Vaultwarden 1.37.5-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/vaultwarden:1.37.5-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/vaultwarden:1.37.5-CE-ubuntu24.04-r1
  • Index digestsha256:7686bd0a3ab6625b2e7e97e4cc05ad1289e8da57b3b58b328415f3a82b13a9b8
  • linux/amd64 digestsha256:a0e81823c6031cb320118fa103aebb18b016837e081cf782f0638f4cfdabbb64
  • ArchiveReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 now6089a5fb7db7bf5a8985955815319d7dba03fddadd4759ae4874ac72264ffae6
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-07T09:20:54Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.trail.json
ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.trail.jsonReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.trail.mdVaultwarden product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductVaultwarden (vaultwarden) [MANIFEST.json]
  • Release tag1.37.5-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/vaultwarden:1.37.5-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:7686bd0a3ab6625b2e7e97e4cc05ad1289e8da57b3b58b328415f3a82b13a9b8 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:a0e81823c6031cb320118fa103aebb18b016837e081cf782f0638f4cfdabbb64 [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.tar.gz (bytes 946380476) [MANIFEST.json]
  • Archive sha256 at publish6089a5fb7db7bf5a8985955815319d7dba03fddadd4759ae4874ac72264ffae6 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/dani-garcia/vaultwarden [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref1.37.5 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit6ed6921cc2b0e03b4d74189574d2a5e71c512e97 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hasha220a57538bb53b70b9b7242a24b96f47675c6b98b8140ea821b71b0cf1b9a0d (files 575) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:bbb6d878d6cc390589f8d8913251012092c349b25807ecdd10915e967bd22cf8 [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793569098 (utc 2026-11-01T21:38:18Z) [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref rust:1.99.1-bookworm@sha256:e6f2cff35d0f309acf8433b4f05878ed77092602c5065cc81801177da0bb3a9c · platform digest sha256:4715c3ad743951a3cea90e8b432f2a17e0ef5f3f3c3abf75108879e783b396f0
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit bfa8bc7158165da6eacc3ee102d261bbcc9667ff · dirty yes · first drive 3549
    • commit ff8a6717061438a0365d5529191d6d1b9f702add · dirty yes · first drive 3598
    • commit 0b84905088b3228fdf50e0647d1f5a7d7d60df02 · dirty yes · first drive 3609
    • commit bd381ae76aa7f67e8731266b0aeeeea5815cd5cc · dirty yes · first drive 3612
    • commit 0185b65902e7de72275f275e796ced5f2061c824 · dirty yes · first drive 3620
    • commit ae45c1d967a795015d2d15ccbbe5e9a73c4f8798 · dirty yes · first drive 3625
    • commit 7279a564d33c851a223aaad1ee727290b1f90ca4 · dirty yes · first drive 3627
    • commit 8e204f133811e166a72c2a2713ab076430aad31c · dirty yes · first drive 3629
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain831 (created 2026-11-07T03:03:48Z · trigger customer_request · upstream version 1.37.5) [chains, chains #831]
  • Requestbuild request #535 (rebuild) (requested at 2026-11-07T03:00:10Z · requested by kitforge-agent · version 1.37.5) [build_requests, build_requests #535]
  • Reasonretarget 2026-11-07: vaultwarden 1.37.4-CE-ubuntu24.04-r4 -> 1.37.5 (upstream GA 2026-11-01; Core since revision 3); Rust 1.99.1, web vault v2026.10.1; clears CVE-2026-109518 apt; PR #185 [build_requests, build_requests #535 request_reason]
  • Supersedesreadystack/vaultwarden:1.37.4-CE-ubuntu24.04-r4 (chain 733) [chains, chains #733]

The path through the harness

Fully recorded

1 chain · 8 drives · 18 stages · 4 rewinds

Chain 831 release · ready_to_ship

Created 2026-11-07T03:03:48Z, upstream 1.37.5, build request 535 [chains, chains #831]

DriveStartedMinutesBuild hostHow it stopped
35492026-11-07T03:04:22Z64.2build host 4 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3549]
35982026-11-07T06:42:37Z7build host 4 withhold-publish infra_hub_rate_limit at package_archive; 1 tick [drive_runs, drive_runs #3598]
36092026-11-07T07:26:34Z6.5build host 4 withhold-publish infra_hub_rate_limit at package_archive; 1 tick [drive_runs, drive_runs #3609]
36122026-11-07T07:50:47Z6.3build host 4 withhold-publish infra_hub_rate_limit at package_archive; 1 tick [drive_runs, drive_runs #3612]
36202026-11-07T08:15:05Z5.8build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3620]
36252026-11-07T08:30:01Z6.9build host 4 publish-held infra_hub_rate_limit at package_archive; 1 tick [drive_runs, drive_runs #3625]
36272026-11-07T08:53:49Z2.8build host 4 publish-held infra_hub_rate_limit at package_archive; 1 tick [drive_runs, drive_runs #3627]
36292026-11-07T09:13:31Z—build host 4 publish-held not recorded [drive_runs, drive_runs #3629]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-07T03:04:33Z2026-11-07T03:04:34Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 164ee7a76e17…
acquire 2026-11-07T03:04:37Z2026-11-07T03:04:38Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 4a10a62daa5f…
license_file 8486a10c4393…
custody_inputs fec73090bb50…
source_tree_hash 491e5549bb00…
source_file_manifest 30fceac4d794…
plan 2026-11-07T03:05:25Z2026-11-07T03:05:25Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report fcde55e5ca12…
input_pin_plan f2475c85e118…
toolchain_lock 4532447951f8…
assemble_kit 2026-11-07T03:20:03Z2026-11-07T03:20:03Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile c35b251d69f8…
build_recipe 54b45d456c78…
system_pinning d2f713907be0…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 5f24c1f15094…
verify_offline_sh 3e8184ea230c…
base_image_digests a47a2c7a28e4…
dockerfile_offline c35b251d69f8…
first_build_digest 86ba8b86ba11…
remediate 2026-11-07T03:20:53Z2026-11-07T03:20:54Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 1709bfb7239d…
security_report 59391cea820b…
build_kit 2026-11-07T03:45:45Z2026-11-07T03:45:46Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 34bbb30174c6…
locked_digest 4e2982e361f5…
freeze_manifest 2e09e10d3faf…
offline_rebuild_transcript d0507545461a…
verdict 2026-11-07T03:46:58Z2026-11-07T03:46:58Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 525b9ed9846c…
publish_image 2026-11-07T03:47:45Z2026-11-07T03:47:46Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme c336c0033232…
promotion_record 9e57816bbfd4…
boot_instance 2026-11-07T03:47:51Z2026-11-07T03:47:55Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 303ac9daa101…
sbom 2026-11-07T03:48:10Z2026-11-07T03:48:11Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 4374e30f94a3…
sbom_json b29f01be249d…
schema_discovery 2026-11-07T03:48:13Z2026-11-07T03:48:14Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash c177ce6bd9e8…
dependency_tree 15515b9a9d14…
table_classification a3eb20347960…
admin_handbook 2026-11-07T03:48:23Z2026-11-07T03:48:24Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map eea4ad3f270e…
admin_handbook e3cff9d4ffec…
db_handbook 2026-11-07T03:48:34Z2026-11-07T03:48:35Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 329331ce8176…
seed_isolation 06ee4840f97c…
seed_data 2026-11-07T03:48:42Z2026-11-07T03:48:43Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 2c31acebb75e…
seed_cases_json 8a3b4376fac5…
seed_validate 2026-11-07T03:48:45Z2026-11-07T03:48:46Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract edaf7178ab89…
usecase_validate 2026-11-07T03:49:05Z2026-11-07T03:49:06Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 197eb9826950…
test_results 65e7c0e7f7ee…
usecase_contract 4b647d2f3f96…
finalize_docs 2026-11-07T03:49:11Z2026-11-07T03:49:12Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 19522b747d99…
release_notes 3e415a629aa9…
api_integration_guide 7f5ec56f2f96…
package_archive invalidated 2026-11-07T08:29:33Z 2026-11-07T04:08:33Z2026-11-07T08:20:55Z2
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 9a1ad8318bb0…
checksums 264deec642c6…
verify_md c40ec5f02433…
rebuild_md a6f052445486…
manifest_txt 2b842d705786…
actions_jsonl fb55faabe071…
provenance_md 55e068d85db8…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 48c492bd9e87…

[stage_runs]

Rewinds

  • 2026-11-07T06:05:42Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24065]
  • 2026-11-07T08:29:33Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24316]
  • 2026-11-07T08:53:22Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24340]
  • 2026-11-07T09:13:05Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24354]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-07T08:20:55Z.

10 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 010671 —
remediate2001 013885 L-A08, L-038, L-036, L-034, L-032
admin_handbook2001 012756 —
db_handbook1001 06220 —
usecase_validate1001 01740 —
finalize_docs2001 017571 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 2 counted, $1.26 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-07T04:09:34Z 01218 findings to tests_broken [held_rounds, held_rounds #1426] $0.65 3 rounds, $40.00 3a1f214df779…
2 not counted2026-11-07T06:02:23Z ——— blocked to blocked [held_rounds, held_rounds #1439] — 3 rounds, $40.00 3a1f214df779…
32026-11-07T08:21:31Z 000 clean to publish [held_rounds, held_rounds #1451] $0.60 3 rounds, $40.00 9a1ad8318bb0…

Defects

Fully recorded
  • Ledger entries26 [defects, defects where product_slug=vaultwarden and this tag or chain]
  • Disclosed in the archive26 [docs/defects/defects.json, entries]

26 ledger entries: by severity medium 1, low 13, high 12; by status open 1, fixed-before-release 25.

DefectSeverityStatusFound byFixed in
RSD-vaultwarden-cea9d37a68
Open self-registration by default [defects, defects #159506]		mediumopenbuild strategy record—
RSD-vaultwarden-d96ac1d7c3
API guide: The step says to replace the r1 tag, but no r1 appears in the command; the tag shown is this release, r3. [defects, defects #159507]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-bb394b05aa
Admin handbook: Misquoted log line (Operating facts, from strategy doc_facts.admin_token). [defects, defects #159508]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-acb9e11644
Admin handbook: Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and… [defects, defects #159918]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-41402a7441
Admin handbook: Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and… [defects, defects #159919]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-950ff45c1c
Admin handbook: Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and… [defects, defects #159920]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-2a1c154127
Admin handbook: Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5". [defects, defects #159921]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-64f345f101
Admin handbook: Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5". [defects, defects #159922]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-c6bf0101b1
Admin handbook: Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5". [defects, defects #159923]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-c2157e2339
Admin handbook: Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and… [defects, defects #159924]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-41e6c3f7d5
Database handbook: Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and… [defects, defects #159925]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-bc9f45f1c5
API guide: Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5". [defects, defects #159926]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-08ed1efa03
Database handbook: Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5". [defects, defects #159927]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-cb4519ca80
Database handbook: Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5". [defects, defects #159928]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-ec45c85c94
Database handbook: Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and… [defects, defects #159929]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-afc916073c
Database handbook: Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and… [defects, defects #159930]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-bacaccbc45
API guide: Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and… [defects, defects #159931]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-f60af4908d
API guide: Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5". [defects, defects #159932]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-3a9ef3ab3b
API guide: Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5". [defects, defects #159933]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-a6da5624b2
API guide: Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5". [defects, defects #159934]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-3f6697548b
API guide: Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5". [defects, defects #159935]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-4f72acea95
API guide: Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and… [defects, defects #159936]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-990ccf90a4
API guide: Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and… [defects, defects #159937]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-f99eaeb7da
API guide: Example response of GET /api/version names the superseded 1.37.4; this image returns "1.37.5". [defects, defects #159938]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-a14daee7a8
API guide: Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and… [defects, defects #159939]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-d2b143c176
API guide: Unchanged sentence made false by the image change: the bundled web vault is 2026.10.1, not 2026.7.0 (also contradicts the handbook's own sentence at ADMIN_HANDBOOK.md Offline Rebuild/Provenance and… [defects, defects #159940]		highfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:a0e81823c6031cb320118fa103aebb18b016837e081cf782f0638f4cfdabbb64 · published digest sha256:a0e81823c6031cb320118fa103aebb18b016837e081cf782f0638f4cfdabbb64 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 726) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-07T09:13:56Z · failing Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-07T09:13:42Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3734497633 · transparency-log entry · integrated 2026-11-07T09:19:18Z) [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:7686bd0a3ab6625b2e7e97e4cc05ad1289e8da57b3b58b328415f3a82b13a9b8 · state attached · log index 3734500105 · transparency-log entry
    • kind sbom · digest sha256:7686bd0a3ab6625b2e7e97e4cc05ad1289e8da57b3b58b328415f3a82b13a9b8 · state attached · log index 3734500959 · transparency-log entry
    • kind vsa · digest sha256:7686bd0a3ab6625b2e7e97e4cc05ad1289e8da57b3b58b328415f3a82b13a9b8 · state attached · log index 3734502023 · transparency-log entry
    • kind provenance · digest sha256:a0e81823c6031cb320118fa103aebb18b016837e081cf782f0638f4cfdabbb64 · state attached · log index 3734502885 · transparency-log entry
    • kind sbom · digest sha256:a0e81823c6031cb320118fa103aebb18b016837e081cf782f0638f4cfdabbb64 · state attached · log index 3734504028 · transparency-log entry
    • kind vsa · digest sha256:a0e81823c6031cb320118fa103aebb18b016837e081cf782f0638f4cfdabbb64 · state attached · log index 3734505325 · transparency-log entry
    (at 2026-11-07T09:19:19Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/vaultwarden/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-07T04:09:41Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:a0e81823c6031cb320118fa103aebb18b016837e081cf782f0638f4cfdabbb64 [clean-room rebuild ledger, runs[601]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-07T03:47:46Z [stage_runs, stage_runs chain 831 stage publish_image]
  • Archive manifests written2026-11-07T09:16:47Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 743 · probed 2026-11-07T03:33:19Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-07T09:20:54Z generated: by KitForge release/build_trail.py · generator commit 8e204f133811e166a72c2a2713ab076430aad31c
  • 2026-11-07T09:22:31Z publication: promoted at 2026-11-07T09:21:27Z · promoted digest sha256:7686bd0a3ab6625b2e7e97e4cc05ad1289e8da57b3b58b328415f3a82b13a9b8 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 342 · checklist status complete · checklist at 2026-11-07T09:22:31Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/vaultwarden/1.37.5-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/vaultwarden/1.37.5-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/vaultwarden/1.37.5-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/vaultwarden/1.37.5-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/vaultwarden/1.37.5-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)535
chainssadb, ReadyStack's engine database (not published)831
defectssadb, ReadyStack's engine database (not published)vaultwarden 1.37.5-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 831
held_roundssadb, ReadyStack's engine database (not published)chain 831
lesson_recallssadb, ReadyStack's engine database (not published)chain 831
micro_step_runssadb, ReadyStack's engine database (not published)chain 831
release_imagessadb, ReadyStack's engine database (not published)vaultwarden 1.37.5-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 831
stage_runssadb, ReadyStack's engine database (not published)chain 831
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—