Redis 8.10.3-CE-ubuntu24.04-r3 build trail
How ReadyStack built readystack/redis:8.10.3-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/redis:8.10.3-CE-ubuntu24.04-r3 - Index digestsha256:ea970038f4b2f2c95e99545acc03791d1a75561778f30b8c4f38482f34832a96
- linux/amd64 digestsha256:0595bc120b88a09cdad1f9c99b8098220f07e913c2fc4b8d611e4a6c8e252a78
- Archive
ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.tar.gz - Archive SHA-256 now75a8f0b03891e70eca6e03030db2d3f14befe83ea9c4dc214000c282259c2662
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-13T10:54:39Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductRedis (redis) [MANIFEST.json]
- Release tag8.10.3-CE-ubuntu24.04-r3 [MANIFEST.json]
- Imagereadystack/redis:8.10.3-CE-ubuntu24.04-r3 [MANIFEST.json]
- Image index digestsha256:ea970038f4b2f2c95e99545acc03791d1a75561778f30b8c4f38482f34832a96 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:0595bc120b88a09cdad1f9c99b8098220f07e913c2fc4b8d611e4a6c8e252a78 [ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.tar.gz (bytes 553194912) [MANIFEST.json]
- Archive sha256 at publish75a8f0b03891e70eca6e03030db2d3f14befe83ea9c4dc214000c282259c2662 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/redis/redis [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream ref8.10.3 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit1a2574ce1551d3de6e0b4a56756c0fdbc6659e4f [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash3cc51f57686121c417ad1c10785daa1815233a26de8445924cdb7ce7a089be24 (files 1861) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:41e3f5123f944dbf06879a615b5ad46e25bf36996687ca12c0f0c4ed369998ac [ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794448324 (utc 2026-11-12T01:52:04Z) [ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.rebuild.json, engine]
- Engine commit(s)
- commit 53328f4754ecefc18b308504e3b02f89c9062497 · dirty yes · first drive 4549
Why this release exists
Fully recorded- Chain1064 (created 2026-11-13T10:08:06Z · trigger customer_request · upstream version 8.10.3) [chains, chains #1064]
- Requestbuild request #716 (rebuild) (requested at 2026-11-12T01:52:06Z · requested by kitforge-agent · version 8.10.3) [build_requests, build_requests #716]
- Reasonrevision 8.10.3-CE-ubuntu24.04-r3: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #716 request_reason]
- Supersedesreadystack/redis:8.10.3-CE-ubuntu24.04-r2 (chain 924) [chains, chains #924]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1064 release · ready_to_ship
Created 2026-11-13T10:08:06Z, upstream 8.10.3, build request 716 [chains, chains #1064]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4549 | 2026-11-13T10:08:32Z | 17.3 | build host 2 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4549] |
| 4559 | 2026-11-13T10:49:57Z | — | build host 2 publish-held | not recorded [drive_runs, drive_runs #4559] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-13T10:08:43Z | 2026-11-13T10:08:43Z | 1 | 4
|
order_json 1cc6968e65e7… |
acquire |
2026-11-13T10:08:48Z | 2026-11-13T10:08:49Z | 1 | 12
|
source_tree 926d7bf1092e…license_file 4a0e416b9537…custody_inputs 961a496578f2…source_tree_hash 3d8f8e72bde0…source_file_manifest cd884afac9a4… |
plan |
2026-11-13T10:09:21Z | 2026-11-13T10:09:22Z | 1 | 10
|
recon_report 19ee7a16f584…input_pin_plan dfdce0b920f7…toolchain_lock 521f2fa7212e… |
assemble_kit |
2026-11-13T10:12:31Z | 2026-11-13T10:12:31Z | 1 | 27
|
dockerfile 73bcbcb71b10…build_recipe ee5e2ce9d398…system_pinning aa8db05a9a8a…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health ecbfa292bc39…verify_offline_sh 3e8184ea230c…base_image_digests 074fe74a876b…dockerfile_offline 73bcbcb71b10…first_build_digest 2769701c765a… |
remediate |
2026-11-13T10:12:58Z | 2026-11-13T10:12:59Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 87c2fe2f3190…security_report ac6a865629c8… |
build_kit |
2026-11-13T10:18:12Z | 2026-11-13T10:18:12Z | 1 | 9
|
cosign_stamp 138ac4d4e141…locked_digest 7057d6336bb2…freeze_manifest d6643aa5c026…offline_rebuild_transcript d27cd02e66ad… |
verdict |
2026-11-13T10:18:40Z | 2026-11-13T10:18:41Z | 1 | 8
|
scout_verdict 22d339faeb2d… |
publish_image |
2026-11-13T10:19:09Z | 2026-11-13T10:19:10Z | 1 | 7
|
hub_readme 8c02b3e0326e…promotion_record 7eb0d1406784… |
boot_instance |
2026-11-13T10:19:15Z | 2026-11-13T10:19:18Z | 2 | 3
|
instance_handle 1d586763e314… |
sbom |
2026-11-13T10:19:32Z | 2026-11-13T10:19:33Z | 1 | 5
|
sbom_md 9f0b53d8d740…sbom_json 406c7e7f1cca… |
schema_discovery |
2026-11-13T10:19:35Z | 2026-11-13T10:19:36Z | 1 | 7
|
schema_hash ad1c3396adb7…dependency_tree aa9a44d3d4b3…table_classification 33ce387b0868… |
admin_handbook |
2026-11-13T10:19:43Z | 2026-11-13T10:19:44Z | 1 | 7
|
api_map 7fc7f4e045e2…admin_handbook 046252deacd3… |
db_handbook |
2026-11-13T10:19:55Z | 2026-11-13T10:19:56Z | 1 | 8
|
db_handbook da20c5c38187…seed_isolation eef89be36a0f… |
seed_data |
2026-11-13T10:20:03Z | 2026-11-13T10:20:04Z | 1 | 6
|
seed_data_sql cb592e943a30…seed_cases_json cc1ac5c760e9… |
seed_validate |
2026-11-13T10:20:07Z | 2026-11-13T10:20:08Z | 1 | 3
|
seed_data_contract 80eec9f37f17… |
usecase_validate |
2026-11-13T10:20:27Z | 2026-11-13T10:20:28Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests 7ae455bc2738…test_results 4f41bf612743…usecase_contract 7b182e6ac678… |
finalize_docs |
2026-11-13T10:20:33Z | 2026-11-13T10:20:34Z | 1 | 9
|
defects_json b8c72a7cbd92…release_notes 6e905a8ab4db…api_integration_guide fcbb366bc3a9… |
package_archive invalidated 2026-11-13T10:49:30Z |
2026-11-13T10:25:47Z | 2026-11-13T10:25:49Z | 1 | 37 (final gate PASS)
|
sale_tar b5ad823355e1…checksums 837e89f758e0…verify_md 6432a20935a8…rebuild_md 9d8c05cc2537…manifest_txt 4f9e124370a1…actions_jsonl e0382e0906cc…provenance_md 805c0c4f2857…assetchain_log_md e9eccaec0c0f…assetchain_log_json 689dbeaa0298… |
[stage_runs]
Rewinds
- 2026-11-13T10:49:30Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #35645]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-13T10:25:49Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 7052 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 6860 | L-A183, L-A15 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.30 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-13T10:27:08Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1865] | $0.30 | 3 rounds, $40.00 | b5ad823355e1… |
Defects
Fully recorded- Ledger entries2 [defects, defects where product_slug=redis and this tag or chain]
- Disclosed in the archive2 [docs/defects/defects.json, entries]
2 ledger entries: by severity low 2; by status fixed-before-release 2.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-redis-488d649edaDocker Hub README: Hub README calls the build kit free for any registered account; the manifest records a paid kit (round-1 finding still present) [defects, defects #278933] | low | fixed-before-release | held review (review model) | — |
RSD-redis-f33bf3982fDocker Hub README: Hub README calls the build kit free for any registered account; the manifest records a paid kit (round-1 finding still present) [defects, defects #278934] | low | fixed-before-release | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:0595bc120b88a09cdad1f9c99b8098220f07e913c2fc4b8d611e4a6c8e252a78 · published digest sha256:0595bc120b88a09cdad1f9c99b8098220f07e913c2fc4b8d611e4a6c8e252a78 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 140) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T10:50:18Z · failing Docker Scout counts 17 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T10:50:07Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3851820938 · transparency-log entry
- log index 3851821766 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3852378930 · transparency-log entry · integrated 2026-11-13T10:52:58Z) [ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:ea970038f4b2f2c95e99545acc03791d1a75561778f30b8c4f38482f34832a96 · state attached · log index 3852382876 · transparency-log entry
- kind sbom · digest sha256:ea970038f4b2f2c95e99545acc03791d1a75561778f30b8c4f38482f34832a96 · state attached · log index 3852386207 · transparency-log entry
- kind vsa · digest sha256:ea970038f4b2f2c95e99545acc03791d1a75561778f30b8c4f38482f34832a96 · state attached · log index 3852388778 · transparency-log entry
- kind provenance · digest sha256:0595bc120b88a09cdad1f9c99b8098220f07e913c2fc4b8d611e4a6c8e252a78 · state attached · log index 3852390675 · transparency-log entry
- kind sbom · digest sha256:0595bc120b88a09cdad1f9c99b8098220f07e913c2fc4b8d611e4a6c8e252a78 · state attached · log index 3852392249 · transparency-log entry
- kind vsa · digest sha256:0595bc120b88a09cdad1f9c99b8098220f07e913c2fc4b8d611e4a6c8e252a78 · state attached · log index 3852395067 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/redis/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-13T10:27:12Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:0595bc120b88a09cdad1f9c99b8098220f07e913c2fc4b8d611e4a6c8e252a78 [clean-room rebuild ledger, runs[823]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-13T10:19:10Z [stage_runs, stage_runs chain 1064 stage publish_image]
- Archive manifests written2026-11-13T10:51:42Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 81 · probed 2026-11-13T10:15:35Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-13T10:54:39Z generated: by KitForge release/build_trail.py · generator commit 53328f4754ecefc18b308504e3b02f89c9062497
- 2026-11-13T10:56:05Z publication: promoted at 2026-11-13T10:55:22Z · promoted digest sha256:ea970038f4b2f2c95e99545acc03791d1a75561778f30b8c4f38482f34832a96 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 537 · checklist status complete · checklist at 2026-11-13T10:56:05Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/redis/8.10.3-CE-ubuntu24.04-r3/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/redis/8.10.3-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.rebuild.json | beside the archive (prodasset /data/production/redis/8.10.3-CE-ubuntu24.04-r3/), as staged for publishing | — |
ReadyStack-redis-8.10.3-CE-ubuntu24.04-r3.rebuild.json.sigstore | beside the archive (prodasset /data/production/redis/8.10.3-CE-ubuntu24.04-r3/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/redis/8.10.3-CE-ubuntu24.04-r3/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 716 |
chains | sadb, ReadyStack's engine database (not published) | 1064 |
defects | sadb, ReadyStack's engine database (not published) | redis 8.10.3-CE-ubuntu24.04-r3 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1064 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1064 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1064 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1064 |
release_images | sadb, ReadyStack's engine database (not published) | redis 8.10.3-CE-ubuntu24.04-r3 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1064 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1064 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |