SeaweedFS 4.53-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/seaweedfs:4.53-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

An earlier release. The current release's build trail

This trail

As JSON
  • Imagereadystack/seaweedfs:4.53-CE-ubuntu24.04-r1
  • Index digestsha256:d3b1cd129a7daa527ef34ef9bc091145a118d3c59a29ddfdefcb25f093956878
  • linux/amd64 digestsha256:0008f8cb8a0bdd145fac6afb290147a1132dc51937dbf2c7a44dca393ca75a3d
  • ArchiveReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 now6e726113f76514f044fafbc32ecea9ca50e70f9b2501f277262ffb01eb634821
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T21:57:29Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.trail.json
ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.trail.jsonReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.trail.mdSeaweedFS product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductSeaweedFS (seaweedfs) [MANIFEST.json]
  • Release tag4.53-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/seaweedfs:4.53-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:d3b1cd129a7daa527ef34ef9bc091145a118d3c59a29ddfdefcb25f093956878 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:0008f8cb8a0bdd145fac6afb290147a1132dc51937dbf2c7a44dca393ca75a3d [ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.tar.gz (bytes 681225770) [MANIFEST.json]
  • Archive sha256 at publish6e726113f76514f044fafbc32ecea9ca50e70f9b2501f277262ffb01eb634821 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/seaweedfs/seaweedfs [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref4.53 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit4ab66fb76da83700739f5839e62fcaf15fb7d02a [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash42c6c5f14034063085988ec79814542c769e3d1a464c2ded43a31a85925f76f6 (files 4598) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:8692eee02a16d7d1dc0ba1e8627f9e8e7df2c844d719f1b2c9f101762fb7fc93 [ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794161433 (utc 2026-11-08T18:10:33Z) [ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit d42769157e3aad564f2494e1b1154cdf7a580a39 · dirty yes · first drive 3989
    • commit 6c084534f784f7171ae351892e74c39b28d639ce · dirty yes · first drive 4107
    • commit bd4bd1a56cd0e6abd6c847dfc6ac025feec74ba0 · dirty yes · first drive 4114
    • commit 48ed93f7dd35077f77743f112310b19ee5fc8d88 · dirty yes · first drive 4115
    • commit 6315de04eae9ffa389986e3d6b60c6c53fa669ec · dirty yes · first drive 4116
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain921 (created 2026-11-09T09:16:19Z · trigger customer_request · upstream version 4.53) [chains, chains #921]
  • Requestbuild request #553 (rebuild) (requested at 2026-11-08T04:08:31Z · requested by kitforge-agent · version 4.52) [build_requests, build_requests #553]
  • Reasonrevision 4.52-CE-ubuntu24.04-r2: same upstream version rebuilt on the chiselled runtime (slim base; retarget.py --rev-bump) [build_requests, build_requests #553 request_reason]
  • Supersedesreadystack/seaweedfs:4.52-CE-ubuntu24.04-r1 (chain 813) [chains, chains #813]

The path through the harness

Fully recorded

1 chain · 5 drives · 18 stages · 4 rewinds

Chain 921 release · ready_to_ship

Created 2026-11-09T09:16:19Z, upstream 4.53, build request 553 [chains, chains #921]

DriveStartedMinutesBuild hostHow it stopped
39892026-11-09T09:16:46Z42.1build host 2 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3989]
41072026-11-09T19:45:02Z25.2build host 2 withhold-publish ready_to_ship at package_archive; 18 ticks [drive_runs, drive_runs #4107]
41142026-11-09T20:43:22Z4.5build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4114]
41152026-11-09T21:18:55Z4.5build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4115]
41162026-11-09T21:51:21Z—build host 2 publish-held not recorded [drive_runs, drive_runs #4116]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-09T09:16:57Z2026-11-09T09:16:58Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 36c5f6ffd8f5…
acquire 2026-11-09T09:17:08Z2026-11-09T19:45:25Z2
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 6059d25e7110…
license_file d789d433cc11…
custody_inputs ba32fe65e0f7…
source_tree_hash 884ceaace939…
source_file_manifest 8857ebb55e10…
plan 2026-11-09T09:17:45Z2026-11-09T19:45:30Z2
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 5b29b6a4fdb9…
input_pin_plan 67983db539ad…
toolchain_lock a471a7493d60…
assemble_kit 2026-11-09T09:24:13Z2026-11-09T19:52:07Z2
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 6f72b7135cf6…
build_recipe 2e45101d63fc…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 395f12e9ade2…
verify_offline_sh 3e8184ea230c…
base_image_digests f108985631dd…
dockerfile_offline 6f72b7135cf6…
first_build_digest af819e43d268…
remediate 2026-11-09T09:25:00Z2026-11-09T19:52:11Z2
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 93a000f07896…
security_report 4b49c6bb0cb5…
build_kit 2026-11-09T09:32:14Z2026-11-09T19:59:25Z2
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 3bf4e515ec40…
locked_digest e83117ecaeda…
freeze_manifest 153105ad24bb…
offline_rebuild_transcript 5c361bf56297…
verdict 2026-11-09T09:32:56Z2026-11-09T20:00:05Z2
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 40e2990a2b82…
publish_image 2026-11-09T09:33:33Z2026-11-09T20:00:48Z2
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme c3786d260cea…
promotion_record 7c4cbd634ff1…
boot_instance 2026-11-09T09:33:44Z2026-11-09T20:01:04Z4
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 1649b041242a…
sbom 2026-11-09T09:34:02Z2026-11-09T20:01:17Z2
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 41e4c4a5f3ed…
sbom_json 93d0395d8af4…
schema_discovery 2026-11-09T09:34:05Z2026-11-09T20:01:20Z2
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 496027682ffd…
dependency_tree e39f2fcc43cf…
table_classification b6f29090da43…
admin_handbook 2026-11-09T09:46:43Z2026-11-09T20:01:27Z2
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map c2571b35a94a…
admin_handbook 0a363f0572a3…
db_handbook 2026-11-09T09:57:47Z2026-11-09T20:01:38Z2
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook d2e5f9378862…
seed_isolation c8258f1718be…
seed_data 2026-11-09T09:57:54Z2026-11-09T20:01:45Z2
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql bb45adceb563…
seed_cases_json 27e448f95713…
seed_validate 2026-11-09T09:57:57Z2026-11-09T20:01:49Z2
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 8dd1620901e7…
usecase_validate 2026-11-09T09:58:11Z2026-11-09T20:01:58Z2
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests df8cd5772e2a…
test_results a0410d251839…
usecase_contract 656d9ef72751…
finalize_docs 2026-11-09T09:58:19Z2026-11-09T20:02:06Z2
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json cea9a7a0886b…
release_notes 706106b2ad9c…
api_integration_guide 1ed16821d603…
package_archive invalidated 2026-11-09T21:50:58Z 2026-11-09T09:58:54Z2026-11-09T21:23:22Z4
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 15adf57aeb3f…
checksums a7ae6573e316…
verify_md 309af996dbca…
rebuild_md 15dde8e928b2…
manifest_txt 1efc22f0537d…
actions_jsonl dcf0a49def2c…
provenance_md e1d9f9025e7a…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json c4886e6eb470…

[stage_runs]

Rewinds

  • 2026-11-09T19:45:04Z: package_archive to acquire on source_changed (source changed: the acquired source is 4.52 (commit 984eac6a790b) but the strategy builds 4.53: acquire runs again so the source tree, its hash, the custody record and the acquisition copy describe what is built) [stage_events, stage_events #29726]
  • 2026-11-09T20:42:08Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29859]
  • 2026-11-09T21:17:19Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29863]
  • 2026-11-09T21:50:58Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29867]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T21:23:22Z.

110 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 07942 —
remediate2001 011755 L-A08, L-038, L-036, L-034, L-032
admin_handbook541703 1524672 —
db_handbook511203 2476653 —
usecase_validate1001 01476 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $7.78 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T20:12:06Z 1419 findings to repackage [held_rounds, held_rounds #1671] $2.50 3 rounds, $40.00 ef50403c5192…
22026-11-09T20:49:10Z 0117 findings to repackage [held_rounds, held_rounds #1672] $3.41 3 rounds, $40.00 dd948e0e00ad…
32026-11-09T21:24:00Z 0011 clean to publish [held_rounds, held_rounds #1673] $1.87 3 rounds, $40.00 15adf57aeb3f…

Defects

Fully recorded
  • Ledger entries53 [defects, defects where product_slug=seaweedfs and this tag or chain]
  • Disclosed in the archive53 [docs/defects/defects.json, entries]

53 ledger entries: by severity critical 1, high 5, low 47; by status fixed-before-release 53.

DefectSeverityStatusFound byFixed in
RSD-seaweedfs-5e0fec19b9
Database handbook: The Option 2 identities-file example puts accessKey/secretKey directly on the identity; SeaweedFS reads keys only from the identity's "credentials" array, so the container starts but no key works… [defects, defects #225022]		criticalfixed-before-releaseheld review (review model)—
RSD-seaweedfs-2a0273932d
Admin handbook: States that 18333 is loopback-only; it listens on all interfaces and is reachable from other containers (guarded only by the admin token). [defects, defects #225023]		highfixed-before-releaseheld review (review model)—
RSD-seaweedfs-b83f6be07f
Admin handbook: Cross-section contradiction: 18333 is named as loopback-only here but on all interfaces in Operating facts, Ports and line 687. [defects, defects #225024]		highfixed-before-releaseheld review (review model)—
RSD-seaweedfs-0c4573aa82
Admin handbook: Says the S3 gateway listens on loopback, which is false (8333 and 18333 listen on all interfaces) and contradicts lines 619-621 and the Operating facts. [defects, defects #225025]		highfixed-before-releaseheld review (review model)—
RSD-seaweedfs-d650e029f5
Database handbook: Lists S3 gRPC 18333 among the loopback-only, unreachable ports; it is reachable from other containers on the network. [defects, defects #225026]		highfixed-before-releaseheld review (review model)—
RSD-seaweedfs-1139c0310f
Admin handbook: Refers to "the two -e options" of a run command that does not have any. [defects, defects #225027]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-e884f61189
Admin handbook: Contradicts lines 234 and 1175: bare `docker logs` shows stderr too. [defects, defects #225028]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-beeb99c0a9
Admin handbook: The "last N lines" command prints nothing because it lacks 2>&1, the rule the section states just above. [defects, defects #225029]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-06078033bb
Admin handbook: The example has no credentials, data volume or port, so it exits at once. [defects, defects #225030]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-deeae5adae
Admin handbook: The one-off example probes a server that does not exist in that container and fails. [defects, defects #225031]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-03a65af5da
Admin handbook: Without -it the shell exits immediately. [defects, defects #225032]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-1d58b9d164
Admin handbook: Step order contradicts the instruction: the check "before you proceed" appears after the restore. [defects, defects #225033]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-718736db94
Admin handbook: A different volume name is a new, empty volume; the sentence claims it serves the old data. [defects, defects #225034]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-90d653268e
Admin handbook: Names a release (4.52-r2) the records do not support and that contradicts "4.48 and later" in the next section. [defects, defects #225035]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-89c9a3fa18
Admin handbook: Says the settings are not environment variables, then documents WEED_MASTER_VOLUME_GROWTH_COPY_1 as one. [defects, defects #225036]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-2e2b35a3f1
Database handbook: Quoted response body differs from the real one. [defects, defects #225037]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-b8f12baef0
Database handbook: /cluster/status and /dir/status are on the master port 9333, not 8333. [defects, defects #225038]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-1694dc8acf
Database handbook: The image sets a 5-second interval, not Docker's 30-second default. [defects, defects #225039]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-f5fdf30144
Database handbook: An unsigned request gets 403, not 500. [defects, defects #225040]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-991ca91110
Database handbook: False: in anonymous mode invalid credentials are not rejected. [defects, defects #225041]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-40cbf76efe
Database handbook: Contradicts the documented timing for existing data. [defects, defects #225042]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-898718490c
Database handbook: Conflates the brand-new-volume write window with the restart read window. [defects, defects #225043]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-2290b30a97
Database handbook: The example value restores the upstream default the image deliberately removed. [defects, defects #225044]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-ab8eef0380
Database handbook: Destructive step contradicts the tested restore procedure. [defects, defects #225045]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-a01701b9d2
Database handbook: The 'Data Corruption After Interrupted Restore' procedure restores into a new volume and then starts the container on the old volume, so the restored data is not served and the step-5 check proves… [defects, defects #225374]		highfixed-before-releaseheld review (review model)—
RSD-seaweedfs-64c73f3c49
Admin handbook: The one-off example names /usr/local/bin/weed, which does not exist in the image (weed is /usr/bin/weed), so the example fails at container creation. [defects, defects #225375]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-98138e5ae3
Admin handbook: Round-1 step-order finding persists: the existence check that must precede the restore is printed after it. [defects, defects #225376]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-8061bb8531
Admin handbook: Contradicts the tested result in Operating facts: objects created after the backup stay listed, they are not lost. [defects, defects #225377]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-3623543994
Admin handbook: 'Newer data is lost' contradicts the tested over-extraction result (post-backup objects and buckets remain listed). [defects, defects #225378]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-6255aca2eb
Admin handbook: 'Newly written objects may not persist' is not what was tested (they remained listed). [defects, defects #225379]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-94daf0ed37
Database handbook: Cross-section contradiction: line 1859 says writes after the extraction may be lost, line 1878 says newer objects are still listed. [defects, defects #225380]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-fdbb1d56d4
Admin handbook: The sentence invents writes made while no container runs and says they are lost on `docker rm`; neither happens, and it contradicts the persistence statement. [defects, defects #225381]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-68baeffa06
Admin handbook: Calls -volume.max=0 and WEED_MASTER_VOLUME_GROWTH_COPY_1=1 'fixed by the entrypoint' and then explains how to change them. [defects, defects #225382]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-bd70bee94f
Admin handbook: Names a hardening range (4.39 to 4.52) that no record supports; the records cover 4.39...4.48 and the enforcement is this image's entrypoint. [defects, defects #225383]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-48be0e9931
Database handbook: Says the container is 'ready to accept requests' within a few seconds, contradicting the documented 15-20 s first-write window and the rule that healthz=200 means started, not ready. [defects, defects #225384]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-8d9d1c8c06
Database handbook: 'Claims at startup' is wrong: volumes are claimed when a bucket needs storage, as the rest of the handbooks say. [defects, defects #225385]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-62479fda71
Database handbook: States 31 buckets for 31 GiB as fact while the record shows 22 buckets with 8 of 31 slots free. [defects, defects #225386]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-2b9a9a7c72
Database handbook: The heading calls all three endpoints loopback-only but the first is served on the published port 8333 and the bullet itself says it is reachable from the host. [defects, defects #225387]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-9165cb5aaf
Database handbook: Says 'the key' (right after discussing the operator's own key) is written to security.toml; only the generated key is. [defects, defects #225388]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-072a397ebb
Database handbook: Lists POST only on the object path although POST (multi-object delete) is also taken on the bucket path. [defects, defects #225389]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-5b0d1e46c6
Database handbook: 'One of these ports' reads as including 18333, which accepts connections, so the connection-reset claim is wrong for it. [defects, defects #225390]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-bd08a77c27
Database handbook: Names a docker command that does not exist as the thing that checks the endpoint. [defects, defects #225391]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-ad34dff8dc
Admin handbook: Paraphrase of the round-2 finding 'Newly written objects may not persist': the tested over-extraction result is that post-backup objects and buckets stay listed; the 'may not be present after a… [defects, defects #225756]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-30567a723a
Admin handbook: Step order: the existence check that must precede the restore is printed after the restore command (round-1 finding that persists; DB_HANDBOOK.md:1836-1850 and :1880-1890 have the right order). [defects, defects #225757]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-928d2737ab
Admin handbook: Same step-order defect: the check is announced as preceding the restore but is printed after the restore command block. [defects, defects #225758]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-454d6a6298
Admin handbook: Turns the measured figure (22 buckets tested, 8 of 31 slots still free) into an expectation/cap, contradicting the 'roughly one bucket per free GiB' statement in the same section (31). [defects, defects #225759]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-bce651a619
Database handbook: 'typical deployments' and 'multiple data volumes' are not what was tested; the record is one host with one /data volume (31 GiB free). [defects, defects #225760]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-daa010a6fb
Admin handbook: Names a version threshold (4.48) that no record supports; the requirement is this image's entrypoint (upstream 4.48 starts without credentials). [defects, defects #225761]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-4371667022
Database handbook: Invents a 4.48 cut-off for backing up, which implies no backup is needed from newer versions; contradicts 'Before upgrading, back up the /data volume' in the Upgrading sections (DB_HANDBOOK.md:1760,… [defects, defects #225762]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-9820f3b833
Admin handbook: Overstates the tested result: only the object overwritten after the backup answered 500; other objects stayed readable/listed. [defects, defects #225763]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-af2cfdabca
Admin handbook: Copying objects and listing object versions are claimed as supported; no record shows either tested (the suite is /healthz and /status; facts cover PUT bucket, PUT/GET object, multipart, list). [defects, defects #225764]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-3a088267ab
Database handbook: Overstates the API guide: it lists only GET /healthz and GET /status as verified and a two-row routing table, no request/response examples for signed S3 calls. [defects, defects #225765]		lowfixed-before-releaseheld review (review model)—
RSD-seaweedfs-9d9ea64a3b
Admin handbook: 'within a few seconds' contradicts the measured 13-21 s on an existing volume stated in Operating facts 'Health check' (same wording at DB_HANDBOOK.md:336). [defects, defects #225766]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:0008f8cb8a0bdd145fac6afb290147a1132dc51937dbf2c7a44dca393ca75a3d · published digest sha256:0008f8cb8a0bdd145fac6afb290147a1132dc51937dbf2c7a44dca393ca75a3d · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 198) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T21:51:43Z · failing Docker Scout counts 11 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T21:51:31Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3771044785 · transparency-log entry · integrated 2026-11-09T21:56:04Z) [ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:d3b1cd129a7daa527ef34ef9bc091145a118d3c59a29ddfdefcb25f093956878 · state attached · log index 3771049012 · transparency-log entry
    • kind sbom · digest sha256:d3b1cd129a7daa527ef34ef9bc091145a118d3c59a29ddfdefcb25f093956878 · state attached · log index 3771050196 · transparency-log entry
    • kind vsa · digest sha256:d3b1cd129a7daa527ef34ef9bc091145a118d3c59a29ddfdefcb25f093956878 · state attached · log index 3771051594 · transparency-log entry
    • kind provenance · digest sha256:0008f8cb8a0bdd145fac6afb290147a1132dc51937dbf2c7a44dca393ca75a3d · state attached · log index 3771053065 · transparency-log entry
    • kind sbom · digest sha256:0008f8cb8a0bdd145fac6afb290147a1132dc51937dbf2c7a44dca393ca75a3d · state attached · log index 3771054604 · transparency-log entry
    • kind vsa · digest sha256:0008f8cb8a0bdd145fac6afb290147a1132dc51937dbf2c7a44dca393ca75a3d · state attached · log index 3771056685 · transparency-log entry
    (at 2026-11-09T21:56:05Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/seaweedfs/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T20:12:11Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:0008f8cb8a0bdd145fac6afb290147a1132dc51937dbf2c7a44dca393ca75a3d [clean-room rebuild ledger, runs[713]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-09T20:00:48Z [stage_runs, stage_runs chain 921 stage publish_image]
  • Archive manifests written2026-11-09T21:53:59Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 62 · probed 2026-11-09T19:55:50Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T21:57:29Z generated: by KitForge release/build_trail.py · generator commit 05abe8d7b7461d3db17ba94ceab20e083311d123
  • 2026-11-09T21:58:58Z publication: promoted at 2026-11-09T21:58:05Z · promoted digest sha256:d3b1cd129a7daa527ef34ef9bc091145a118d3c59a29ddfdefcb25f093956878 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 438 · checklist status complete · checklist at 2026-11-09T21:58:58Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/seaweedfs/4.53-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/seaweedfs/4.53-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/seaweedfs/4.53-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-seaweedfs-4.53-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/seaweedfs/4.53-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/seaweedfs/4.53-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)553
chainssadb, ReadyStack's engine database (not published)921
defectssadb, ReadyStack's engine database (not published)seaweedfs 4.53-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 921
held_roundssadb, ReadyStack's engine database (not published)chain 921
lesson_recallssadb, ReadyStack's engine database (not published)chain 921
micro_step_runssadb, ReadyStack's engine database (not published)chain 921
release_imagessadb, ReadyStack's engine database (not published)seaweedfs 4.53-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 921
stage_runssadb, ReadyStack's engine database (not published)chain 921
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—