Syncthing v2.1.7-CE-ubuntu24.04-r2 build trail

• ProductSyncthing (syncthing) [MANIFEST.json]
• Release tagv2.1.7-CE-ubuntu24.04-r2 [MANIFEST.json]
• Imagereadystack/syncthing:v2.1.7-CE-ubuntu24.04-r2 [MANIFEST.json]
• Image index digestsha256:4ff206218425e119d5b898c6ad4924795869272d6b883f61afe2144fc1f6f0c4 [docs/provenance/LOCKED_DIGEST.txt]
• linux/amd64 image digestsha256:41018e6c100e3c14eb410fae22c814174709c3846023858d7368ea50c3fae352 [ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
• ArchiveReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r2.tar.gz (bytes 488170252) [MANIFEST.json]
• Archive sha256 at publishb3cad9e4a463e6ca640a21dd9f1fc00d9b831a26db4c6aa6608ef26bed80ddd0 [MANIFEST.json, repack_history[0].previous_tarball_sha256]
• Archive sha256 now9a3120e6bd215453297dc3427a728d85bc6e5bb1242ff6e8177c8c9a7410cbbf [MANIFEST.json, tarball_sha256]
• Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
• Repack history
  • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 b3cad9e4a463e6ca640a21dd9f1fc00d9b831a26db4c6aa6608ef26bed80ddd0 · sha256 9a3120e6bd215453297dc3427a728d85bc6e5bb1242ff6e8177c8c9a7410cbbf · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
  [MANIFEST.json, repack_history]
• Upstream repositoryhttps://github.com/syncthing/syncthing [docs/provenance/SOURCE_TREE_HASH.json]
• Upstream refv2.1.7 [docs/provenance/SOURCE_TREE_HASH.json]
• Upstream commitd6d0181f7d466381c4b39ec8fd944c364f939b32 [docs/provenance/SOURCE_TREE_HASH.json]
• Source tree hash29190459a024f777fe48e236b121a638068ac992896a82baae8543a2d669912d (files 945) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
• Kit tree hashsha256:f8201caa7143ddd264cc3eaa8aed76db35d8c017b8f40452705e7546d670f830 [ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
• SOURCE_DATE_EPOCH1792526078 (utc 2026-10-20T19:54:38Z) [ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
• Base images
  • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
  • ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
  [ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r2.rebuild.json, bases]
• BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r2.rebuild.json, engine]

• Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

• Chain689 (created 2026-10-27T11:03:25Z · trigger customer_request · upstream version v2.1.7) [chains, chains #689]
• Requestbuild request #366 (rebuild) (requested at 2026-10-27T02:37:04Z · requested by kitforge-agent · version v2.1.7) [build_requests, build_requests #366]
• Reasonrevision v2.1.7-CE-ubuntu24.04-r2: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #366 request_reason]
• Supersedesreadystack/syncthing:v2.1.7-CE-ubuntu24.04-r1 (chain 606) [chains, chains #606]

1 chain · 2 drives · 18 stages · 1 rewind

Stages, in order

[stage_runs]

Rewinds

• 2026-10-27T11:28:54Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #505]

• Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
• Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Role: writer model. Calls up to 2026-10-27T11:34:47Z.

8 calls over 3 stages

[micro_step_runs]

• Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
• Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
• Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Role: review model.

1 round, 1 counted

• Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
• Not recorded: the round cap in force at each round (the state files did not keep it)

• Ledger entries1 [defects, defects where product_slug=syncthing and this tag or chain]
• Disclosed in the archive1 [docs/defects/defects.json, entries]

1 ledger entry: by severity low 1; by status open 1.

• Reproduced before publishingyes (rebuilt digest sha256:41018e6c100e3c14eb410fae22c814174709c3846023858d7368ea50c3fae352 · published digest sha256:41018e6c100e3c14eb410fae22c814174709c3846023858d7368ea50c3fae352 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 84) [docs/provenance/REPRO_VERIFICATION.json, verified]
• Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 689 package_archive gate_result.g8.result]
• Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-27T11:29:36Z · failing Docker Scout counts 100 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
• First own scan of the releaseA (at 2026-10-27T11:34:59Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-27T06:30:41Z) [image_scans, image_scans #1328]
• Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-27T11:29:26Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
• Image signature transparency-log entries
  • log index 3514366026 · transparency-log entry
  • log index 3514368422 · transparency-log entry
  [docs/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
• rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3630170260 · transparency-log entry · integrated 2026-11-01T12:49:27Z) [ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]

Offline clean-room rebuilds

• 2026-10-27T11:20:09Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
  rebuilt sha256:41018e6c100e3c14eb410fae22c814174709c3846023858d7368ea50c3fae352 [clean-room rebuild ledger, runs[450]]

• Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
• Not recorded: the attestations' transparency-log entries (no attestation record in the release's workspace)
• Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

• Image pushed (internal tag), publish_image passed2026-10-27T11:12:06Z [stage_runs, stage_runs chain 689 stage publish_image]
• Archive manifests written2026-10-27T11:31:03Z [PUBLISH_MANIFEST.json, published_at]
• Archive cut over on prodasset, package_archive passed2026-10-27T11:34:47Z [stage_runs, stage_runs chain 689 stage package_archive]
• Cut-over markerpresent (chain 689) [.cutover.json]

• Not recorded: when the release tag was promoted (the promotion record in the archive was written before the promotion, and the release's workspace no longer holds this chain)
• Not recorded: the site event's time (the release checklist is in the chain's workspace, which no longer holds this chain)

• Packages in the image182 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
• x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 747 · probed 2026-11-02T17:12:05Z · source backfill) [release_images, isa_level_hard]

• 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records