Uptime Kuma 2.5.9-CE-ubuntu24.04-r1 build trail
How ReadyStack built readystack/uptimekuma:2.5.9-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/uptimekuma:2.5.9-CE-ubuntu24.04-r1 - Index digestsha256:6700bb7bda011d5d19d85db4cd8ddf07e97e882a161dd3a02be26b5ef66dc0b1
- linux/amd64 digestsha256:856d6d84c8b178ae180e44f9d5d514626382f461eec828cef665fc4fb9dd86e8
- Archive
ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.tar.gz - Archive SHA-256 now978cf8ee30252a99adc6d7addcba3bd844b092ec516473b79ffd47e824d9580a
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-08T14:56:53Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductUptime Kuma (uptimekuma) [MANIFEST.json]
- Release tag2.5.9-CE-ubuntu24.04-r1 [MANIFEST.json]
- Imagereadystack/uptimekuma:2.5.9-CE-ubuntu24.04-r1 [MANIFEST.json]
- Image index digestsha256:6700bb7bda011d5d19d85db4cd8ddf07e97e882a161dd3a02be26b5ef66dc0b1 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:856d6d84c8b178ae180e44f9d5d514626382f461eec828cef665fc4fb9dd86e8 [ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.tar.gz (bytes 260035458) [MANIFEST.json]
- Archive sha256 at publish978cf8ee30252a99adc6d7addcba3bd844b092ec516473b79ffd47e824d9580a [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/louislam/uptime-kuma [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream ref2.5.9 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commitdf601c58d9205562f34cfe5ef35264b341019d19 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash33c2570e852d993bee57d72a24ba0d0b325adba59a8500d8924ae4e768b76408 (files 800) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:d2a534ed5f1b89f82d1e00cb7a2fbc0ae2f0e7222b1cecfdb2806b1681640820 [ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1793461969 (utc 2026-10-31T15:52:49Z) [ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
- Base images
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.rebuild.json, engine]
- Engine commit(s)
- commit 89d863ac88b135c8b01feee55143a4eb91c606e1 · dirty yes · first drive 3647
- commit 6904f162d72c63c98e5dc2a9a05bffd35b1f838e · dirty yes · first drive 3676
- commit 92dcb99fd5af2466b8a040e9b12f1cd9afdd07b3 · dirty yes · first drive 3687
- commit 5caa66bc9ce095394303246790aaa92ec96b2e89 · dirty yes · first drive 3697
- commit 1b8dcc94a7e7ad41bd084637f76ac0c5650ae5e0 · dirty yes · first drive 3700
- commit e53659b3a6a4c81fa7e71e0c7fb79fae091436b9 · dirty yes · first drive 3702
- commit c4ae03ac898ae3caa1f2e0aef044119311e344df · dirty yes · first drive 3707
- commit 25f176d1e4c68bf0eaed5fe5103af4b3ad61b7fd · dirty yes · first drive 3766
- commit 3d32cc1dd39bba72d2a0135dfa6216cfa284f64a · dirty yes · first drive 3773
- commit f43702b5e009964169aee805cbca1db98779c212 · dirty yes · first drive 3814
- commit 678cbcb0bbd61a6d885eab3d9776ddcdf7ce640d · dirty yes · first drive 3821
Why this release exists
Fully recorded- Chain857 (created 2026-11-07T11:07:09Z · trigger customer_request · upstream version 2.5.9) [chains, chains #857]
- Requestbuild request #532 (rebuild) (requested at 2026-11-07T02:03:22Z · requested by kitforge-agent · version 2.5.9) [build_requests, build_requests #532]
- Reasonretarget to 2.5.9: a newer upstream release (rule 1) [build_requests, build_requests #532 request_reason]
- Supersedesreadystack/uptimekuma:2.5.8-CE-ubuntu24.04-r3 (chain 803) [chains, chains #803]
The path through the harness
Fully recorded1 chain · 11 drives · 18 stages · 2 rewinds
Chain 857 release · ready_to_ship
Created 2026-11-07T11:07:09Z, upstream 2.5.9, build request 532 [chains, chains #857]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 3647 | 2026-11-07T11:07:33Z | 1.5 | build host 4 withhold-publish | stage_failed at assemble_kit; first failed check exists:first_build_digest; 4 ticks [drive_runs, drive_runs #3647] |
| 3676 | 2026-11-08T03:47:10Z | 1.2 | build host 4 withhold-publish | stage_failed at assemble_kit; first failed check exists:first_build_digest; 1 tick [drive_runs, drive_runs #3676] |
| 3687 | 2026-11-08T04:27:42Z | 1.1 | build host 4 withhold-publish | stage_failed at assemble_kit; first failed check exists:first_build_digest; 1 tick [drive_runs, drive_runs #3687] |
| 3697 | 2026-11-08T04:54:36Z | 0.9 | build host 4 withhold-publish | stage_failed at assemble_kit; first failed check exists:first_build_digest; 1 tick [drive_runs, drive_runs #3697] |
| 3700 | 2026-11-08T05:05:41Z | 1 | build host 4 withhold-publish | repeat_gate_failure at assemble_kit; first failed check exists:first_build_digest; 1 tick [drive_runs, drive_runs #3700] |
| 3702 | 2026-11-08T05:27:20Z | 0.9 | build host 4 withhold-publish | repeat_gate_failure at assemble_kit; first failed check exists:first_build_digest; 1 tick [drive_runs, drive_runs #3702] |
| 3707 | 2026-11-08T05:44:37Z | 0.9 | build host 4 withhold-publish | repeat_gate_failure at assemble_kit; first failed check exists:first_build_digest; 1 tick [drive_runs, drive_runs #3707] |
| 3766 | 2026-11-08T10:29:45Z | 0.9 | build host 4 withhold-publish | repeat_gate_failure at assemble_kit; first failed check exists:first_build_digest; 1 tick [drive_runs, drive_runs #3766] |
| 3773 | 2026-11-08T11:09:33Z | 14.5 | build host 4 withhold-publish | stage_failed at verdict; first failed check scout_verdict:release_check_passed; 4 ticks [drive_runs, drive_runs #3773] |
| 3814 | 2026-11-08T13:37:47Z | 16.2 | build host 4 withhold-publish | ready_to_ship at package_archive; 16 ticks [drive_runs, drive_runs #3814] |
| 3821 | 2026-11-08T14:51:13Z | — | build host 4 publish-held | not recorded [drive_runs, drive_runs #3821] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-07T11:07:43Z | 2026-11-07T11:07:44Z | 1 | 4
|
order_json 70fae7b5fd08… |
acquire |
2026-11-07T11:07:48Z | 2026-11-07T11:07:49Z | 1 | 12
|
source_tree e44a111d2a1f…license_file a0e4fe6bed45…custody_inputs 5f3aaa273098…source_tree_hash 9bc4f4246505…source_file_manifest 60f4c1f88e04… |
plan |
2026-11-07T11:08:19Z | 2026-11-07T11:08:20Z | 1 | 10
|
recon_report ef5503ecde6a…input_pin_plan 81c1b82589cf…toolchain_lock 886b5fd7262e… |
assemble_kit |
2026-11-07T11:09:03Z | 2026-11-08T13:41:44Z | 10 | 27
|
dockerfile 3c1872062136…build_recipe c7a24bc5214d…system_pinning f5414a420fd6…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health 6e35ee70b79f…verify_offline_sh 3e8184ea230c…base_image_digests b9e62506c535…dockerfile_offline 3c1872062136…first_build_digest 3b9655e6799e… |
remediate |
2026-11-08T11:18:08Z | 2026-11-08T13:41:48Z | 2 | 8
|
vendored_apt e3b0c44298fc…remediation_log d6e840ee5e91…security_report 6a774168a6ea… |
build_kit |
2026-11-08T11:21:46Z | 2026-11-08T13:45:01Z | 2 | 9
|
cosign_stamp edb551b8cfe2…locked_digest d930d94f25ca…freeze_manifest b9f102d6f9a0…offline_rebuild_transcript 41cd6dc43a3b… |
verdict |
2026-11-08T11:24:05Z | 2026-11-08T13:46:23Z | 2 | 8
|
scout_verdict f29f1196a51b… |
publish_image |
2026-11-08T13:47:10Z | 2026-11-08T13:47:11Z | 1 | 7
|
hub_readme 60aa9fce94e6…promotion_record 2889b8339b67… |
boot_instance |
2026-11-08T13:47:22Z | 2026-11-08T13:47:26Z | 2 | 3
|
instance_handle b4dd8bf85bcb… |
sbom |
2026-11-08T13:47:46Z | 2026-11-08T13:47:47Z | 1 | 5
|
sbom_md 8994cc36d527…sbom_json a37e4147df72… |
schema_discovery |
2026-11-08T13:47:49Z | 2026-11-08T13:47:50Z | 1 | 7
|
schema_hash a7c5d2da34a7…dependency_tree e7dada9bd7f4…table_classification 483757b66bb7… |
admin_handbook |
2026-11-08T13:47:56Z | 2026-11-08T13:47:57Z | 1 | 7
|
api_map 2d297bab4d83…admin_handbook 70a3bf1070c3… |
db_handbook |
2026-11-08T13:48:05Z | 2026-11-08T13:48:06Z | 1 | 8
|
db_handbook bd492999ac93…seed_isolation 36b669faf16f… |
seed_data |
2026-11-08T13:48:12Z | 2026-11-08T13:48:13Z | 1 | 6
|
seed_data_sql 785ff72b97ca…seed_cases_json 3d463dc1daba… |
seed_validate |
2026-11-08T13:48:16Z | 2026-11-08T13:48:16Z | 1 | 3
|
seed_data_contract 5a565ac6e398… |
usecase_validate |
2026-11-08T13:48:38Z | 2026-11-08T13:48:38Z | 1 | 10
|
failed_tests b710bd7a34ad…passed_tests b3f4e29cb2b6…test_results fb46b415439f…usecase_contract 5b0d6b043928… |
finalize_docs |
2026-11-08T13:48:43Z | 2026-11-08T13:48:44Z | 1 | 9
|
defects_json c85d39f16864…release_notes 8e8475536f6b…api_integration_guide 0b9496b619fc… |
package_archive invalidated 2026-11-08T14:50:40Z |
2026-11-08T13:53:55Z | 2026-11-08T13:53:57Z | 1 | 34 (final gate PASS)
|
sale_tar 771b8fcb781b…checksums 213decfe395a…verify_md 7d64976d872c…rebuild_md 9f8c6c46ec8c…manifest_txt e0344f9a5646…actions_jsonl cb80c600ae55…provenance_md 7da75997c95d…assetchain_log_md e9eccaec0c0f…assetchain_log_json 686733e26399… |
[stage_runs]
Rewinds
- 2026-11-08T13:37:51Z:
verdicttoassemble_kiton strategy_changed (strategy changed (d2e4722b4557 -> 874755791eb1)) [stage_events, stage_events #26389] - 2026-11-08T14:50:40Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #26591]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-08T13:53:57Z.
5 calls over 3 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 5896 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 10137 | L-A08, L-038, L-036, L-034, L-032 |
usecase_validate | 1 | 0 | 0 | 1 | 0 | 1760 | — |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.32 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-08T13:54:34Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1517] | $0.32 | 3 rounds, $40.00 | 771b8fcb781b… |
Defects
Fully recorded- Ledger entries0 [defects, defects where product_slug=uptimekuma and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
0 ledger entries.
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:856d6d84c8b178ae180e44f9d5d514626382f461eec828cef665fc4fb9dd86e8 · published digest sha256:856d6d84c8b178ae180e44f9d5d514626382f461eec828cef665fc4fb9dd86e8 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 59) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T14:51:48Z · failing Docker Scout counts 99 packages with copyleft licences (GPL, LGPL, MPL), 98 of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T14:51:24Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3755921763 · transparency-log entry
- log index 3755921988 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3756307363 · transparency-log entry · integrated 2026-11-08T14:55:42Z) [ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:6700bb7bda011d5d19d85db4cd8ddf07e97e882a161dd3a02be26b5ef66dc0b1 · state attached · log index 3756308021 · transparency-log entry
- kind sbom · digest sha256:6700bb7bda011d5d19d85db4cd8ddf07e97e882a161dd3a02be26b5ef66dc0b1 · state attached · log index 3756308383 · transparency-log entry
- kind vsa · digest sha256:6700bb7bda011d5d19d85db4cd8ddf07e97e882a161dd3a02be26b5ef66dc0b1 · state attached · log index 3756308805 · transparency-log entry
- kind provenance · digest sha256:856d6d84c8b178ae180e44f9d5d514626382f461eec828cef665fc4fb9dd86e8 · state attached · log index 3756309237 · transparency-log entry
- kind sbom · digest sha256:856d6d84c8b178ae180e44f9d5d514626382f461eec828cef665fc4fb9dd86e8 · state attached · log index 3756309737 · transparency-log entry
- kind vsa · digest sha256:856d6d84c8b178ae180e44f9d5d514626382f461eec828cef665fc4fb9dd86e8 · state attached · log index 3756310471 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/uptimekuma/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-08T13:54:38Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:856d6d84c8b178ae180e44f9d5d514626382f461eec828cef665fc4fb9dd86e8 [clean-room rebuild ledger, runs[653]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-08T13:47:11Z [stage_runs, stage_runs chain 857 stage publish_image]
- Archive manifests written2026-11-08T14:53:27Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 751 · probed 2026-11-08T13:43:46Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-08T14:56:53Z generated: by KitForge release/build_trail.py · generator commit 678cbcb0bbd61a6d885eab3d9776ddcdf7ce640d
- 2026-11-08T14:58:20Z publication: promoted at 2026-11-08T14:57:20Z · promoted digest sha256:6700bb7bda011d5d19d85db4cd8ddf07e97e882a161dd3a02be26b5ef66dc0b1 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 376 · checklist status complete · checklist at 2026-11-08T14:58:20Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/uptimekuma/2.5.9-CE-ubuntu24.04-r1/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/uptimekuma/2.5.9-CE-ubuntu24.04-r1/), as staged for publishing | — |
ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.rebuild.json | beside the archive (prodasset /data/production/uptimekuma/2.5.9-CE-ubuntu24.04-r1/), as staged for publishing | — |
ReadyStack-uptimekuma-2.5.9-CE-ubuntu24.04-r1.rebuild.json.sigstore | beside the archive (prodasset /data/production/uptimekuma/2.5.9-CE-ubuntu24.04-r1/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/uptimekuma/2.5.9-CE-ubuntu24.04-r1/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 532 |
chains | sadb, ReadyStack's engine database (not published) | 857 |
defects | sadb, ReadyStack's engine database (not published) | uptimekuma 2.5.9-CE-ubuntu24.04-r1 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 857 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 857 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 857 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 857 |
release_images | sadb, ReadyStack's engine database (not published) | uptimekuma 2.5.9-CE-ubuntu24.04-r1 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 857 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 857 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |