Distribution Registry v3.1.2-CE-ubuntu24.04-r7 build trail

How ReadyStack built readystack/registry:v3.1.2-CE-ubuntu24.04-r7 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/registry:v3.1.2-CE-ubuntu24.04-r7
  • Index digestsha256:8a39c46f3fb35d90da573e8d03706321904dc68f874279e4f62798e13b2c6766
  • linux/amd64 digestsha256:5f04c71c049e55ba4d5ff16ae84225340b32ca9b42991e99b5d02c1cc767aacc
  • ArchiveReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.tar.gz
  • Archive SHA-256 now38ea0358b7afb702928931db6c760ddefd65a6f1cb5a230973c92d58cef8bdc0
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T10:41:56Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.trail.json.sigstore ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.trail.json
ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.trail.jsonReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.trail.json.sigstoreReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.trail.mdDistribution Registry product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductDistribution Registry (registry) [MANIFEST.json]
  • Release tagv3.1.2-CE-ubuntu24.04-r7 [MANIFEST.json]
  • Imagereadystack/registry:v3.1.2-CE-ubuntu24.04-r7 [MANIFEST.json]
  • Image index digestsha256:8a39c46f3fb35d90da573e8d03706321904dc68f874279e4f62798e13b2c6766 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:5f04c71c049e55ba4d5ff16ae84225340b32ca9b42991e99b5d02c1cc767aacc [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.tar.gz (bytes 479051784) [MANIFEST.json]
  • Archive sha256 at publish38ea0358b7afb702928931db6c760ddefd65a6f1cb5a230973c92d58cef8bdc0 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/distribution/distribution [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv3.1.2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit3220848f15d9279c66a41aa0a257469e6aede1e9 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashb7cd43949374362404d0782d67aca2c20279b89570b5d1401291180757d4d899 (files 4599) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:1d2149ac2d52219b909994fae6dd9786c709d912710bf5b0f0195ba45271e044 [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1790250209 (utc 2026-09-24T11:43:29Z) [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.rebuild.json, engine]
  • Engine commit(s)
    • commit de82d9f15f2f16d4019ffa4fd6872481dac1dbe0 · dirty yes · first drive 3670
    • commit 25f176d1e4c68bf0eaed5fe5103af4b3ad61b7fd · dirty yes · first drive 3764
    • commit 9297e5f1902d782e43b6ebf8fe9b54eba0e82889 · dirty yes · first drive 3858
    • commit 4875c2406708ae99fbe7b89aa07055d421a931c1 · dirty yes · first drive 3906
    • commit 36f5326faa9c012737f04b0c87a1a5edeb6dd870 · dirty yes · first drive 3972
    • commit 55866b6001949e70404e9d5146b06b3d82f15175 · dirty yes · first drive 3980
    • commit 9e1e08daa6fd77ad7901229048721017ec2e4d84 · dirty yes · first drive 3986
    • commit bfc2c69cad25a084895a177f0ea769362fac34dc · dirty yes · first drive 3992
    • commit 0e6d2dd94eeb1339a0c2a974a3cb5125871ca557 · dirty yes · first drive 3996
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain864 (created 2026-11-08T02:56:44Z · trigger customer_request · upstream version v3.1.2) [chains, chains #864]
  • Requestbuild request #540 (rebuild) (requested at 2026-11-08T02:54:49Z · requested by kitforge-agent · version v3.1.2) [build_requests, build_requests #540]
  • Reasonrevision v3.1.2-CE-ubuntu24.04-r7: same upstream version rebuilt on the chiselled slim base (Core slim batch, PR #195; retarget.py --rev-bump) [build_requests, build_requests #540 request_reason]
  • Supersedesreadystack/registry:v3.1.2-CE-ubuntu24.04-r6 (chain 836) [chains, chains #836]

The path through the harness

Fully recorded

1 chain · 9 drives · 18 stages · 4 rewinds

Chain 864 release · ready_to_ship

Created 2026-11-08T02:56:44Z, upstream v3.1.2, build request 540 [chains, chains #864]

DriveStartedMinutesBuild hostHow it stopped
36702026-11-08T02:57:10Z74.1build host 2 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3670]
37642026-11-08T10:23:21Z21.2build host 2 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3764]
38582026-11-08T18:25:27Z20build host 2 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3858]
39062026-11-09T00:23:17Z20build host 2 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3906]
39722026-11-09T06:28:26Z6.5build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3972]
39802026-11-09T08:04:32Z4.8build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3980]
39862026-11-09T08:59:48Z2.9build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3986]
39922026-11-09T10:06:15Z2.9build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3992]
39962026-11-09T10:37:58Z—build host 2 publish-held not recorded [drive_runs, drive_runs #3996]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-08T02:57:21Z2026-11-08T02:57:22Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json adbaad6f0dbe…
acquire 2026-11-08T02:57:28Z2026-11-08T02:57:29Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree ddcd139d1670…
license_file cb5e8e7e5f4a…
custody_inputs 6a5c96dbb28a…
source_tree_hash ba888dab5412…
source_file_manifest c29b0fe5b8c2…
plan 2026-11-08T02:57:59Z2026-11-08T02:57:59Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 479b5367f337…
input_pin_plan c7b384a1836c…
toolchain_lock f00eaad4df88…
assemble_kit 2026-11-08T03:00:39Z2026-11-08T03:00:39Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile d67e56b1a51c…
build_recipe 4beb3dd196ef…
system_pinning fa091140511e…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health a362b50456b3…
verify_offline_sh 3e8184ea230c…
base_image_digests af50099de4bd…
dockerfile_offline d67e56b1a51c…
first_build_digest dfa70c87c05d…
remediate 2026-11-08T03:01:04Z2026-11-08T03:01:05Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 6d782c9a04d1…
security_report 107fb4a81d01…
build_kit 2026-11-08T03:04:30Z2026-11-08T03:04:31Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 546c52ae52ce…
locked_digest f556b93275b1…
freeze_manifest 9545ce8c6208…
offline_rebuild_transcript 71a0d910f7ab…
verdict 2026-11-08T03:05:01Z2026-11-08T03:05:02Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 6e26ba96b36d…
publish_image 2026-11-08T03:05:32Z2026-11-08T03:05:32Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 6ef8a2ce2e59…
promotion_record d2416f49ae95…
boot_instance 2026-11-08T03:05:38Z2026-11-08T03:05:42Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 956642b04e1a…
sbom 2026-11-08T03:05:50Z2026-11-08T03:05:51Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 7c74b974d26b…
sbom_json 7dd3660b8d12…
schema_discovery 2026-11-08T03:05:53Z2026-11-08T03:05:54Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 0d42df0f8948…
dependency_tree da81f263714f…
table_classification baf9701ff510…
admin_handbook 2026-11-08T03:24:20Z2026-11-08T03:24:20Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 8a112ecad2a4…
admin_handbook 12172d774658…
db_handbook 2026-11-08T03:41:35Z2026-11-08T03:41:37Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 6fe0cc86b280…
seed_isolation 5fa93ac554b8…
seed_data 2026-11-08T03:41:52Z2026-11-08T03:41:53Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 251a88e60706…
seed_cases_json 5c833c8af5c3…
seed_validate 2026-11-08T03:41:59Z2026-11-08T03:42:00Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 06c574998b94…
usecase_validate 2026-11-08T03:42:48Z2026-11-08T03:42:50Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests bec0d99c2293…
passed_tests c1c34c783ba9…
test_results ca9bcd0317aa…
usecase_contract 7120b82ae823…
finalize_docs 2026-11-08T03:43:03Z2026-11-08T03:43:06Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json cded594b4523…
release_notes 3bf60ba1fa19…
api_integration_guide 65840d1fced4…
package_archive invalidated 2026-11-09T10:37:34Z 2026-11-08T04:11:18Z2026-11-09T10:09:06Z8
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar b98ec2f0e8e3…
checksums 0c04acad8e5e…
verify_md 343d565cdd4d…
rebuild_md 03d0635ee101…
manifest_txt ae124677f921…
actions_jsonl 18634849420f…
provenance_md 4421d493ef82…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json ddb4f7451b60…

[stage_runs]

Rewinds

  • 2026-11-09T07:13:47Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28188]
  • 2026-11-09T08:36:26Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28422]
  • 2026-11-09T09:31:13Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28581]
  • 2026-11-09T10:37:34Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28706]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T10:09:06Z.

411 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 08317 L-A183, L-A15
remediate2001 08453 L-A183, L-A15
admin_handbook21412703 542232172 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook19211203 511723957 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate1001 02027 L-A59

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

4 rounds, 4 counted, $9.06 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T06:35:38Z 01021 findings to repackage [held_rounds, held_rounds #1594] $2.48 3 rounds, $40.00 eefb97ede569…
22026-11-09T08:10:05Z 0912 findings to repackage [held_rounds, held_rounds #1600] $2.14 3 rounds, $40.00 42f0919752e9…
32026-11-09T09:03:07Z 017 findings to repackage [held_rounds, held_rounds #1602] $2.24 3 rounds, $40.00 e880156940f4…
42026-11-09T10:09:48Z 005 clean to publish [held_rounds, held_rounds #1606] $2.21 3 rounds, $40.00 b98ec2f0e8e3…

Defects

Fully recorded
  • Ledger entries66 [defects, defects where product_slug=registry and this tag or chain]
  • Disclosed in the archive66 [docs/defects/defects.json, entries]

66 ledger entries: by severity low 46, high 20; by status open 1, fixed-before-release 65.

DefectSeverityStatusFound byFixed in
RSD-registry-3638dd51ee
The comment at the top of the shipped config.yml does not mention that upload purging differs from upstream [defects, defects #198928]		lowopenheld review (review model)—
RSD-registry-e8211ec960
Admin handbook: The TLS push example uses a URL scheme in the image reference; docker rejects it as an invalid reference. [defects, defects #200122]		highfixed-before-releaseheld review (review model)—
RSD-registry-1712d499b6
Admin handbook: The TLS test push example uses a URL scheme in the image reference; docker rejects it as an invalid reference. [defects, defects #200123]		highfixed-before-releaseheld review (review model)—
RSD-registry-57a46b9d0a
Admin handbook: The debug-listener publish example uses a CIDR range as the host address in -p, which docker refuses. [defects, defects #200124]		highfixed-before-releaseheld review (review model)—
RSD-registry-ec0ad92c22
Admin handbook: The run command reads a file named env.conf that the steps never create. [defects, defects #200125]		lowfixed-before-releaseheld review (review model)—
RSD-registry-5f9f5ad2b1
Admin handbook: The replica htpasswd-sharing procedure copies the file into containers that have not started; docker cp fails because auth/ does not exist yet in a new volume. [defects, defects #200126]		highfixed-before-releaseheld review (review model)—
RSD-registry-b43c87d8a4
Admin handbook: The procedure order (copy before the replicas start) cannot work. [defects, defects #200127]		highfixed-before-releaseheld review (review model)—
RSD-registry-647ae4c70f
Admin handbook: The handbook says the image has no shells, but it has /bin/sh and the handbook's user-management procedure runs it. [defects, defects #200128]		highfixed-before-releaseheld review (review model)—
RSD-registry-f8243005e5
Admin handbook: The sentence attributes the image's shell to the container runtime, contradicting the image contents and line 475. [defects, defects #200129]		lowfixed-before-releaseheld review (review model)—
RSD-registry-3735e30150
Database handbook: The sentence says the image has no shell, contradicting the tested user-management procedure that runs sh. [defects, defects #200130]		highfixed-before-releaseheld review (review model)—
RSD-registry-d0b4287279
Database handbook: The runtime user is named docker; it is registry. [defects, defects #200131]		highfixed-before-releaseheld review (review model)—
RSD-registry-1977c661d4
Database handbook: The sentence says the configuration file lives in the data volume, which would make customers expect edits to survive container re-creation; it does not. [defects, defects #200132]		highfixed-before-releaseheld review (review model)—
RSD-registry-686a97475d
Admin handbook: The sentence says configuration changes persist in the volume; they do not, and the next paragraph says they are lost on re-creation. [defects, defects #200133]		highfixed-before-releaseheld review (review model)—
RSD-registry-326ed63579
Admin handbook: The sentence offers only rebuilding the image or environment variables and omits the documented mounted-file option. [defects, defects #200134]		lowfixed-before-releaseheld review (review model)—
RSD-registry-73e38eea70
Database handbook: The overview says users are managed through API requests; there is no such API. [defects, defects #200135]		lowfixed-before-releaseheld review (review model)—
RSD-registry-cb1940a366
Admin handbook: Recovery needs one successful check, not three consecutive ones; the threshold of 3 applies to failures only. [defects, defects #200136]		lowfixed-before-releaseheld review (review model)—
RSD-registry-7fc86c67f7
Database handbook: Same false recovery rule: one successful check clears the 503, not three. [defects, defects #200137]		lowfixed-before-releaseheld review (review model)—
RSD-registry-66270e7b7d
Database handbook: The sentence is garbled and contradicts the threshold behaviour (three failures start the 503, one success ends it). [defects, defects #200138]		lowfixed-before-releaseheld review (review model)—
RSD-registry-8b9ca966d8
Admin handbook: The sentence says / does not verify storage while the next paragraph (and line 194) say a failing storage check turns / into 503. [defects, defects #200139]		lowfixed-before-releaseheld review (review model)—
RSD-registry-75fade703c
Admin handbook: The sentence ties publishing the debug listener to TLS, which has nothing to do with it; the real step is REGISTRY_HTTP_DEBUG_ADDR. [defects, defects #200140]		lowfixed-before-releaseheld review (review model)—
RSD-registry-7dd5111765
Admin handbook: Step 6 repeats the docker run of step 5 under the same container name without telling the customer to remove the first container. [defects, defects #200141]		lowfixed-before-releaseheld review (review model)—
RSD-registry-4c73f9cb3c
Database handbook: Only /debug/health refuses HEAD; the other debug endpoints answer it. [defects, defects #200142]		lowfixed-before-releaseheld review (review model)—
RSD-registry-02bf643154
Database handbook: The password is 43 characters (32 bytes encoded), not 32 characters. [defects, defects #200143]		lowfixed-before-releaseheld review (review model)—
RSD-registry-51165070e4
Database handbook: The blob-by-digest route has no PUT; uploads go through blobs/uploads/. [defects, defects #200144]		lowfixed-before-releaseheld review (review model)—
RSD-registry-eb5ff93566
Database handbook: The namespaced blob-by-digest route has no PUT. [defects, defects #200145]		lowfixed-before-releaseheld review (review model)—
RSD-registry-7120f50dd0
Database handbook: The command shown prints nothing, so there is no 'response status of 200' to read. [defects, defects #200146]		lowfixed-before-releaseheld review (review model)—
RSD-registry-cfbef2b940
Database handbook: The publish flag shown exposes the unauthenticated debug listener on all interfaces, against the advice in the same paragraph. [defects, defects #200147]		lowfixed-before-releaseheld review (review model)—
RSD-registry-44daa95f3b
Admin handbook: The count says eight modules; seven are listed everywhere in the handbook. [defects, defects #200148]		lowfixed-before-releaseheld review (review model)—
RSD-registry-23f27806d7
Admin handbook: The repeat instruction keeps the same host port and the same volume, contradicting the earlier statement that each replica needs its own volume. [defects, defects #200149]		lowfixed-before-releaseheld review (review model)—
RSD-registry-2a6497a80c
Admin handbook: The sentence says token authentication is unsupported; line 2307 (and the DB handbook) say it is only not configured. [defects, defects #200150]		lowfixed-before-releaseheld review (review model)—
RSD-registry-f1331e3b20
Admin handbook: Empty heading left by the section rewrite (recurs from last round's finding). [defects, defects #200151]		lowfixed-before-releaseheld review (review model)—
RSD-registry-3545d974d2
Database handbook: Empty heading left by the section rewrite (recurs from last round's finding). [defects, defects #200152]		lowfixed-before-releaseheld review (review model)—
RSD-registry-9bf218fe1a
Admin handbook: Claim that the load balancer can route upload requests to any backend is false for the documented topology (one volume per replica): tested 404 BLOB_UPLOAD_UNKNOWN. [defects, defects #202083]		highfixed-before-releaseheld review (review model)—
RSD-registry-f02e0483d1
Admin handbook: Same false promise: the secret alone does not give seamless uploads across replicas with separate volumes (tested 404 BLOB_UPLOAD_UNKNOWN). [defects, defects #202084]		highfixed-before-releaseheld review (review model)—
RSD-registry-6357f34138
Admin handbook: False failure condition for the documented single-file config mount (tested healthy with the file in a 700 host directory). [defects, defects #202085]		highfixed-before-releaseheld review (review model)—
RSD-registry-d78f01c405
Admin handbook: Parent-directory search requirement is false for a single-file bind mount. [defects, defects #202086]		highfixed-before-releaseheld review (review model)—
RSD-registry-82ba423a90
Admin handbook: The example mounts a single file (-v /path/to/config.yml:...); the directory-search requirement is false for it. [defects, defects #202087]		highfixed-before-releaseheld review (review model)—
RSD-registry-f381126fca
Admin handbook: Same false requirement in Troubleshooting (single-file mount works from a 700 directory). [defects, defects #202088]		highfixed-before-releaseheld review (review model)—
RSD-registry-77d881881d
Database handbook: False: single-file mount of a config.yml in a 700 host directory starts healthy; a 600 file owned by the host user fails because of the file mode, not the directory. [defects, defects #202089]		highfixed-before-releaseheld review (review model)—
RSD-registry-040d000042
Database handbook: Same false directory requirement for the `-v /path/to/config.yml:/etc/distribution/config.yml:ro` example. [defects, defects #202090]		highfixed-before-releaseheld review (review model)—
RSD-registry-394e87b5fd
Database handbook: Same false directory requirement for the single-file mount in Container Runtime. [defects, defects #202091]		highfixed-before-releaseheld review (review model)—
RSD-registry-d15529db0a
Database handbook: Parent directories do not need to be searchable or writable by uid 999. [defects, defects #202092]		lowfixed-before-releaseheld review (review model)—
RSD-registry-60a0785480
Database handbook: Wrong error text for a certificate permission failure; contradicts Operating facts. [defects, defects #202093]		lowfixed-before-releaseheld review (review model)—
RSD-registry-c7f33035c5
Database handbook: Wrong error text. [defects, defects #202094]		lowfixed-before-releaseheld review (review model)—
RSD-registry-5c3930f6ce
Database handbook: An unreadable configuration file is a configuration error (exit 1), not a panic (exit 2); contradicts Operating facts. [defects, defects #202095]		lowfixed-before-releaseheld review (review model)—
RSD-registry-1301751989
Database handbook: Wrong cause: login does not stop the password being printed. [defects, defects #202096]		lowfixed-before-releaseheld review (review model)—
RSD-registry-a5055ca347
Database handbook: The shown command uses `>`, which overwrites; repeating it as written loses the earlier users. [defects, defects #202097]		lowfixed-before-releaseheld review (review model)—
RSD-registry-ac01054bf7
Admin handbook: Sentence contradicts the next one and the behaviour. [defects, defects #202098]		lowfixed-before-releaseheld review (review model)—
RSD-registry-aa5cd5ca55
Admin handbook: In the documented procedure the docker user does exist in the shared file (registry1's); the paragraph says it is removed. [defects, defects #202099]		lowfixed-before-releaseheld review (review model)—
RSD-registry-0dcc9ff827
Admin handbook: Status is 404 BLOB_UPLOAD_INVALID, not 500. [defects, defects #202100]		lowfixed-before-releaseheld review (review model)—
RSD-registry-f91d31e96d
Admin handbook: Container names differ between the two procedures of the same section. [defects, defects #202101]		lowfixed-before-releaseheld review (review model)—
RSD-registry-fe811b1004
Admin handbook: Unsupported version claim. [defects, defects #202102]		lowfixed-before-releaseheld review (review model)—
RSD-registry-8c53c9bbea
Admin handbook: The image has no entrypoint script that hands off; the entrypoint is the registry binary. [defects, defects #202103]		lowfixed-before-releaseheld review (review model)—
RSD-registry-8c694f53ee
Admin handbook: Reintroduces the round-1/2 false promise that the load balancer can route to any backend. [defects, defects #202725]		highfixed-before-releaseheld review (review model)—
RSD-registry-565247bcf5
Admin handbook: A missing volume does not make the registry exit: it starts healthy on the writable layer, as lines 876 and 927 of the same documents say. [defects, defects #202726]		lowfixed-before-releaseheld review (review model)—
RSD-registry-110afcdd1c
Admin handbook: Sentence contradicts itself and the Operating facts (stop the registry, then archive); an archive of a running registry is not supported by any record. [defects, defects #202727]		lowfixed-before-releaseheld review (review model)—
RSD-registry-139fd628cb
Admin handbook: --insecure-registry is a dockerd option, not a flag of the Docker client commands (docker login/push); the sentence sends the customer to a flag that does not exist where it is named. [defects, defects #202728]		lowfixed-before-releaseheld review (review model)—
RSD-registry-a4a449d6f8
Admin handbook: Backwards: the filtered form (2>&1 | grep level=error) never shows access lines; they appear only in the unfiltered form. [defects, defects #202729]		lowfixed-before-releaseheld review (review model)—
RSD-registry-afe12e12b7
Admin handbook: The registry has one name pattern; a multi-component name works on the plain {name} paths too. [defects, defects #202730]		lowfixed-before-releaseheld review (review model)—
RSD-registry-8fdaf86b72
Database handbook: The header is shown with literal backslashes; the registry sends Basic realm="Registry". [defects, defects #202731]		lowfixed-before-releaseheld review (review model)—
RSD-registry-50fdbe50db
Database handbook: 'One respect' is false: the shipped file also turns authentication on, binds the debug listener to loopback and sets log level info; contradicts the file's own comment and the Operating facts. [defects, defects #202732]		lowfixed-before-releaseheld review (review model)—
RSD-registry-f1ca90e77f
Admin handbook: The Routes table labels the plain {name} paths 'single-component repository' (lines 638, 640-643) and the {namespace}/{name} paths 'namespaced repository' (639, 644-647), implying a multi-component… [defects, defects #203992]		lowfixed-before-releaseheld review (review model)—
RSD-registry-92d56ab46a
Admin handbook: The touch/chmod block is printed after the tar block (lines 764 then 770) although the sentence says it comes first. [defects, defects #203993]		lowfixed-before-releaseheld review (review model)—
RSD-registry-afbacc6c76
Database handbook: The endpoint answers Content-Type text/plain; version=0.0.4 (Prometheus text format), not OpenMetrics; no record shows OpenMetrics is served. [defects, defects #203994]		lowfixed-before-releaseheld review (review model)—
RSD-registry-cd67600ad2
Database handbook: `docker logs` prints both streams; stderr is simply not carried through a pipe. [defects, defects #203995]		lowfixed-before-releaseheld review (review model)—
RSD-registry-4013e46721
Database handbook: A volume is an option of docker run: `docker restart` keeps the mounts of the existing container, and re-running the edited run command fails with the name `registry` already in use; the container… [defects, defects #203996]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:5f04c71c049e55ba4d5ff16ae84225340b32ca9b42991e99b5d02c1cc767aacc · published digest sha256:5f04c71c049e55ba4d5ff16ae84225340b32ca9b42991e99b5d02c1cc767aacc · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 98) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T10:38:19Z · failing Docker Scout counts 12 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T10:38:09Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3763282609 · transparency-log entry · integrated 2026-11-09T10:40:50Z) [ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:8a39c46f3fb35d90da573e8d03706321904dc68f874279e4f62798e13b2c6766 · state attached · log index 3763283678 · transparency-log entry
    • kind sbom · digest sha256:8a39c46f3fb35d90da573e8d03706321904dc68f874279e4f62798e13b2c6766 · state attached · log index 3763284715 · transparency-log entry
    • kind vsa · digest sha256:8a39c46f3fb35d90da573e8d03706321904dc68f874279e4f62798e13b2c6766 · state attached · log index 3763285861 · transparency-log entry
    • kind provenance · digest sha256:5f04c71c049e55ba4d5ff16ae84225340b32ca9b42991e99b5d02c1cc767aacc · state attached · log index 3763286709 · transparency-log entry
    • kind sbom · digest sha256:5f04c71c049e55ba4d5ff16ae84225340b32ca9b42991e99b5d02c1cc767aacc · state attached · log index 3763287499 · transparency-log entry
    • kind vsa · digest sha256:5f04c71c049e55ba4d5ff16ae84225340b32ca9b42991e99b5d02c1cc767aacc · state attached · log index 3763289003 · transparency-log entry
    (at 2026-11-09T10:40:50Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/registry/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T06:35:44Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:5f04c71c049e55ba4d5ff16ae84225340b32ca9b42991e99b5d02c1cc767aacc [clean-room rebuild ledger, runs[688]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-08T03:05:32Z [stage_runs, stage_runs chain 864 stage publish_image]
  • Archive manifests written2026-11-09T10:39:39Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 69 · probed 2026-11-09T09:02:19Z · source g8) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T10:41:56Z generated: by KitForge release/build_trail.py · generator commit 689d6317d30e65d62baa6df3341eadc3f62cb7de
  • 2026-11-09T10:43:07Z publication: promoted at 2026-11-09T10:42:28Z · promoted digest sha256:8a39c46f3fb35d90da573e8d03706321904dc68f874279e4f62798e13b2c6766 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 409 · checklist status complete · checklist at 2026-11-09T10:43:07Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/registry/v3.1.2-CE-ubuntu24.04-r7/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/registry/v3.1.2-CE-ubuntu24.04-r7/), as staged for publishing—
ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.rebuild.jsonbeside the archive (prodasset /data/production/registry/v3.1.2-CE-ubuntu24.04-r7/), as staged for publishing—
ReadyStack-registry-v3.1.2-CE-ubuntu24.04-r7.rebuild.json.sigstorebeside the archive (prodasset /data/production/registry/v3.1.2-CE-ubuntu24.04-r7/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/registry/v3.1.2-CE-ubuntu24.04-r7/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)540
chainssadb, ReadyStack's engine database (not published)864
defectssadb, ReadyStack's engine database (not published)registry v3.1.2-CE-ubuntu24.04-r7
drive_runssadb, ReadyStack's engine database (not published)chain 864
held_roundssadb, ReadyStack's engine database (not published)chain 864
lesson_recallssadb, ReadyStack's engine database (not published)chain 864
micro_step_runssadb, ReadyStack's engine database (not published)chain 864
release_imagessadb, ReadyStack's engine database (not published)registry v3.1.2-CE-ubuntu24.04-r7
stage_eventssadb, ReadyStack's engine database (not published)chain 864
stage_runssadb, ReadyStack's engine database (not published)chain 864
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—