Distribution Registry v3.1.2-CE-ubuntu24.04-r6 build trail
How ReadyStack built readystack/registry:v3.1.2-CE-ubuntu24.04-r6 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/registry:v3.1.2-CE-ubuntu24.04-r6 - Index digestsha256:abfab9aaa17340535e5e89286edaa33a91751ffe99a0a5c07aed2b664b91909f
- linux/amd64 digestsha256:7c073e4ce452e874a03f8930e458a97d932a5b4809b0a83fa71e592493965e9c
- Archive
ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.tar.gz - Archive SHA-256 now3a2f4bb880b8cd25b77f8cb8db54a8848d3dc6ed5f1e4e1db8f2b2f55142b324
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-07T04:56:47Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.trail.json.sigstore ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductDistribution Registry (registry) [MANIFEST.json]
- Release tagv3.1.2-CE-ubuntu24.04-r6 [MANIFEST.json]
- Imagereadystack/registry:v3.1.2-CE-ubuntu24.04-r6 [MANIFEST.json]
- Image index digestsha256:abfab9aaa17340535e5e89286edaa33a91751ffe99a0a5c07aed2b664b91909f [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:7c073e4ce452e874a03f8930e458a97d932a5b4809b0a83fa71e592493965e9c [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.tar.gz (bytes 470470578) [MANIFEST.json]
- Archive sha256 at publish3a2f4bb880b8cd25b77f8cb8db54a8848d3dc6ed5f1e4e1db8f2b2f55142b324 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/distribution/distribution [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv3.1.2 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commit3220848f15d9279c66a41aa0a257469e6aede1e9 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashb7cd43949374362404d0782d67aca2c20279b89570b5d1401291180757d4d899 (files 4599) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:4ab6db4b83f5b07b5d55de927484dfdbe619613ca84ec3d540d256d36f2380a3 [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1790250209 (utc 2026-09-24T11:43:29Z) [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.rebuild.json, engine]
- Engine commit(s)
- commit 82ceed962bb8cbb719cd23d6abac3b09b92a97c3 · dirty yes · first drive 3558
- commit 010aa541a25a24b2cef6b4553320a093daeed530 · dirty yes · first drive 3563
- commit 41f5e1f99ee0c35eecf46505cb0cc6b032dda355 · dirty yes · first drive 3570
Why this release exists
Fully recorded- Chain836 (created 2026-11-07T03:47:59Z · trigger customer_request · upstream version v3.1.2) [chains, chains #836]
- Requestbuild request #521 (rebuild) (requested at 2026-11-07T02:01:39Z · requested by kitforge-agent · version v3.1.2) [build_requests, build_requests #521]
- Reasonrerelease agenda REVISION -> v3.1.2-CE-ubuntu24.04-r6 (decay loop, IMP-08) [build_requests, build_requests #521 request_reason]
- Supersedesreadystack/registry:v3.1.2-CE-ubuntu24.04-r5 (chain 752) [chains, chains #752]
The path through the harness
Fully recorded1 chain · 3 drives · 18 stages · 1 rewind
Chain 836 release · ready_to_ship
Created 2026-11-07T03:47:59Z, upstream v3.1.2, build request 521 [chains, chains #836]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 3558 | 2026-11-07T03:48:22Z | 10.7 | build host 2 withhold-publish | infra_hub_rate_limit at publish_image; 8 ticks [drive_runs, drive_runs #3558] |
| 3563 | 2026-11-07T04:23:42Z | 7.2 | build host 2 withhold-publish | ready_to_ship at package_archive; 12 ticks [drive_runs, drive_runs #3563] |
| 3570 | 2026-11-07T04:52:25Z | — | build host 2 publish-held | not recorded [drive_runs, drive_runs #3570] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-07T03:48:32Z | 2026-11-07T03:48:33Z | 1 | 4
|
order_json 2150c479dffc… |
acquire |
2026-11-07T03:48:39Z | 2026-11-07T03:48:40Z | 1 | 12
|
source_tree ddcd139d1670…license_file cb5e8e7e5f4a…custody_inputs 6a5c96dbb28a…source_tree_hash ba888dab5412…source_file_manifest c29b0fe5b8c2… |
plan |
2026-11-07T03:49:12Z | 2026-11-07T03:49:13Z | 1 | 10
|
recon_report 801a294e4c20…input_pin_plan 72e8d3c572d1…toolchain_lock 2a4b28d23255… |
assemble_kit |
2026-11-07T03:51:55Z | 2026-11-07T03:51:56Z | 1 | 27
|
dockerfile cfb5d164b01c…build_recipe fcd55e274c91…system_pinning fa091140511e…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health f527585402a6…verify_offline_sh 3e8184ea230c…base_image_digests af50099de4bd…dockerfile_offline cfb5d164b01c…first_build_digest 02f95c8a1b65… |
remediate |
2026-11-07T03:52:22Z | 2026-11-07T03:52:23Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log f8a61a4ce71f…security_report 537e1afc8d6b… |
build_kit |
2026-11-07T03:55:43Z | 2026-11-07T03:55:44Z | 1 | 9
|
cosign_stamp 2282f321a2e3…locked_digest d101156695e8…freeze_manifest 3df4ce72fac4…offline_rebuild_transcript ff1e96520824… |
verdict |
2026-11-07T03:56:24Z | 2026-11-07T03:56:25Z | 1 | 8
|
scout_verdict 20f0d438bc52… |
publish_image |
2026-11-07T04:24:26Z | 2026-11-07T04:24:26Z | 1 | 7
|
hub_readme 5423509ac387…promotion_record 489acec91272… |
boot_instance |
2026-11-07T04:24:32Z | 2026-11-07T04:24:35Z | 2 | 3
|
instance_handle fcb74f1f742d… |
sbom |
2026-11-07T04:24:45Z | 2026-11-07T04:24:46Z | 1 | 5
|
sbom_md effce29ad460…sbom_json 2954838b5d47… |
schema_discovery |
2026-11-07T04:24:49Z | 2026-11-07T04:24:50Z | 1 | 7
|
schema_hash 0d42df0f8948…dependency_tree da81f263714f…table_classification baf9701ff510… |
admin_handbook |
2026-11-07T04:24:58Z | 2026-11-07T04:24:59Z | 1 | 7
|
api_map 8a112ecad2a4…admin_handbook 7f175bf14f6e… |
db_handbook |
2026-11-07T04:25:09Z | 2026-11-07T04:25:10Z | 1 | 8
|
db_handbook 0ba9e951990c…seed_isolation 5fa93ac554b8… |
seed_data |
2026-11-07T04:25:17Z | 2026-11-07T04:25:18Z | 1 | 6
|
seed_data_sql 251a88e60706…seed_cases_json fbe9c9716bb3… |
seed_validate |
2026-11-07T04:25:20Z | 2026-11-07T04:25:21Z | 1 | 3
|
seed_data_contract 23f3ed3ab9fd… |
usecase_validate |
2026-11-07T04:25:42Z | 2026-11-07T04:25:42Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests ce84bfd5fb46…test_results 018e6ad9af56…usecase_contract 7ba2024fef66… |
finalize_docs |
2026-11-07T04:25:48Z | 2026-11-07T04:25:48Z | 1 | 9
|
defects_json dca4c6106555…release_notes d08f6d6d2aaf…api_integration_guide d3469082578c… |
package_archive invalidated 2026-11-07T04:51:54Z |
2026-11-07T04:30:49Z | 2026-11-07T04:30:51Z | 1 | 34 (final gate PASS)
|
sale_tar 0e9ad10e06fc…checksums d4c53e9e53ab…verify_md 778cb8b90b12…rebuild_md 49d98ecd8ec0…manifest_txt 036458782662…actions_jsonl 341042a5eb9c…provenance_md 013f02ca6b6b…assetchain_log_md e9eccaec0c0f…assetchain_log_json 1bd3100de5e2… |
[stage_runs]
Rewinds
- 2026-11-07T04:51:54Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #23873]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-07T04:30:51Z.
7 calls over 5 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 8663 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 8765 | L-A183, L-A15 |
admin_handbook | 1 | 0 | 0 | 1 | 0 | 10176 | L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14 |
db_handbook | 1 | 0 | 0 | 1 | 0 | 7519 | L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15 |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 1791 | L-A59 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.49 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-07T04:31:16Z | 0 | 0 | 1 | clean to publish [held_rounds, held_rounds #1427] | $0.49 | 3 rounds, $40.00 | 0e9ad10e06fc… |
Defects
Fully recorded- Ledger entries2 [defects, defects where product_slug=registry and this tag or chain]
- Disclosed in the archive2 [docs/defects/defects.json, entries]
2 ledger entries: by severity low 2; by status open 1, fixed-before-release 1.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-registry-0ec5037ee8The comment at the top of the shipped config.yml does not mention that upload purging differs from upstream [defects, defects #160087] | low | open | held review (review model) | — |
RSD-registry-e8eb8702a4Database handbook: Empty heading and duplicated 'Reproducibility' section heading left by the section rewrite. [defects, defects #160167] | low | fixed-before-release | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:7c073e4ce452e874a03f8930e458a97d932a5b4809b0a83fa71e592493965e9c · published digest sha256:7c073e4ce452e874a03f8930e458a97d932a5b4809b0a83fa71e592493965e9c · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 89) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-07T04:52:46Z · failing Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-07T04:52:35Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3729553043 · transparency-log entry
- log index 3729553866 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3729957702 · transparency-log entry · integrated 2026-11-07T04:55:37Z) [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:abfab9aaa17340535e5e89286edaa33a91751ffe99a0a5c07aed2b664b91909f · state attached · log index 3729959013 · transparency-log entry
- kind sbom · digest sha256:abfab9aaa17340535e5e89286edaa33a91751ffe99a0a5c07aed2b664b91909f · state attached · log index 3729960173 · transparency-log entry
- kind vsa · digest sha256:abfab9aaa17340535e5e89286edaa33a91751ffe99a0a5c07aed2b664b91909f · state attached · log index 3729961223 · transparency-log entry
- kind provenance · digest sha256:7c073e4ce452e874a03f8930e458a97d932a5b4809b0a83fa71e592493965e9c · state attached · log index 3729962594 · transparency-log entry
- kind sbom · digest sha256:7c073e4ce452e874a03f8930e458a97d932a5b4809b0a83fa71e592493965e9c · state attached · log index 3729963817 · transparency-log entry
- kind vsa · digest sha256:7c073e4ce452e874a03f8930e458a97d932a5b4809b0a83fa71e592493965e9c · state attached · log index 3729965959 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/registry/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-07T04:31:21Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:7c073e4ce452e874a03f8930e458a97d932a5b4809b0a83fa71e592493965e9c [clean-room rebuild ledger, runs[603]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-07T04:24:26Z [stage_runs, stage_runs chain 836 stage publish_image]
- Archive manifests written2026-11-07T04:54:11Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 743 · probed 2026-11-07T03:54:00Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-07T04:56:47Z generated: by KitForge release/build_trail.py · generator commit 628ddf42a9b85c4b4257577579c4d816c681f78e
- 2026-11-07T04:58:01Z publication: promoted at 2026-11-07T04:57:16Z · promoted digest sha256:abfab9aaa17340535e5e89286edaa33a91751ffe99a0a5c07aed2b664b91909f · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 330 · checklist status complete · checklist at 2026-11-07T04:58:01Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/registry/v3.1.2-CE-ubuntu24.04-r6/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/registry/v3.1.2-CE-ubuntu24.04-r6/), as staged for publishing | — |
ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.rebuild.json | beside the archive (prodasset /data/production/registry/v3.1.2-CE-ubuntu24.04-r6/), as staged for publishing | — |
ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r6.rebuild.json.sigstore | beside the archive (prodasset /data/production/registry/v3.1.2-CE-ubuntu24.04-r6/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/registry/v3.1.2-CE-ubuntu24.04-r6/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 521 |
chains | sadb, ReadyStack's engine database (not published) | 836 |
defects | sadb, ReadyStack's engine database (not published) | registry v3.1.2-CE-ubuntu24.04-r6 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 836 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 836 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 836 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 836 |
release_images | sadb, ReadyStack's engine database (not published) | registry v3.1.2-CE-ubuntu24.04-r6 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 836 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 836 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |