SWAG 5.9.0-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/swag:5.9.0-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/swag:5.9.0-CE-ubuntu24.04-r1
  • Index digestsha256:33a4430a4a12b61cda3be79755a8ebffe77f317b1d56493834cf2a95430c0cce
  • linux/amd64 digestsha256:fae67e509ab4b905beeb49e4c409e63f7bbeb36c13ba149af182d47d6b8797c3
  • ArchiveReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 nowdf74dc2fb2a4ad2576da24e70fd9d5eb7b4bce983327760db7ad0268136e6872
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T20:31:18Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.trail.json
ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.trail.jsonReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.trail.mdSWAG product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductSWAG (swag) [MANIFEST.json]
  • Release tag5.9.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/swag:5.9.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:33a4430a4a12b61cda3be79755a8ebffe77f317b1d56493834cf2a95430c0cce [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:fae67e509ab4b905beeb49e4c409e63f7bbeb36c13ba149af182d47d6b8797c3 [ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.tar.gz (bytes 402666879) [MANIFEST.json]
  • Archive sha256 at publishdf74dc2fb2a4ad2576da24e70fd9d5eb7b4bce983327760db7ad0268136e6872 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/linuxserver/docker-swag [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref5.9.0-ls497 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit24000edb531a50939fd4e1a9e5943aa659fb2dab [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashb8940a29f1bf74e97e31b5fafda9240ff496e094b57d146cf8afaa5dac2348b6 (files 152) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:cbd025e27356b36360677f878de056fe1e115f1aedc6a5541056f04497df8ec3 [ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793438806 (utc 2026-10-31T09:26:46Z) [ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit 373d3c6436c70a6b11e2c6f6d2aa49fc56a5a5c1 · dirty yes · first drive 3664
    • commit c5454541988413acee973d174dd436e17d7a9974 · dirty yes · first drive 3683
    • commit 893ddf91074580cc5f11ded7558920733b65fc43 · dirty yes · first drive 3945
    • commit 0f08e26ee402fd26c98aca5274d6a37e78400064 · dirty yes · first drive 3971
    • commit 5d0ff967b304c4cd787659a1843c76de2a7e8063 · dirty yes · first drive 4089
    • commit 91a955c6ea053cb5d1d14ee38103d7239668d234 · dirty yes · first drive 4098
    • commit 6c084534f784f7171ae351892e74c39b28d639ce · dirty yes · first drive 4106
    • commit a50b7385e20d13ac36f6f5f752bdaadce848ac1d · dirty yes · first drive 4111
    • commit 844b5eff31c4198de7a7e3f53d46cba192aeceb8 · dirty yes · first drive 4113
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain860 (created 2026-11-07T12:13:11Z · trigger customer_request · upstream version 5.9.0) [chains, chains #860]
  • Requestbuild request #489 (rebuild) (requested at 2026-11-03T05:16:44Z · requested by kitforge-agent · version 5.9.0) [build_requests, build_requests #489]
  • Reasonretarget to 5.9.0-ls497: a newer upstream release (rule 1) [build_requests, build_requests #489 request_reason]

The path through the harness

Fully recorded

2 chains · 10 drives · 18 stages · 6 rewinds

Chain 768 behind it · abandoned

Created 2026-10-28T10:36:00Z, upstream 5.8.0, build request 450 [chains, chains #768]

Abandoned: chain 768 abandoned: stale (it targets '5.8.0', the strategy '5.9.0') [watch_queue, watch_queue #10299 resolution]

DriveStartedMinutesBuild hostHow it stopped
6382026-10-28T10:36:13Z18.2build host 3 withhold-publish stage_failed at build_kit [drive_runs, drive_runs #638] rebuilt from a build line's log

Chain 860 release · ready_to_ship

Created 2026-11-07T12:13:11Z, upstream 5.9.0, build request 489 [chains, chains #860]

DriveStartedMinutesBuild hostHow it stopped
36642026-11-07T12:13:29Z45.9build host 3 withhold-publish stage_failed at package_archive; first failed check g8; 18 ticks [drive_runs, drive_runs #3664]
36832026-11-08T04:11:59Z12.9build host 3 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3683]
39452026-11-09T04:05:53Z12.7build host 3 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3945]
39712026-11-09T06:25:11Z26.9build host 3 withhold-publish ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #3971]
40892026-11-09T18:18:27Z6.3build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4089]
40982026-11-09T19:06:41Z5.7build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4098]
41062026-11-09T19:41:52Z5.7build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4106]
41112026-11-09T20:13:11Z5.9build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4111]
41132026-11-09T20:24:14Z—build host 3 publish-held not recorded [drive_runs, drive_runs #4113]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-07T12:13:39Z2026-11-07T12:13:40Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json eadf50f796f0…
acquire 2026-11-07T12:13:44Z2026-11-07T12:13:45Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree e505c19d5c9f…
license_file 3972dc9744f6…
custody_inputs 077269637473…
source_tree_hash b392efb4fac4…
source_file_manifest 4be9fa677ca0…
plan 2026-11-07T12:14:24Z2026-11-07T12:14:25Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report c685e959d59c…
input_pin_plan ecf9f882dd1d…
toolchain_lock 608e26d38425…
assemble_kit 2026-11-07T12:22:24Z2026-11-09T06:29:40Z2
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 6d59c9f180ce…
build_recipe 571180da9a4b…
system_pinning 28602e4092a8…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 8b3c1843dbfb…
verify_offline_sh 3e8184ea230c…
base_image_digests 7acd08a7c2d3…
dockerfile_offline 6d59c9f180ce…
first_build_digest faea0f02a4e2…
remediate 2026-11-07T12:23:01Z2026-11-09T06:29:44Z2
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 2d63b34968c0…
security_report 10d74aa6dfbe…
build_kit 2026-11-07T12:31:29Z2026-11-09T06:38:02Z2
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 7648b4f760b9…
locked_digest 8890e3b6e492…
freeze_manifest eb8ffa0acd83…
offline_rebuild_transcript be2b9c7f7777…
verdict 2026-11-07T12:33:04Z2026-11-09T06:39:34Z2
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 1eaa13687b9f…
publish_image 2026-11-07T12:34:02Z2026-11-09T06:40:27Z2
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme fe74aee4c892…
promotion_record 60367d97ceba…
boot_instance 2026-11-07T12:34:15Z2026-11-09T06:40:37Z4
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle b8e5799ec096…
sbom 2026-11-07T12:34:37Z2026-11-09T06:40:58Z2
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md d889864dd67d…
sbom_json 90fc19b912fe…
schema_discovery 2026-11-07T12:34:40Z2026-11-09T06:41:01Z2
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash e1893ac93128…
dependency_tree 1343eb96ed89…
table_classification e03c3d87a147…
admin_handbook 2026-11-07T12:38:21Z2026-11-09T06:41:13Z2
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map cdc3b6bb2c96…
admin_handbook 74a9279d5060…
db_handbook 2026-11-07T12:42:33Z2026-11-09T06:41:29Z2
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 07e329cff882…
seed_isolation 9ad80c9e4be8…
seed_data 2026-11-07T12:42:51Z2026-11-09T06:41:47Z2
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 97c26d9ebdae…
seed_cases_json 32e29224fd5a…
seed_validate 2026-11-07T12:42:54Z2026-11-09T06:41:50Z2
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract e001619383d1…
usecase_validate 2026-11-07T12:43:27Z2026-11-09T06:42:26Z2
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 42dbeb793221…
test_results 7212cf090a8e…
usecase_contract c21723c95428…
finalize_docs 2026-11-07T12:47:48Z2026-11-09T06:42:32Z2
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 5c0e849bff57…
release_notes b336c9a4a075…
api_integration_guide b8a852a585ed…
package_archive invalidated 2026-11-09T20:23:50Z 2026-11-07T12:59:19Z2026-11-09T20:19:06Z8
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 560db911ea8e…
checksums 726badd16832…
verify_md 1d73ee1fe08d…
rebuild_md ccd19fe95868…
manifest_txt 17cb2b285086…
actions_jsonl 6aab9a173c40…
provenance_md b6a5c10cafea…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 6d05fc55142c…

[stage_runs]

Rewinds

  • 2026-11-09T06:25:15Z: package_archive to assemble_kit on strategy_changed (strategy changed (f064868cfe0f -> 477a0f78085a)) [stage_events, stage_events #28101]
  • 2026-11-09T07:35:28Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28239]
  • 2026-11-09T18:53:51Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29603]
  • 2026-11-09T19:39:36Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29702]
  • 2026-11-09T20:11:53Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29847]
  • 2026-11-09T20:23:50Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29854]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T20:19:06Z.

64 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 011241 L-A183, L-A15
remediate2001 011448 L-A183, L-A15
admin_handbook18001 081950 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook21001 092394 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
finalize_docs21001 096078 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

5 rounds, 5 counted, $8.02 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T06:52:57Z 22614 findings to repackage [held_rounds, held_rounds #1598] $2.28 3 rounds, $40.00 0bdd52726a98…
22026-11-09T18:25:07Z 0415 findings to repackage [held_rounds, held_rounds #1659] $2.29 3 rounds, $40.00 387a977cacb7…
32026-11-09T19:12:51Z 0311 findings to repackage [held_rounds, held_rounds #1666] $1.29 3 rounds, $40.00 3af6dfc6499c…
42026-11-09T19:48:00Z 0142 findings to repackage [held_rounds, held_rounds #1668] $1.52 3 rounds, $40.00 029fc8394e22…
52026-11-09T20:19:30Z 000 clean to publish [held_rounds, held_rounds #1670] $0.63 3 rounds, $40.00 560db911ea8e…

Defects

Fully recorded
  • Ledger entries87 [defects, defects where product_slug=swag and this tag or chain]
  • Disclosed in the archive87 [docs/defects/defects.json, entries]

87 ledger entries: by severity critical 2, high 44, low 41; by status fixed-before-release 87.

DefectSeverityStatusFound byFixed in
RSD-swag-464321f066
Database handbook: The documented backup command never runs tar: arguments after the image go to the SWAG entrypoint, which ignores them and starts the gateway (exit 1 without URL). [defects, defects #201499]		criticalfixed-before-releaseheld review (review model)—
RSD-swag-999df19e56
Database handbook: The documented restore command starts SWAG (ignoring the tar arguments) instead of extracting the backup; the volume is not restored and the next start finds an empty /config and requests new… [defects, defects #201500]		criticalfixed-before-releaseheld review (review model)—
RSD-swag-a840fa5c27
Admin handbook: Every documented `docker exec swag certbot ...` command fails for the non-root user: certbot's default logs/work directories (/var/log/letsencrypt, /var/lib/letsencrypt) are not writable and the… [defects, defects #201501]		highfixed-before-releaseheld review (review model)—
RSD-swag-2b8ed6dd42
Database handbook: Every documented `docker exec swag certbot ...` command fails for the non-root user: certbot's default logs/work directories (/var/log/letsencrypt, /var/lib/letsencrypt) are not writable and the… [defects, defects #201502]		highfixed-before-releaseheld review (review model)—
RSD-swag-f38cc25e10
Database handbook: Every documented `docker exec swag certbot ...` command fails for the non-root user: certbot's default logs/work directories (/var/log/letsencrypt, /var/lib/letsencrypt) are not writable and the… [defects, defects #201503]		highfixed-before-releaseheld review (review model)—
RSD-swag-3c54ea4efd
Database handbook: Every documented `docker exec swag certbot ...` command fails for the non-root user: certbot's default logs/work directories (/var/log/letsencrypt, /var/lib/letsencrypt) are not writable and the… [defects, defects #201504]		highfixed-before-releaseheld review (review model)—
RSD-swag-bbb0f8b5d5
Database handbook: Every documented `docker exec swag certbot ...` command fails for the non-root user: certbot's default logs/work directories (/var/log/letsencrypt, /var/lib/letsencrypt) are not writable and the… [defects, defects #201505]		highfixed-before-releaseheld review (review model)—
RSD-swag-6f8591bb02
API guide: Every documented `docker exec swag certbot ...` command fails for the non-root user: certbot's default logs/work directories (/var/log/letsencrypt, /var/lib/letsencrypt) are not writable and the… [defects, defects #201506]		highfixed-before-releaseheld review (review model)—
RSD-swag-dd3b197401
API guide: Every documented `docker exec swag certbot ...` command fails for the non-root user: certbot's default logs/work directories (/var/log/letsencrypt, /var/lib/letsencrypt) are not writable and the… [defects, defects #201507]		highfixed-before-releaseheld review (review model)—
RSD-swag-b79d4979d5
Database handbook: /usr/bin/certbot does not exist. [defects, defects #201508]		highfixed-before-releaseheld review (review model)—
RSD-swag-c63c15f99e
Database handbook: Documented command fails with 'no such file or directory'. [defects, defects #201509]		highfixed-before-releaseheld review (review model)—
RSD-swag-fcca84a202
Admin handbook: The section says the existing certificate stays in use until a later renewal; the first restart actually deletes it and requests a new one at once (also on any change of URL, SUBDOMAINS,… [defects, defects #201510]		highfixed-before-releaseheld review (review model)—
RSD-swag-5d14e7e96d
Admin handbook: With the shipped configuration nothing listens on 8443/udp, so HTTP/3 is not served; it needs the `listen 8443 quic reuseport` lines in site-confs/default.conf uncommented and -p 443:8443/udp… [defects, defects #201511]		highfixed-before-releaseheld review (review model)—
RSD-swag-c6dffdb0ac
Admin handbook: With the shipped configuration nothing listens on 8443/udp, so HTTP/3 is not served; it needs the `listen 8443 quic reuseport` lines in site-confs/default.conf uncommented and -p 443:8443/udp… [defects, defects #201512]		highfixed-before-releaseheld review (review model)—
RSD-swag-ebcbd1f20d
Database handbook: With the shipped configuration nothing listens on 8443/udp, so HTTP/3 is not served; it needs the `listen 8443 quic reuseport` lines in site-confs/default.conf uncommented and -p 443:8443/udp… [defects, defects #201513]		highfixed-before-releaseheld review (review model)—
RSD-swag-0dc9aa7add
API guide: With the shipped configuration nothing listens on 8443/udp, so HTTP/3 is not served; it needs the `listen 8443 quic reuseport` lines in site-confs/default.conf uncommented and -p 443:8443/udp… [defects, defects #201514]		highfixed-before-releaseheld review (review model)—
RSD-swag-a6005a3c2e
API guide: With the shipped configuration nothing listens on 8443/udp, so HTTP/3 is not served; it needs the `listen 8443 quic reuseport` lines in site-confs/default.conf uncommented and -p 443:8443/udp… [defects, defects #201515]		highfixed-before-releaseheld review (review model)—
RSD-swag-c8bfda5838
Admin handbook: A newly copied proxy sample still has `listen 443`; the 80/443 -> 8080/8443 rewrite happens only at container start, so a reload alone leaves the app unreachable on the published port 8443 (nginx… [defects, defects #201516]		highfixed-before-releaseheld review (review model)—
RSD-swag-381cb682e0
API guide: A newly copied proxy sample still has `listen 443`; the 80/443 -> 8080/8443 rewrite happens only at container start, so a reload alone leaves the app unreachable on the published port 8443 (nginx… [defects, defects #201517]		highfixed-before-releaseheld review (review model)—
RSD-swag-86e6e5003f
API guide: A newly copied proxy sample still has `listen 443`; the 80/443 -> 8080/8443 rewrite happens only at container start, so a reload alone leaves the app unreachable on the published port 8443 (nginx… [defects, defects #201518]		highfixed-before-releaseheld review (review model)—
RSD-swag-3624408449
Database handbook: The documented way to supply DNS credentials (an --env-file of secrets) has no effect: certbot reads only /config/dns-conf/<provider>.ini, so the request fails with the template's placeholder values. [defects, defects #201519]		highfixed-before-releaseheld review (review model)—
RSD-swag-33ce1e0527
Database handbook: The example's `--env-file /path/to/dns-secrets.env` supplies nothing certbot uses; remove the line and put the credentials in /config/dns-conf/cloudflare.ini. [defects, defects #201520]		highfixed-before-releaseheld review (review model)—
RSD-swag-45f0b4ef8d
Database handbook: API keys in dns-conf files are not environment variables; DNS credentials cannot be passed that way. [defects, defects #201521]		highfixed-before-releaseheld review (review model)—
RSD-swag-73b24601a2
API guide: Same as the DB handbook: --env-file credentials are ignored. [defects, defects #201522]		highfixed-before-releaseheld review (review model)—
RSD-swag-5ab740d32b
API guide: The `--env-file dns-secrets.env` line supplies nothing the entrypoint or certbot reads. [defects, defects #201523]		highfixed-before-releaseheld review (review model)—
RSD-swag-c88ada9d5a
Database handbook: The volume-mount example sets no URL (and publishes no ports), so the container exits with 'URL is required' instead of running. [defects, defects #201524]		highfixed-before-releaseheld review (review model)—
RSD-swag-d54d00a8b9
Admin handbook: The log directory is /config/log, not /config/logs. [defects, defects #201525]		lowfixed-before-releaseheld review (review model)—
RSD-swag-402bca4674
Database handbook: No 03:00/15:00 UTC schedule exists. [defects, defects #201526]		lowfixed-before-releaseheld review (review model)—
RSD-swag-d68c056100
Database handbook: An existing certificate is reused at start; certbot is not run then. [defects, defects #201527]		lowfixed-before-releaseheld review (review model)—
RSD-swag-882ba3a5d2
Database handbook: Certificates do not expire when the container stops. [defects, defects #201528]		lowfixed-before-releaseheld review (review model)—
RSD-swag-7417d6dd4d
Database handbook: 8080 and 8443 are not low-numbered; the stated reason is wrong (the entrypoint moves 80/443 to 8080/8443 so that no low port is needed). [defects, defects #201529]		lowfixed-before-releaseheld review (review model)—
RSD-swag-745690f73a
Admin handbook: The ports are above 1023; the sentence gives an unrelated reason that depends on the runtime's sysctl. [defects, defects #201530]		lowfixed-before-releaseheld review (review model)—
RSD-swag-e2c6521613
API guide: The rewrite exists so that no port below 1024 is needed; the sentence says the opposite. [defects, defects #201531]		lowfixed-before-releaseheld review (review model)—
RSD-swag-93d4d23d5e
API guide: The entrypoint mounts nothing; it only references the file in certbot's cli.ini. [defects, defects #201532]		lowfixed-before-releaseheld review (review model)—
RSD-swag-9884ef7dfe
Admin handbook: Arguments are not passed on to any program. [defects, defects #201533]		lowfixed-before-releaseheld review (review model)—
RSD-swag-ab516e8403
API guide: Arguments are ignored by swag-entrypoint.sh. [defects, defects #201534]		lowfixed-before-releaseheld review (review model)—
RSD-swag-b6efcffb1d
Admin handbook: Words after the image name have no effect. [defects, defects #201535]		lowfixed-before-releaseheld review (review model)—
RSD-swag-5b20334e74
Admin handbook: The guide contradicts itself on when the credentials go in; on a new volume they can only be edited after the first start, which fails to obtain a certificate until the container is restarted. [defects, defects #201536]		lowfixed-before-releaseheld review (review model)—
RSD-swag-231b9ee237
API guide: X25519MLKEM768 is a curve/group, not a cipher. [defects, defects #201537]		lowfixed-before-releaseheld review (review model)—
RSD-swag-1b599fdd73
API guide: Curve, not cipher. [defects, defects #201538]		lowfixed-before-releaseheld review (review model)—
RSD-swag-6ec2840ec7
Admin handbook: Live on the release image: with the shipped default.conf, `curl -si http://127.0.0.1:8080/.well-known/acme-challenge/tok` (token file in /config/www) -> `HTTP/1.1 301 Moved Permanently`, `Location:… [defects, defects #221813]		highfixed-before-releaseheld review (review model)—
RSD-swag-c42af61dc7
API guide: Live on the release image: with the shipped default.conf, `curl -si http://127.0.0.1:8080/.well-known/acme-challenge/tok` (token file in /config/www) -> `HTTP/1.1 301 Moved Permanently`, `Location:… [defects, defects #221814]		highfixed-before-releaseheld review (review model)—
RSD-swag-330eda546d
Database handbook: Ran the documented line as written in a started container: `docker exec jt-ha860-s1 certbot --config-dir /config/etc/letsencrypt --logs-dir /config/log/letsencrypt --work-dir /tmp/letsencrypt` ->… [defects, defects #221815]		highfixed-before-releaseheld review (review model)—
RSD-swag-df5f02c155
Admin handbook: provenance/IMAGE_CONFIG.json has no Volumes entry, so /config is in the container's writable layer, which `docker restart` keeps (live: files and certbot state survived `docker restart jt-ha860-s2`). [defects, defects #221816]		lowfixed-before-releaseheld review (review model)—
RSD-swag-0ab1735cf7
Admin handbook: swag-entrypoint.sh: `if [ ! [defects, defects #221817]		lowfixed-before-releaseheld review (review model)—
RSD-swag-7309d98f33
Admin handbook: swag-entrypoint.sh: `if [ ! [defects, defects #221818]		lowfixed-before-releaseheld review (review model)—
RSD-swag-69212404ec
Database handbook: swag-entrypoint.sh: `if [ ! [defects, defects #221819]		lowfixed-before-releaseheld review (review model)—
RSD-swag-033b1bbbd0
API guide: swag-entrypoint.sh: `if [ ! [defects, defects #221820]		lowfixed-before-releaseheld review (review model)—
RSD-swag-1339e88957
Admin handbook: held docs/REBUILD.md (57 lines) lists requirements, the two scripts and the rebuild.json verifier; it names no upstream versions, Git commits or build arguments (docs/PROVENANCE.md and… [defects, defects #221821]		lowfixed-before-releaseheld review (review model)—
RSD-swag-7697651d7c
Admin handbook: Live: after uncommenting the quic lines and `nginx -s reload`, /proc/net/udp showed 8443/udp listening; /config/nginx/ssl.conf:32 is still `#add_header Alt-Svc 'h3=":443"' always;`, so no Alt-Svc… [defects, defects #221822]		lowfixed-before-releaseheld review (review model)—
RSD-swag-3782b093ef
Admin handbook: Live: `docker run -d -e VALIDATION=dns -e DNSPLUGIN=cloudflare -v jt-ha860-v3:/config ...` on a new volume: the first start creates /config/dns-conf/cloudflare.ini with placeholder values and… [defects, defects #221823]		lowfixed-before-releaseheld review (review model)—
RSD-swag-ff7cde8edd
Database handbook: Live: `docker run -d -e VALIDATION=dns -e DNSPLUGIN=cloudflare -v jt-ha860-v3:/config ...` on a new volume: the first start creates /config/dns-conf/cloudflare.ini with placeholder values and… [defects, defects #221824]		lowfixed-before-releaseheld review (review model)—
RSD-swag-9d618efa6e
API guide: Live: `docker run -d -e VALIDATION=dns -e DNSPLUGIN=cloudflare -v jt-ha860-v3:/config ...` on a new volume: the first start creates /config/dns-conf/cloudflare.ini with placeholder values and… [defects, defects #221825]		lowfixed-before-releaseheld review (review model)—
RSD-swag-307ce75906
Database handbook: swag-entrypoint.sh: `sed -i -E '/^\s*ssl_ecdh_curve/ s/X25519MLKEM768://'` removes the group name, not the line; live ssl.conf:14 is `ssl_ecdh_curve X25519:prime256v1:secp384r1;`. [defects, defects #221826]		lowfixed-before-releaseheld review (review model)—
RSD-swag-b0a159b566
Database handbook: swag-entrypoint.sh runs the ssl_ecdh_curve sed unconditionally; the OpenSSL is the image's, not 'your system's'. [defects, defects #221827]		lowfixed-before-releaseheld review (review model)—
RSD-swag-451b2236e0
Database handbook: swag-entrypoint.sh reads no positional arguments; admin handbook lines 259 and 797 say it ignores them. [defects, defects #221828]		lowfixed-before-releaseheld review (review model)—
RSD-swag-7a9d87a3ef
Database handbook: Live: `docker exec jt-ha860-s1 which certbot` -> /usr/local/bin/certbot; the next block runs `certbot --help`, not a full path. [defects, defects #221829]		lowfixed-before-releaseheld review (review model)—
RSD-swag-15fed87e7f
Database handbook: /config/dns-conf is a path inside the container's /config volume (entrypoint C=/config), not a host path. [defects, defects #221830]		lowfixed-before-releaseheld review (review model)—
RSD-swag-ec194b3fc1
Database handbook: Live on the release image (digest sha256:fae67e5…): `curl -si http://127.0.0.1:8080/.well-known/acme-challenge/tok` (token in /config/www) -> `HTTP/1.1 301 Moved Permanently`; `curl -sik… [defects, defects #223600]		highfixed-before-releaseheld review (review model)—
RSD-swag-e620ee3e51
Database handbook: Live on the release image (digest sha256:fae67e5…): `curl -si http://127.0.0.1:8080/.well-known/acme-challenge/tok` (token in /config/www) -> `HTTP/1.1 301 Moved Permanently`; `curl -sik… [defects, defects #223601]		highfixed-before-releaseheld review (review model)—
RSD-swag-79e94b9cdb
Database handbook: Ran the documented line as written in a started container (jt-ha860-w1): output 'You must agree in order to register with the ACME server. [defects, defects #223602]		highfixed-before-releaseheld review (review model)—
RSD-swag-5ad8c65500
Admin handbook: Live: /config/nginx/ssl.conf:32 is `#add_header Alt-Svc 'h3=":443"' always;`, the quic lines in default.conf:21,23 are commented; without the Alt-Svc line no browser is told about HTTP/3. [defects, defects #223603]		lowfixed-before-releaseheld review (review model)—
RSD-swag-6b4886543b
Admin handbook: Live: `docker run -d -e VALIDATION=dns -e DNSPLUGIN=cloudflare -v jt-ha860-w1v:/config ...` on a new volume: the first start creates /config/dns-conf/cloudflare.ini (and a template for every… [defects, defects #223604]		lowfixed-before-releaseheld review (review model)—
RSD-swag-7213b2a6fb
API guide: Live: `docker run -d -e VALIDATION=dns -e DNSPLUGIN=cloudflare -v jt-ha860-w1v:/config ...` on a new volume: the first start creates /config/dns-conf/cloudflare.ini (and a template for every… [defects, defects #223605]		lowfixed-before-releaseheld review (review model)—
RSD-swag-53c14edba2
API guide: Live: `docker run -d -e VALIDATION=dns -e DNSPLUGIN=cloudflare -v jt-ha860-w1v:/config ...` on a new volume: the first start creates /config/dns-conf/cloudflare.ini (and a template for every… [defects, defects #223606]		lowfixed-before-releaseheld review (review model)—
RSD-swag-b1e53bccde
Database handbook: swag-entrypoint.sh: a new named volume is empty before the first start, and the first start generates a self-signed cert.crt/cert.key in /config/keys when either is missing; nothing can be placed… [defects, defects #223607]		lowfixed-before-releaseheld review (review model)—
RSD-swag-5102f0ad29
Admin handbook: swag-entrypoint.sh: `if [ ! [defects, defects #223608]		lowfixed-before-releaseheld review (review model)—
RSD-swag-5490c291bf
Admin handbook: Live: the default site's `/` on 8080 returns a 3xx to https; it is HTTP requests that are redirected, there is no HTTPS request on 8080 (nginx listens for plain HTTP there). [defects, defects #223609]		lowfixed-before-releaseheld review (review model)—
RSD-swag-a4ab860b32
Database handbook: Live: the default site's `/` on 8080 returns a 3xx to https; it is HTTP requests that are redirected, there is no HTTPS request on 8080 (nginx listens for plain HTTP there). [defects, defects #223610]		lowfixed-before-releaseheld review (review model)—
RSD-swag-c351064c47
API guide: Live: the default site's `/` on 8080 returns a 3xx to https; it is HTTP requests that are redirected, there is no HTTPS request on 8080 (nginx listens for plain HTTP there). [defects, defects #223611]		lowfixed-before-releaseheld review (review model)—
RSD-swag-ad003c38d8
Admin handbook: certbot has no subcommand that manages DNS provider credentials; they are the .ini templates the entrypoint copies to /config/dns-conf (swag-entrypoint.sh `cp -n /defaults/dns-conf/*`) and the… [defects, defects #223612]		lowfixed-before-releaseheld review (review model)—
RSD-swag-d1b530c1a2
Admin handbook: Live on the release image (sha256:fae67e5…, container jt-ha860-r4b): `docker exec c cp sonarr.conf.sample sonarr2.conf` -> 'cp: cannot stat sonarr.conf.sample: No such file or directory' (samples… [defects, defects #224654]		highfixed-before-releaseheld review (review model)—
RSD-swag-ddb9754e0e
Admin handbook: Live on the release image (sha256:fae67e5…, container jt-ha860-r4b): `docker exec c cp sonarr.conf.sample sonarr2.conf` -> 'cp: cannot stat sonarr.conf.sample: No such file or directory' (samples… [defects, defects #224655]		highfixed-before-releaseheld review (review model)—
RSD-swag-b91ccd56ce
API guide: Live on the release image (sha256:fae67e5…, container jt-ha860-r4b): `docker exec c cp sonarr.conf.sample sonarr2.conf` -> 'cp: cannot stat sonarr.conf.sample: No such file or directory' (samples… [defects, defects #224656]		highfixed-before-releaseheld review (review model)—
RSD-swag-2fd851027a
API guide: Live on the release image (sha256:fae67e5…, container jt-ha860-r4b): `docker exec c cp sonarr.conf.sample sonarr2.conf` -> 'cp: cannot stat sonarr.conf.sample: No such file or directory' (samples… [defects, defects #224657]		highfixed-before-releaseheld review (review model)—
RSD-swag-6931b52e1e
API guide: Live on the release image (sha256:fae67e5…, container jt-ha860-r4b): `docker exec c cp sonarr.conf.sample sonarr2.conf` -> 'cp: cannot stat sonarr.conf.sample: No such file or directory' (samples… [defects, defects #224658]		highfixed-before-releaseheld review (review model)—
RSD-swag-61ee6c9110
API guide: Live on the release image (sha256:fae67e5…, container jt-ha860-r4b): `docker exec c cp sonarr.conf.sample sonarr2.conf` -> 'cp: cannot stat sonarr.conf.sample: No such file or directory' (samples… [defects, defects #224659]		highfixed-before-releaseheld review (review model)—
RSD-swag-324b2eba9b
Database handbook: Live on the release image (sha256:fae67e5…, container jt-ha860-r4b): `docker exec c cp sonarr.conf.sample sonarr2.conf` -> 'cp: cannot stat sonarr.conf.sample: No such file or directory' (samples… [defects, defects #224660]		highfixed-before-releaseheld review (review model)—
RSD-swag-60cee130a6
Database handbook: Live on the release image (sha256:fae67e5…, container jt-ha860-r4b): `docker exec c cp sonarr.conf.sample sonarr2.conf` -> 'cp: cannot stat sonarr.conf.sample: No such file or directory' (samples… [defects, defects #224661]		highfixed-before-releaseheld review (review model)—
RSD-swag-4644ebeec9
Database handbook: Live on the release image (sha256:fae67e5…, container jt-ha860-r4b): `docker exec c cp sonarr.conf.sample sonarr2.conf` -> 'cp: cannot stat sonarr.conf.sample: No such file or directory' (samples… [defects, defects #224662]		highfixed-before-releaseheld review (review model)—
RSD-swag-6c272319d4
Database handbook: Live on the release image (sha256:fae67e5…, container jt-ha860-r4b): `docker exec c cp sonarr.conf.sample sonarr2.conf` -> 'cp: cannot stat sonarr.conf.sample: No such file or directory' (samples… [defects, defects #224663]		highfixed-before-releaseheld review (review model)—
RSD-swag-af346945cb
Database handbook: Live on the release image (sha256:fae67e5…, container jt-ha860-r4b): `docker exec c cp sonarr.conf.sample sonarr2.conf` -> 'cp: cannot stat sonarr.conf.sample: No such file or directory' (samples… [defects, defects #224664]		highfixed-before-releaseheld review (review model)—
RSD-swag-06dec9bf35
Database handbook: Live on the release image (sha256:fae67e5…, container jt-ha860-r4b): `docker exec c cp sonarr.conf.sample sonarr2.conf` -> 'cp: cannot stat sonarr.conf.sample: No such file or directory' (samples… [defects, defects #224665]		highfixed-before-releaseheld review (review model)—
RSD-swag-3c2ba9ba5c
API guide: Live: after `cp radarr.subdomain.conf.sample radarr.subdomain.conf` and `nginx -s reload` (rc 0, `nginx -t` ok) the sample's `listen 443 ssl` stays 443: `curl -sk -H 'Host: radarr.example.com'… [defects, defects #224666]		highfixed-before-releaseheld review (review model)—
RSD-swag-ab2105aee4
API guide: Same live test as :878 (reload leaves the new sample on container port 443, not published); contradicts API_INTEGRATION_GUIDE.md:451 'a newly copied sample needs `docker restart swag`'. [defects, defects #224667]		highfixed-before-releaseheld review (review model)—
RSD-swag-44ffc34acf
Admin handbook: Live with --cap-add NET_ADMIN: `docker exec c fail2ban-client status` -> 'exec: "fail2ban-client": executable file not found in $PATH'; the python form prints 'Number of jail: 5'. [defects, defects #224668]		lowfixed-before-releaseheld review (review model)—
RSD-swag-9ceb747485
Database handbook: swag-entrypoint.sh: `VALIDATION="$(lower "${VALIDATION:-http}")"`; the dns branch is taken only `if [ "$VALIDATION" = dns ]`, DNSPLUGIN alone changes nothing. [defects, defects #224669]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:fae67e509ab4b905beeb49e4c409e63f7bbeb36c13ba149af182d47d6b8797c3 · published digest sha256:fae67e509ab4b905beeb49e4c409e63f7bbeb36c13ba149af182d47d6b8797c3 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 211) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T20:24:56Z · failing Docker Scout counts 110 packages with copyleft licences (GPL, LGPL, MPL), 109 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T20:24:25Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3769775893 · transparency-log entry · integrated 2026-11-09T20:30:02Z) [ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:33a4430a4a12b61cda3be79755a8ebffe77f317b1d56493834cf2a95430c0cce · state attached · log index 3769778356 · transparency-log entry
    • kind sbom · digest sha256:33a4430a4a12b61cda3be79755a8ebffe77f317b1d56493834cf2a95430c0cce · state attached · log index 3769780578 · transparency-log entry
    • kind vsa · digest sha256:33a4430a4a12b61cda3be79755a8ebffe77f317b1d56493834cf2a95430c0cce · state attached · log index 3769782722 · transparency-log entry
    • kind provenance · digest sha256:fae67e509ab4b905beeb49e4c409e63f7bbeb36c13ba149af182d47d6b8797c3 · state attached · log index 3769784767 · transparency-log entry
    • kind sbom · digest sha256:fae67e509ab4b905beeb49e4c409e63f7bbeb36c13ba149af182d47d6b8797c3 · state attached · log index 3769787412 · transparency-log entry
    • kind vsa · digest sha256:fae67e509ab4b905beeb49e4c409e63f7bbeb36c13ba149af182d47d6b8797c3 · state attached · log index 3769790040 · transparency-log entry
    (at 2026-11-09T20:30:03Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/swag/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T06:53:01Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:fae67e509ab4b905beeb49e4c409e63f7bbeb36c13ba149af182d47d6b8797c3 [clean-room rebuild ledger, runs[689]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-09T06:40:27Z [stage_runs, stage_runs chain 860 stage publish_image]
  • Archive manifests written2026-11-09T20:27:52Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 965 · probed 2026-11-09T18:24:25Z · source g8) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T20:31:18Z generated: by KitForge release/build_trail.py · generator commit 844b5eff31c4198de7a7e3f53d46cba192aeceb8
  • 2026-11-09T20:32:59Z publication: promoted at 2026-11-09T20:31:54Z · promoted digest sha256:33a4430a4a12b61cda3be79755a8ebffe77f317b1d56493834cf2a95430c0cce · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 437 · checklist status complete · checklist at 2026-11-09T20:32:59Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

26 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/swag/5.9.0-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/swag/5.9.0-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/swag/5.9.0-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-swag-5.9.0-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/swag/5.9.0-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/swag/5.9.0-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)489
chainssadb, ReadyStack's engine database (not published)768, 860
defectssadb, ReadyStack's engine database (not published)swag 5.9.0-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 768, chain 860
held_roundssadb, ReadyStack's engine database (not published)chain 860
lesson_recallssadb, ReadyStack's engine database (not published)chain 860
micro_step_runssadb, ReadyStack's engine database (not published)chain 860
release_imagessadb, ReadyStack's engine database (not published)swag 5.9.0-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 860
stage_runssadb, ReadyStack's engine database (not published)chain 860
watch_queuesadb, ReadyStack's engine database (not published)10299
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—