runs, stage_runs chain 951 stage publish_image]
- Archive manifests written2026-11-10T08:11:01Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 916 · probed 2026-11-10T07:32:27Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-10T08:14:35Z generated: by KitForge release/build_trail.py · generator commit 8f330f31aa066ed1381d543d473df5415ecba80a
- 2026-11-10T08:16:10Z publication: promoted at 2026-11-10T08:15:09Z · promoted digest sha256:e0c85ba45d4770fbe16ef1c5171712df365cacb69e4505a38369efc5883f9f91 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 445 · checklist status complete · checklist at 2026-11-10T08:16:10Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/redash/v26.9.0-CE-ubuntu24.04-r6/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/redash/v26.9.0-CE-ubuntu24.04-r6/), as staged for publishing | — |
ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.rebuild.json | beside the archive (prodasset /data/production/redash/v26.9.0-CE-ubuntu24.04-r6/), as staged for publishing | — |
ReadyStack-redash-v26.9.0-CE-ubuntu24.04-r6.rebuild.json.sigstore | beside the archive (prodasset /data/production/redash/v26.9.0-CE-ubuntu24.04-r6/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/redash/v26.9.0-CE-ubuntu24.04-r6/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 631 |
chains | sadb, ReadyStack's engine database (not published) | 951 |
defects | sadb, ReadyStack's engine database (not published) | redash v26.9.0-CE-ubuntu24.04-r6 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 951 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 951 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 951 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 951 |
release_images | sadb, ReadyStack's engine database (not published) | redash v26.9.0-CE-ubuntu24.04-r6 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 951 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 951 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |