Apache Superset 6.1.0-CE-ubuntu24.04-r5 build trail

How ReadyStack built readystack/superset:6.1.0-CE-ubuntu24.04-r5 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/superset:6.1.0-CE-ubuntu24.04-r5
  • Index digestsha256:2e1b5800670028414d0057e3481a2643a47ac97ac830e0f841a96ca484e86fb0
  • linux/amd64 digestsha256:b2ce1e6e7f1c25b5c22f766fd9d943d1c84f27d138b360597379578b3fe6f771
  • ArchiveReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.tar.gz
  • Archive SHA-256 nowbafee7230d49a42f52704a8153ea3062a962fe1205c085a70466e9d0187931b8
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-11T01:41:48Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.trail.json.sigstore ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.trail.json
ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.trail.jsonReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.trail.json.sigstoreReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.trail.mdApache Superset product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductApache Superset (superset) [MANIFEST.json]
  • Release tag6.1.0-CE-ubuntu24.04-r5 [MANIFEST.json]
  • Imagereadystack/superset:6.1.0-CE-ubuntu24.04-r5 [MANIFEST.json]
  • Image index digestsha256:2e1b5800670028414d0057e3481a2643a47ac97ac830e0f841a96ca484e86fb0 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:b2ce1e6e7f1c25b5c22f766fd9d943d1c84f27d138b360597379578b3fe6f771 [ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.tar.gz (bytes 830387555) [MANIFEST.json]
  • Archive sha256 at publish114826f8370003e9b384fe32ddb928d61255372913b74a3e03fdedaa3c3e414e [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/apache/superset [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref6.1.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitc83fb2bb1dcfac41ac51bcebd82471f4a7180d18 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash33f51912dbfeb76ed01a8c9bf599cc0c10ff67821868c648e64c0fdf32737ae9 (files 7493) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:7d17d3278f0400d1914c1a4d9193bda7821b62413f14f44bedf3d3e561d9dca4 [ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794290162 (utc 2026-11-10T05:56:02Z) [ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.rebuild.json, engine]
  • Engine commit(s)
    • commit e3eaace0a74e1a10fea82b44f3849ea9a0e2216a · dirty yes · first drive 4151
    • commit 4c9b9ae57bdaa41861e468b83c8303059b789f97 · dirty yes · first drive 4183
    • commit 40e81e58cfc3900bc3db063b06c1947cb0d9c1bb · dirty yes · first drive 4218
    • commit 8c06307911557c927272aed1342f4fd649c279f0 · dirty yes · first drive 4230
    • commit 46082b13c8804936006ea4a756f16056183148fd · dirty yes · first drive 4235
    • commit 28643fdaf7cf653d83d33c09e065e7533296b5ab · dirty yes · first drive 4240
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain943 (created 2026-11-10T06:10:24Z · trigger customer_request · upstream version 6.1.0) [chains, chains #943]
  • Requestbuild request #622 (rebuild) (requested at 2026-11-10T06:02:08Z · requested by kitforge-agent · version 6.1.0) [build_requests, build_requests #622]
  • Reasonrevision 6.1.0-CE-ubuntu24.04-r5: same upstream version re-dated by its own release (owner 2026-11-10 "date images correctly") [build_requests, build_requests #622 request_reason]
  • Supersedesreadystack/superset:6.1.0-CE-ubuntu24.04-r4 (chain 802) [chains, chains #802]

The path through the harness

Fully recorded

1 chain · 6 drives · 18 stages · 3 rewinds

Chain 943 release · ready_to_ship

Created 2026-11-10T06:10:24Z, upstream 6.1.0, build request 622 [chains, chains #943]

DriveStartedMinutesBuild hostHow it stopped
41512026-11-10T06:10:54Z3.9build host 4 withhold-publish stage_failed at assemble_kit; first failed check exists:first_build_digest; 4 ticks [drive_runs, drive_runs #4151]
41832026-11-10T20:45:49Z48.1build host 4 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 15 ticks [drive_runs, drive_runs #4183]
42182026-11-10T23:21:40Z16.7build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4218]
42302026-11-11T00:25:18Z9.6build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4230]
42352026-11-11T00:59:12Z9.3build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4235]
42402026-11-11T01:30:29Z—build host 4 publish-held not recorded [drive_runs, drive_runs #4240]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-10T06:11:05Z2026-11-10T06:11:05Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 0386737ffb36…
acquire 2026-11-10T06:11:17Z2026-11-10T06:11:18Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 0f63ce6b1a17…
license_file ff254eb676d6…
custody_inputs 00a4dc7aa900…
source_tree_hash 076be5060bc9…
source_file_manifest f571f368454a…
plan 2026-11-10T06:12:27Z2026-11-10T06:12:28Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 7e35f4fa6262…
input_pin_plan 186caf907ab7…
toolchain_lock a04cd1fd1e94…
assemble_kit 2026-11-10T06:14:49Z2026-11-10T20:57:44Z2
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile ee28a59cc012…
build_recipe 66671bb512d9…
system_pinning 3eac9630c326…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health f59df95f78d3…
verify_offline_sh 3e8184ea230c…
base_image_digests 66963822f18a…
dockerfile_offline ee28a59cc012…
first_build_digest 1b6a2824b00a…
remediate 2026-11-10T20:59:17Z2026-11-10T20:59:18Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 0e021be80ae8…
security_report 5b887db23e96…
build_kit 2026-11-10T21:11:30Z2026-11-10T21:11:31Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 09ab6f6d4243…
locked_digest 05b1bb7c4da4…
freeze_manifest afeba5e244eb…
offline_rebuild_transcript db2c2a35855e…
verdict 2026-11-10T21:14:55Z2026-11-10T21:14:56Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 35dfac314a1f…
publish_image 2026-11-10T21:16:24Z2026-11-10T21:16:25Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 503aa9615709…
promotion_record e8d13c13c88b…
boot_instance 2026-11-10T21:17:43Z2026-11-10T21:17:46Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 1b9444265f0f…
sbom 2026-11-10T21:18:27Z2026-11-10T21:18:28Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md d84be7268671…
sbom_json 8878b7c57659…
schema_discovery 2026-11-10T21:18:31Z2026-11-10T21:18:32Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 5a267f0d4fb6…
dependency_tree d4104de55c95…
table_classification 766efff6c1e5…
admin_handbook 2026-11-10T21:24:51Z2026-11-10T21:24:52Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 55755968e648…
admin_handbook 3faffcfc9759…
db_handbook 2026-11-10T21:31:30Z2026-11-10T21:31:31Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 935c309ca3e1…
seed_isolation b92860746389…
seed_data 2026-11-10T21:31:45Z2026-11-10T21:31:46Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql f09663432233…
seed_cases_json 4887152ecb3d…
seed_validate 2026-11-10T21:31:48Z2026-11-10T21:31:49Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 90b63a509717…
usecase_validate 2026-11-10T21:32:17Z2026-11-10T21:32:17Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 56ff33770d42…
test_results 5caf472ca044…
usecase_contract 4ad7bf5a91ef…
finalize_docs 2026-11-10T21:32:24Z2026-11-10T21:32:24Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json d553b9ddb9da…
release_notes 8095741d7e15…
api_integration_guide 53a45cc41df7…
package_archive invalidated 2026-11-11T01:30:05Z 2026-11-10T21:33:52Z2026-11-11T01:08:27Z4
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 7b10698a9a73…
checksums bf0f37a1ce30…
verify_md e0ffdf68b4a8…
rebuild_md 710a6e36a795…
manifest_txt 437f872cfc2b…
actions_jsonl 2daf9e3c04d1…
provenance_md 7f5974eae679…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 192005ef6d91…

[stage_runs]

Rewinds

  • 2026-11-11T00:21:22Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30960]
  • 2026-11-11T00:57:57Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #30987]
  • 2026-11-11T01:30:05Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #31007]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-11T01:08:27Z.

70 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 021750 —
remediate2001 028028 L-A08, L-038, L-036, L-034, L-032
admin_handbook25803 1135794 —
db_handbook401503 4217405 —
usecase_validate1001 02207 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $3.73 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-10T23:39:28Z 118 findings to repackage [held_rounds, held_rounds #1717] $1.58 3 rounds, $40.00 b16484d653dc…
22026-11-11T00:35:32Z 015 findings to repackage [held_rounds, held_rounds #1722] $1.16 3 rounds, $40.00 162590dc5cb8…
32026-11-11T01:09:12Z 001 clean to publish [held_rounds, held_rounds #1724] $1.00 3 rounds, $40.00 7b10698a9a73…

Defects

Fully recorded
  • Ledger entries18 [defects, defects where product_slug=superset and this tag or chain]
  • Disclosed in the archive18 [docs/defects/defects.json, entries]

18 ledger entries: by severity low 15, critical 1, high 2; by status open 1, fixed-before-release 17.

DefectSeverityStatusFound byFixed in
RSD-superset-5f1ea9733c
While SUPERSET_ADMIN_PASSWORD is set, every start passes the admin password on a process command line [defects, defects #236269]		lowopenheld review (review model)—
RSD-superset-6fa4af6f35
Database handbook: The documented restore pipes the dump into the live, already-initialised database (the same db container that was backed up). [defects, defects #239362]		criticalfixed-before-releaseheld review (review model)—
RSD-superset-7eefda7879
Admin handbook: The only documented way to change the database password wipes every user, dashboard, chart and saved query without saying so, lists the volume removal before the container removal (which fails), and… [defects, defects #239363]		highfixed-before-releaseheld review (review model)—
RSD-superset-86f7e7f709
Admin handbook: The image does not use Docker's default 30 s interval, and its HEALTHCHECK timeout is not 10 s (only curl's --max-time is). [defects, defects #239364]		lowfixed-before-releaseheld review (review model)—
RSD-superset-bf51d0878a
Admin handbook: Says no recovery is documented, but Common Issues and Troubleshooting documents one (`delete from dbs`). [defects, defects #239365]		lowfixed-before-releaseheld review (review model)—
RSD-superset-8d0eaeea07
Database handbook: gunicorn binds all interfaces, not loopback; the loopback claim contradicts the entrypoint and would make `-p 8088:8088` unusable if it were true. [defects, defects #239366]		lowfixed-before-releaseheld review (review model)—
RSD-superset-afe28ce566
Database handbook: Contradicts the same handbook ('approximately one minute') and the admin handbook, and is shorter than measured. [defects, defects #239367]		lowfixed-before-releaseheld review (review model)—
RSD-superset-50dd6020f4
Admin handbook: The word 'only' is false and the sentence contradicts the Overview, which lists /static/ as unauthenticated. [defects, defects #239368]		lowfixed-before-releaseheld review (review model)—
RSD-superset-b37c7671eb
Database handbook: Contradicts the same handbook's Network and Ports section and endpoint list, which add /healthcheck; /ping is also unauthenticated. [defects, defects #239369]		lowfixed-before-releaseheld review (review model)—
RSD-superset-5a503d9da7
Admin handbook: The documented db run command already mounts the named volume superset-db, so removing the container does not lose data; the following sentence then tells the reader to mount a volume as if the… [defects, defects #239370]		lowfixed-before-releaseheld review (review model)—
RSD-superset-bdb554b0a3
API guide: The Routes table gives GET, POST for the chart, dashboard and dataset collections and GET for /me/, but the release's OpenAPI document lists DELETE on those three collections and PUT on /me/; the… [defects, defects #239371]		lowfixed-before-releaseheld review (review model)—
RSD-superset-5263ba38ff
Admin handbook: The documented password-change command puts the new password inside a double-quoted host shell string, so a password containing $ (the handbook invites special characters) is expanded by the host… [defects, defects #240996]		highfixed-before-releaseheld review (review model)—
RSD-superset-a905f9cac3
Admin handbook: Repeats the round-1 error that the image's HEALTHCHECK timeout is 10 s; only curl's --max-time is 10 s. [defects, defects #240997]		lowfixed-before-releaseheld review (review model)—
RSD-superset-ee061d8dfd
Database handbook: Same paraphrase of the corrected round-1 finding: the HEALTHCHECK timeout is 900 s, 10 s is only curl's --max-time, and the interval and start period are omitted. [defects, defects #240998]		lowfixed-before-releaseheld review (review model)—
RSD-superset-d8d44a1ccc
Database handbook: Contradicts the same handbook (lines 676 and 743 list /ping and the static assets as unauthenticated); /ping answers 200 without credentials (same class as the round-1 minor). [defects, defects #240999]		lowfixed-before-releaseheld review (review model)—
RSD-superset-e05a307004
Database handbook: The count is wrong and contradicts the handbook's own line 959 and the admin handbook line 761: RELEASE_NOTES lists 19 raised minimums in total, which include the four libraries, so beyond them… [defects, defects #241000]		lowfixed-before-releaseheld review (review model)—
RSD-superset-849f394830
Admin handbook: The condition is contradictory: the decryption error only occurs when a connection has been saved, so a deployment with no saved connections never meets it (it starts with any key). [defects, defects #241001]		lowfixed-before-releaseheld review (review model)—
RSD-superset-59fd137076
Admin handbook: The documented recovery names a failure (datasets reference the connection) but gives no way past it, so a deployment with datasets cannot complete the recovery as written. [defects, defects #241598]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:b2ce1e6e7f1c25b5c22f766fd9d943d1c84f27d138b360597379578b3fe6f771 · published digest sha256:b2ce1e6e7f1c25b5c22f766fd9d943d1c84f27d138b360597379578b3fe6f771 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 305) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-11T01:31:24Z · failing Docker Scout counts 102 packages with copyleft licences (GPL, LGPL, MPL), 101 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-11T01:30:39Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3799106989 · transparency-log entry · integrated 2026-11-11T01:40:15Z) [ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:2e1b5800670028414d0057e3481a2643a47ac97ac830e0f841a96ca484e86fb0 · state attached · log index 3799112380 · transparency-log entry
    • kind sbom · digest sha256:2e1b5800670028414d0057e3481a2643a47ac97ac830e0f841a96ca484e86fb0 · state attached · log index 3799115465 · transparency-log entry
    • kind vsa · digest sha256:2e1b5800670028414d0057e3481a2643a47ac97ac830e0f841a96ca484e86fb0 · state attached · log index 3799118641 · transparency-log entry
    • kind provenance · digest sha256:b2ce1e6e7f1c25b5c22f766fd9d943d1c84f27d138b360597379578b3fe6f771 · state attached · log index 3799121820 · transparency-log entry
    • kind sbom · digest sha256:b2ce1e6e7f1c25b5c22f766fd9d943d1c84f27d138b360597379578b3fe6f771 · state attached · log index 3799124474 · transparency-log entry
    • kind vsa · digest sha256:b2ce1e6e7f1c25b5c22f766fd9d943d1c84f27d138b360597379578b3fe6f771 · state attached · log index 3799127055 · transparency-log entry
    (at 2026-11-11T01:40:17Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/superset/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-10T23:39:35Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:b2ce1e6e7f1c25b5c22f766fd9d943d1c84f27d138b360597379578b3fe6f771 [clean-room rebuild ledger, runs[737]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-10T21:16:25Z [stage_runs, stage_runs chain 943 stage publish_image]
  • Archive manifests written2026-11-11T01:35:31Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 979 · probed 2026-11-10T21:06:07Z · source build_kit) [release_images, isa_level_hard]

History

3 events
  • 2026-11-11T01:41:48Z generated: by KitForge release/build_trail.py · generator commit 28643fdaf7cf653d83d33c09e065e7533296b5ab
  • 2026-11-11T01:44:15Z publication: promoted at 2026-11-11T01:42:27Z · promoted digest sha256:2e1b5800670028414d0057e3481a2643a47ac97ac830e0f841a96ca484e86fb0 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 461 · checklist status complete · checklist at 2026-11-11T01:44:15Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
  • 2026-11-12T04:25:55Z repack: previous sha256 114826f8370003e9b384fe32ddb928d61255372913b74a3e03fdedaa3c3e414e · sha256 bafee7230d49a42f52704a8153ea3062a962fe1205c085a70466e9d0187931b8 · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); README.md and FILE_MODES.tsv at the archive root (release/kit_unpack.py), BUILD_OFFLINE.sh putting back the packed file modes, REBUILD.md unpacking with -p and keeping the key and signature outside the kit, and the verifier naming what differs; not image inputs; image and every build input unchanged · label kitfix · replaced BUILD_OFFLINE.sh, docs/REBUILD.md, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, docs/rebuild-bundle/rebuild_bundle.py · added FILE_MODES.tsv, README.md · record MANIFEST.json repack_history

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/superset/6.1.0-CE-ubuntu24.04-r5/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/superset/6.1.0-CE-ubuntu24.04-r5/), as staged for publishing—
ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.rebuild.jsonbeside the archive (prodasset /data/production/superset/6.1.0-CE-ubuntu24.04-r5/), as staged for publishing—
ReadyStack-superset-6.1.0-CE-ubuntu24.04-r5.rebuild.json.sigstorebeside the archive (prodasset /data/production/superset/6.1.0-CE-ubuntu24.04-r5/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/superset/6.1.0-CE-ubuntu24.04-r5/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)622
chainssadb, ReadyStack's engine database (not published)943
defectssadb, ReadyStack's engine database (not published)superset 6.1.0-CE-ubuntu24.04-r5
drive_runssadb, ReadyStack's engine database (not published)chain 943
held_roundssadb, ReadyStack's engine database (not published)chain 943
lesson_recallssadb, ReadyStack's engine database (not published)chain 943
micro_step_runssadb, ReadyStack's engine database (not published)chain 943
release_imagessadb, ReadyStack's engine database (not published)superset 6.1.0-CE-ubuntu24.04-r5
stage_eventssadb, ReadyStack's engine database (not published)chain 943
stage_runssadb, ReadyStack's engine database (not published)chain 943
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—