Syncthing v2.1.7-CE-ubuntu24.04-r3 build trail

How ReadyStack built readystack/syncthing:v2.1.7-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/syncthing:v2.1.7-CE-ubuntu24.04-r3
  • Index digestsha256:15114ee04698f46ee546f92ed69147b5166f422c718ed4ae6d3255b71024e96e
  • linux/amd64 digestsha256:5ba2ea4025426b62cf9cbc9927d49e0c29c1326b1680ab8205d809bdb4c62e03
  • ArchiveReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.tar.gz
  • Archive SHA-256 now6e32aee22a078c94050de88b4e4bef6a9e29b4413be467151c9a73d66cb17ce8
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-08T11:09:07Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.trail.json
ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.trail.jsonReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.trail.json.sigstoreReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.trail.mdSyncthing product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductSyncthing (syncthing) [MANIFEST.json]
  • Release tagv2.1.7-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Imagereadystack/syncthing:v2.1.7-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Image index digestsha256:15114ee04698f46ee546f92ed69147b5166f422c718ed4ae6d3255b71024e96e [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:5ba2ea4025426b62cf9cbc9927d49e0c29c1326b1680ab8205d809bdb4c62e03 [ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.tar.gz (bytes 500649508) [MANIFEST.json]
  • Archive sha256 at publish6e32aee22a078c94050de88b4e4bef6a9e29b4413be467151c9a73d66cb17ce8 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/syncthing/syncthing [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv2.1.7 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitd6d0181f7d466381c4b39ec8fd944c364f939b32 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash29190459a024f777fe48e236b121a638068ac992896a82baae8543a2d669912d (files 945) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:e226095e3f063d70a6357c9972eaffc2f64ebf8baa5970905bcd6305549a3571 [ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1792526078 (utc 2026-10-20T19:54:38Z) [ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.rebuild.json, engine]
  • Engine commit(s)
    • commit d7ccff446f52731f23cbe85c44adc1730f1c2bef · dirty yes · first drive 3479
    • commit 21a662bdd6974e1e462fe91e1415f9f9d120bf2d · dirty yes · first drive 3537
    • commit 0b84905088b3228fdf50e0647d1f5a7d7d60df02 · dirty yes · first drive 3602
    • commit 120579f1916582dbd0a42b015d97b8dd63740a06 · dirty yes · first drive 3631
    • commit 89d863ac88b135c8b01feee55143a4eb91c606e1 · dirty yes · first drive 3649
    • commit b24ebbcea6866f4b5fc11eacaac6d5e22dcdcfb6 · dirty yes · first drive 3681
    • commit 92dcb99fd5af2466b8a040e9b12f1cd9afdd07b3 · dirty yes · first drive 3686
    • commit 2d1ae189f0cfc9706683f33be126c89e775e7d32 · dirty yes · first drive 3709
    • commit 652df6e0e6aa50b44c0f12948b3d5baab047fc1f · dirty yes · first drive 3747
    • commit 1b6b66826eaa0cb5f2f833b5a6a84e7c72e9e068 · dirty yes · first drive 3754
    • commit 3d32cc1dd39bba72d2a0135dfa6216cfa284f64a · dirty yes · first drive 3771
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain744 (created 2026-10-28T02:01:45Z · trigger customer_request · upstream version v2.1.7) [chains, chains #744]
  • Requestbuild request #441 (rebuild) (requested at 2026-10-28T01:54:54Z · requested by kitforge-agent · version v2.1.7) [build_requests, build_requests #441]
  • Reasonrevision v2.1.7-CE-ubuntu24.04-r3: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #441 request_reason]
  • Supersedesreadystack/syncthing:v2.1.7-CE-ubuntu24.04-r2 (chain 689) [chains, chains #689]

The path through the harness

Fully recorded

1 chain · 12 drives · 18 stages · 4 rewinds

Chain 744 release · ready_to_ship

Created 2026-10-28T02:01:45Z, upstream v2.1.7, build request 441 [chains, chains #744]

DriveStartedMinutesBuild hostHow it stopped
6292026-10-28T02:02:08Z29.9build host 3 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #629] rebuilt from a build line's log
34792026-11-03T05:50:46Z0.6build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3479]
35372026-11-07T01:50:32Z7.2build host 3 withhold-publish stage_failed at verdict; first failed check scout_verdict:release_check_passed; 4 ticks [drive_runs, drive_runs #3537]
36022026-11-07T07:08:19Z14.3build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 15 ticks [drive_runs, drive_runs #3602]
36312026-11-07T09:27:10Z1.1build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3631]
36492026-11-07T11:09:18Z1.1build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3649]
36812026-11-08T04:07:13Z1.1build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3681]
36862026-11-08T04:26:39Z0.8build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3686]
37092026-11-08T06:00:00Z5.1build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3709]
37472026-11-08T09:28:17Z3.9build host 3 withhold-publish infra_hub_rate_limit at package_archive; 1 tick [drive_runs, drive_runs #3747]
37542026-11-08T10:07:25Z2.9build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3754]
37712026-11-08T11:04:32Z—build host 3 publish-held not recorded [drive_runs, drive_runs #3771]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-28T02:02:14Z2026-10-28T02:02:15Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-28T02:02:19Z2026-10-28T02:02:19Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-28T02:02:59Z2026-10-28T02:03:00Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-28T02:05:53Z2026-11-07T07:11:30Z3
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 46c6891b33f6…
build_recipe eefb66daf971…
system_pinning 3342957f888a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health dc8e6850842f…
verify_offline_sh 3e8184ea230c…
base_image_digests 477734fb9ed3…
dockerfile_offline 46c6891b33f6…
first_build_digest cdadf0c255e9…
remediate 2026-10-28T02:06:43Z2026-11-07T07:11:34Z3
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 1d4bba57e874…
security_report 0a409c260b1f…
build_kit 2026-10-28T02:09:52Z2026-11-07T07:14:45Z3
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 08656d5ee94e…
locked_digest b1acec4628b2…
freeze_manifest 07626873549d…
offline_rebuild_transcript 0725b5043d79…
verdict 2026-10-28T02:10:22Z2026-11-07T07:15:14Z3
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 6a93bfdae7a9…
publish_image 2026-10-28T02:11:00Z2026-11-07T07:15:43Z2
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 49d195aac6a6…
promotion_record 9cb70ac83b9f…
boot_instance 2026-10-28T02:11:07Z2026-11-07T07:15:55Z4
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 26dd0c294f8d…
sbom 2026-10-28T02:11:16Z2026-11-07T07:16:04Z2
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md defb410546ca…
sbom_json b9b8331843fa…
schema_discovery 2026-10-28T02:11:23Z2026-11-07T07:16:11Z2
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash e3959782afd8…
dependency_tree 76d7dea45645…
table_classification 15899cc95d94…
admin_handbook 2026-10-28T02:20:00Z2026-11-07T07:16:20Z2
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 12b7eba0144c…
admin_handbook b35832404cf3…
db_handbook 2026-10-28T02:25:15Z2026-11-07T07:16:32Z2
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook d865146a5b39…
seed_isolation be452e759117…
seed_data 2026-10-28T02:25:50Z2026-11-07T07:17:08Z2
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql f5e08f8bd55a…
seed_cases_json e3c931bc77ec…
seed_validate 2026-10-28T02:25:53Z2026-11-07T07:17:12Z2
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 4cc7e21c4f02…
usecase_validate 2026-10-28T02:27:06Z2026-11-07T07:18:20Z2
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests d297059a3315…
test_results 670e0d1d541e…
usecase_contract 675e77513154…
finalize_docs 2026-10-28T02:27:12Z2026-11-07T07:18:28Z2
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 385f7960cffd…
release_notes 5c291f9b06cf…
api_integration_guide 1b7cc1e19f3e…
package_archive invalidated 2026-11-08T11:04:00Z 2026-10-28T02:32:03Z2026-11-08T10:10:17Z9
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 1b0f1610a3b7…
checksums 7fe51f86f223…
verify_md 1c467cbfab80…
rebuild_md 746e72c4e6db…
manifest_txt 563dd8f5d36e…
actions_jsonl 51e772c5aba2…
provenance_md 59400edd8dba…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 4075dc11c757…

[stage_runs]

Rewinds

  • 2026-11-07T01:50:36Z: package_archive to assemble_kit on strategy_changed (kit pins stale: the staged kit leaves 2 fetch(es) unpinned that the kit rendered now pins (Dockerfile.vendor: FROM without a digest (golang:1.26.10-bookworm); Dockerfile.vendor: a `git clone` no commit check pins (https://github.com/syncthing/syncthing)) (c446d8481cfe -> c446d8481cfe)) [stage_events, stage_events #23082]
  • 2026-11-07T07:08:24Z: verdict to assemble_kit on strategy_changed (strategy changed (c446d8481cfe -> d51da41dbfdc)) [stage_events, stage_events #24162]
  • 2026-11-08T06:54:51Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #25342]
  • 2026-11-08T11:04:00Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #25935]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-08T10:10:17Z.

137 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook884703 9187244 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook422003 143294 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate3001 02883 L-A59

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $2.83 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-08T06:05:40Z 229 findings to repackage [held_rounds, held_rounds #1478] $1.47 3 rounds, $40.00 6381317c5d19…
22026-11-08T10:10:51Z 005 clean to publish [held_rounds, held_rounds #1497] $1.36 3 rounds, $40.00 1b0f1610a3b7…

Defects

Fully recorded
  • Ledger entries18 [defects, defects where product_slug=syncthing and this tag or chain]
  • Disclosed in the archive18 [docs/defects/defects.json, entries]

18 ledger entries: by severity low 15, critical 1, high 2; by status open 1, fixed-before-release 17.

DefectSeverityStatusFound byFixed in
RSD-syncthing-e69fd54c95
Release notes: The image's EXPOSE metadata lists 21027/tcp and no UDP port, so `docker run -P` publishes neither 22000/udp (QUIC) nor 21027/udp (local discovery). [defects, defects #170512]		lowopenheld review (review model)—
RSD-syncthing-59b5d886b0
Database handbook: Troubleshooting 'Backup and Restore' backup command runs `tar` without --entrypoint, so the image's entrypoint passes it to syncthing and no backup is made; it also bind-mounts the host cwd as uid… [defects, defects #170788]		criticalfixed-before-releaseheld review (review model)—
RSD-syncthing-26e51ae6dd
Database handbook: False: the entrypoint writes initial_gui_password only when SYNCTHING_GUI_PASSWORD is empty; also contradicts the Admin Handbook 'Initial password file not found' and the Operating facts. [defects, defects #170789]		highfixed-before-releaseheld review (review model)—
RSD-syncthing-9b8535f175
Database handbook: The extract/cd commands name an archive and directory that do not exist; the shipped kit is ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.tar.gz and extracts to v2.1.7-CE-ubuntu24.04-r3. [defects, defects #170790]		highfixed-before-releaseheld review (review model)—
RSD-syncthing-8127e21778
Database handbook: The archive has no vendor/ directory (it is vendored/ and apt/); also 'Image contents' (lines 745-746) lists the vendored module tree and gui.files.go as contents of the rebuilt image, which is a… [defects, defects #170791]		lowfixed-before-releaseheld review (review model)—
RSD-syncthing-da7a83d4d7
Admin handbook: Wrong/contradictory: the port answers both HTTP and HTTPS from outside the container; DB handbook line 913 tells customers to use https://. [defects, defects #170792]		lowfixed-before-releaseheld review (review model)—
RSD-syncthing-cd737584fe
Admin handbook: Global discovery does not use 21027/udp. [defects, defects #170793]		lowfixed-before-releaseheld review (review model)—
RSD-syncthing-ae9b11c45a
Admin handbook: 22000/udp is the QUIC sync listener, not discovery (discovery is 21027/udp); contradicts Operating facts 'Ports'. [defects, defects #170794]		lowfixed-before-releaseheld review (review model)—
RSD-syncthing-743bf1f259
Admin handbook: Contradicts Operating facts: 'Peers connect to 22000; 8384 never needs to be reachable by peers.' [defects, defects #170795]		lowfixed-before-releaseheld review (review model)—
RSD-syncthing-9ba0f7776f
Admin handbook: 'Container Will Not Start' names a cause that does not stop the container and omits the one that does. [defects, defects #170796]		lowfixed-before-releaseheld review (review model)—
RSD-syncthing-27d7671d7d
Database handbook: Contradicts the same handbook (line 439, 515): the GUI uses the separate https-cert.pem/https-key.pem. [defects, defects #170797]		lowfixed-before-releaseheld review (review model)—
RSD-syncthing-be92faa4d5
Database handbook: There is no 'Deployment' section in the DB handbook; the run command is in Quick Start / Operating facts. [defects, defects #170798]		lowfixed-before-releaseheld review (review model)—
RSD-syncthing-76cf3a0fb9
Database handbook: The documented run command (-p 8384:8384) already exposes the GUI/API on every host interface. [defects, defects #170799]		lowfixed-before-releaseheld review (review model)—
RSD-syncthing-c8fa46d078
Database handbook: Dockerfile.offline.pinned:38-41 (FROM scratch; COPY --from=rootfs /rootfs/), :22-24 copy only /usr/bin/syncthing, rs-probe and the entrypoint; RELEASE_NOTES.md 'slim base' paragraph; the vendored… [defects, defects #174409]		lowfixed-before-releaseheld review (review model)—
RSD-syncthing-1ba2572254
Database handbook: gui.files.go is a Go source file in the archive (tar tzf shows it); the image is FROM scratch with only the built binary (Dockerfile.offline.pinned:22,38-40). [defects, defects #174410]		lowfixed-before-releaseheld review (review model)—
RSD-syncthing-d2b24137d7
Database handbook: provenance/IMAGE_CONFIG.json ExposedPorts = 21027/tcp, 22000/tcp, 8384/tcp; the same handbook (Image Details, Operating facts Ports) says EXPOSE lists no UDP port, so 'exposes ... [defects, defects #174411]		lowfixed-before-releaseheld review (review model)—
RSD-syncthing-ca33902e9d
Admin handbook: Live: POST /rest/system/shutdown -> PID 1 exits and `docker ps -a` shows 'Exited (0)', not unhealthy; PID 1 is the monitor, so there is no running container whose main process has exited. [defects, defects #174412]		lowfixed-before-releaseheld review (review model)—
RSD-syncthing-773b5ac9e8
Database handbook: readystack-entrypoint.sh last line `exec syncthing "$@"`; live /proc listing: PID 1 `syncthing`, PID 31 `/usr/bin/syncthing`; the script is not the monitor. [defects, defects #174413]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:5ba2ea4025426b62cf9cbc9927d49e0c29c1326b1680ab8205d809bdb4c62e03 · published digest sha256:5ba2ea4025426b62cf9cbc9927d49e0c29c1326b1680ab8205d809bdb4c62e03 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 92) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T11:04:54Z · failing Docker Scout counts 15 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T11:04:44Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3754219880 · transparency-log entry · integrated 2026-11-08T11:07:59Z) [ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:15114ee04698f46ee546f92ed69147b5166f422c718ed4ae6d3255b71024e96e · state attached · log index 3754221447 · transparency-log entry
    • kind sbom · digest sha256:15114ee04698f46ee546f92ed69147b5166f422c718ed4ae6d3255b71024e96e · state attached · log index 3754222311 · transparency-log entry
    • kind vsa · digest sha256:15114ee04698f46ee546f92ed69147b5166f422c718ed4ae6d3255b71024e96e · state attached · log index 3754223304 · transparency-log entry
    • kind provenance · digest sha256:5ba2ea4025426b62cf9cbc9927d49e0c29c1326b1680ab8205d809bdb4c62e03 · state attached · log index 3754224177 · transparency-log entry
    • kind sbom · digest sha256:5ba2ea4025426b62cf9cbc9927d49e0c29c1326b1680ab8205d809bdb4c62e03 · state attached · log index 3754224783 · transparency-log entry
    • kind vsa · digest sha256:5ba2ea4025426b62cf9cbc9927d49e0c29c1326b1680ab8205d809bdb4c62e03 · state attached · log index 3754225296 · transparency-log entry
    (at 2026-11-08T11:07:59Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/syncthing/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-08T06:05:46Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:5ba2ea4025426b62cf9cbc9927d49e0c29c1326b1680ab8205d809bdb4c62e03 [clean-room rebuild ledger, runs[630]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-07T07:15:43Z [stage_runs, stage_runs chain 744 stage publish_image]
  • Archive manifests written2026-11-08T11:06:21Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 71 · probed 2026-11-07T07:12:57Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-08T11:09:07Z generated: by KitForge release/build_trail.py · generator commit 3d32cc1dd39bba72d2a0135dfa6216cfa284f64a
  • 2026-11-08T11:10:20Z publication: promoted at 2026-11-08T11:09:37Z · promoted digest sha256:15114ee04698f46ee546f92ed69147b5166f422c718ed4ae6d3255b71024e96e · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 362 · checklist status complete · checklist at 2026-11-08T11:10:20Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/syncthing/v2.1.7-CE-ubuntu24.04-r3/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/syncthing/v2.1.7-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.rebuild.jsonbeside the archive (prodasset /data/production/syncthing/v2.1.7-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-syncthing-v2.1.7-CE-ubuntu24.04-r3.rebuild.json.sigstorebeside the archive (prodasset /data/production/syncthing/v2.1.7-CE-ubuntu24.04-r3/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/syncthing/v2.1.7-CE-ubuntu24.04-r3/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)441
chainssadb, ReadyStack's engine database (not published)744
defectssadb, ReadyStack's engine database (not published)syncthing v2.1.7-CE-ubuntu24.04-r3
drive_runssadb, ReadyStack's engine database (not published)chain 744
held_roundssadb, ReadyStack's engine database (not published)chain 744
lesson_recallssadb, ReadyStack's engine database (not published)chain 744
micro_step_runssadb, ReadyStack's engine database (not published)chain 744
release_imagessadb, ReadyStack's engine database (not published)syncthing v2.1.7-CE-ubuntu24.04-r3
stage_eventssadb, ReadyStack's engine database (not published)chain 744
stage_runssadb, ReadyStack's engine database (not published)chain 744
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—