Vaultwarden 1.37.5-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/vaultwarden:1.37.5-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/vaultwarden:1.37.5-CE-ubuntu24.04-r2
  • Index digestsha256:da5cba976e32ce820a3ae9ff9e8841ddd68dafb8a284ac04f2dc63c6c7b736b0
  • linux/amd64 digestsha256:5b443a7a4b758529c03b0fa0da00cfcc0082557850eef3963154ea7501be145b
  • ArchiveReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 nowfc5fddb0785fcb78d07514eaaaf4e6b9bd6c7c1d08128939c2fc6f1b7e23d0d3
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T15:36:45Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.trail.json
ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.trail.jsonReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.trail.mdVaultwarden product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductVaultwarden (vaultwarden) [MANIFEST.json]
  • Release tag1.37.5-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/vaultwarden:1.37.5-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:da5cba976e32ce820a3ae9ff9e8841ddd68dafb8a284ac04f2dc63c6c7b736b0 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:5b443a7a4b758529c03b0fa0da00cfcc0082557850eef3963154ea7501be145b [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.tar.gz (bytes 1254192989) [MANIFEST.json]
  • Archive sha256 at publishfc5fddb0785fcb78d07514eaaaf4e6b9bd6c7c1d08128939c2fc6f1b7e23d0d3 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/dani-garcia/vaultwarden [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref1.37.5 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit6ed6921cc2b0e03b4d74189574d2a5e71c512e97 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hasha220a57538bb53b70b9b7242a24b96f47675c6b98b8140ea821b71b0cf1b9a0d (files 575) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:e7c47c4c5a36aed970494c025df02a356fc834b0e484c33f6e5b8aeab1f50560 [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793569098 (utc 2026-11-01T21:38:18Z) [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref rust:1.99.1-bookworm@sha256:e6f2cff35d0f309acf8433b4f05878ed77092602c5065cc81801177da0bb3a9c · platform digest sha256:4715c3ad743951a3cea90e8b432f2a17e0ef5f3f3c3abf75108879e783b396f0
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit f67434b93907ad054ca0d12dd4d819bad708a360 · dirty yes · first drive 3982
    • commit 87de622d36b973dfefbe3911c9eb3c551aaa7d05 · dirty yes · first drive 4004
    • commit eda8a641601535a907ca0cb72a5a4d60029813e5 · dirty yes · first drive 4018
    • commit d731c9e0f6a9f36f56d28d09aead99eb92f2b336 · dirty yes · first drive 4034
    • commit 9b46fb2966cf7f115ec4c331ca41468be77aac3c · dirty yes · first drive 4043
    • commit 60a6d2c97ec3cf892fe7edaac0f7a56017938207 · dirty yes · first drive 4057
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain917 (created 2026-11-09T08:17:23Z · trigger customer_request · upstream version 1.37.5) [chains, chains #917]
  • Requestbuild request #546 (rebuild) (requested at 2026-11-08T03:42:16Z · requested by kitforge-agent · version 1.37.5) [build_requests, build_requests #546]
  • Reasonrevision 1.37.5-CE-ubuntu24.04-r2: same upstream version rebuilt on the chiselled runtime (slim base, C/Rust engine #198) [build_requests, build_requests #546 request_reason]
  • Supersedesreadystack/vaultwarden:1.37.5-CE-ubuntu24.04-r1 (chain 831) [chains, chains #831]

The path through the harness

Fully recorded

1 chain · 6 drives · 18 stages · 4 rewinds

Chain 917 release · ready_to_ship

Created 2026-11-09T08:17:23Z, upstream 1.37.5, build request 546 [chains, chains #917]

DriveStartedMinutesBuild hostHow it stopped
39822026-11-09T08:18:01Z85.9build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3982]
40042026-11-09T11:23:16Z18.8build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4004]
40182026-11-09T12:59:17Z6.3build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4018]
40342026-11-09T14:13:16Z5.8build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4034]
40432026-11-09T14:53:01Z5.9build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4043]
40572026-11-09T15:27:48Z—build host 3 publish-held not recorded [drive_runs, drive_runs #4057]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-09T08:18:12Z2026-11-09T08:18:12Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 92971dfd11e6…
acquire 2026-11-09T08:18:16Z2026-11-09T08:18:17Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 4a10a62daa5f…
license_file 8486a10c4393…
custody_inputs fec73090bb50…
source_tree_hash 491e5549bb00…
source_file_manifest 30fceac4d794…
plan 2026-11-09T08:18:59Z2026-11-09T08:19:00Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 5ee4a94a9fb7…
input_pin_plan 1eb4637cd3c7…
toolchain_lock ef9eb052aff0…
assemble_kit 2026-11-09T08:34:01Z2026-11-09T08:34:02Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 303ef65e07dc…
build_recipe 88dc9f90b6b7…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 5592ddb3e7d3…
verify_offline_sh 3e8184ea230c…
base_image_digests a47a2c7a28e4…
dockerfile_offline 303ef65e07dc…
first_build_digest 2cbdde8ad82f…
remediate 2026-11-09T08:34:50Z2026-11-09T08:34:51Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 252113f5b3c9…
security_report 5b86a0e7cb54…
build_kit 2026-11-09T08:59:59Z2026-11-09T08:59:59Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 508a3b3740c3…
locked_digest 4a1feaa527b7…
freeze_manifest b3f3c33899df…
offline_rebuild_transcript 1c89314509cb…
verdict 2026-11-09T09:00:42Z2026-11-09T09:00:43Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict d73c4ab6bd5d…
publish_image 2026-11-09T09:01:19Z2026-11-09T09:01:20Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme f1104ae28bdf…
promotion_record b72276fed5bf…
boot_instance 2026-11-09T09:01:25Z2026-11-09T09:01:30Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 7d596376a9d6…
sbom 2026-11-09T09:01:44Z2026-11-09T09:01:44Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 17d5840fa894…
sbom_json 50236074b604…
schema_discovery 2026-11-09T09:01:47Z2026-11-09T09:01:48Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash c177ce6bd9e8…
dependency_tree 15515b9a9d14…
table_classification a3eb20347960…
admin_handbook 2026-11-09T09:11:50Z2026-11-09T09:11:51Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map eea4ad3f270e…
admin_handbook 02ec3c31cbe6…
db_handbook 2026-11-09T09:20:34Z2026-11-09T09:20:35Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 703b40e06a77…
seed_isolation 06ee4840f97c…
seed_data 2026-11-09T09:20:47Z2026-11-09T09:20:48Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 2c31acebb75e…
seed_cases_json c5c72823b24e…
seed_validate 2026-11-09T09:20:51Z2026-11-09T09:20:51Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract da8d3d1ee3ec…
usecase_validate 2026-11-09T09:21:12Z2026-11-09T09:21:13Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 84c6216920c9…
test_results c4e53606dfe9…
usecase_contract f01da0d96c74…
finalize_docs 2026-11-09T09:34:55Z2026-11-09T09:34:56Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json e2b08dafb83d…
release_notes b3a9cafa3a01…
api_integration_guide 893827e8ad04…
package_archive invalidated 2026-11-09T15:27:21Z 2026-11-09T09:43:52Z2026-11-09T14:58:56Z5
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar a104c6bf85a1…
checksums a266872abdc3…
verify_md de09531c1092…
rebuild_md 376c335872ce…
manifest_txt 665c9511ea95…
actions_jsonl 48682f24d25a…
provenance_md 8e8ba6802d74…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json a2c1c606736c…

[stage_runs]

Rewinds

  • 2026-11-09T12:23:55Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28860]
  • 2026-11-09T13:41:38Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28990]
  • 2026-11-09T14:49:45Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29188]
  • 2026-11-09T15:27:21Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29285]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T14:58:56Z.

213 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 010303 —
remediate2001 013980 L-A08, L-038, L-036, L-034, L-032
admin_handbook683303 11542441 —
db_handbook451603 3297409 —
usecase_validate1001 01805 —
finalize_docs954503 13722979 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

4 rounds, 4 counted, $11.84 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T11:42:29Z 52025 findings to repackage [held_rounds, held_rounds #1610] $2.84 3 rounds, $40.00 54855a7ae1f1…
22026-11-09T13:06:03Z 0719 findings to repackage [held_rounds, held_rounds #1619] $3.50 3 rounds, $40.00 dfc0cafa0aec…
32026-11-09T14:19:30Z 0112 findings to repackage [held_rounds, held_rounds #1631] $3.38 3 rounds, $40.00 4671956eb03a…
42026-11-09T14:59:22Z 008 clean to publish [held_rounds, held_rounds #1638] $2.13 3 rounds, $40.00 a104c6bf85a1…

Defects

Fully recorded
  • Ledger entries96 [defects, defects where product_slug=vaultwarden and this tag or chain]
  • Disclosed in the archive96 [docs/defects/defects.json, entries]

96 ledger entries: by severity medium 1, critical 5, high 28, low 62; by status open 3, fixed-before-release 93.

DefectSeverityStatusFound byFixed in
RSD-vaultwarden-3eda7ea875
Open self-registration by default [defects, defects #203277]		mediumopenbuild strategy record—
RSD-vaultwarden-795c9a50db
Admin handbook: The restore extraction omits -i, so docker does not attach stdin and tar reads nothing. [defects, defects #205764]		criticalfixed-before-releaseheld review (review model)—
RSD-vaultwarden-90403aeace
Admin handbook: Extraction example omits -i. [defects, defects #205765]		criticalfixed-before-releaseheld review (review model)—
RSD-vaultwarden-d825f57c70
Admin handbook: The streaming example uses docker exec without -i and contradicts the sentence above it. [defects, defects #205766]		criticalfixed-before-releaseheld review (review model)—
RSD-vaultwarden-5f7621577d
Admin handbook: A backup taken with no running container excludes the database files, so the archive holds no database. [defects, defects #205767]		criticalfixed-before-releaseheld review (review model)—
RSD-vaultwarden-7a4e2bec38
Admin handbook: The 'restore a backup' sequence uses vw-data.tar then deletes the -wal; it loses data and its mv fails. [defects, defects #205768]		criticalfixed-before-releaseheld review (review model)—
RSD-vaultwarden-7ade10623d
Admin handbook: The hash command is given without -it and panics. [defects, defects #205769]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-0e3f401a54
Database handbook: The hash command is given without -it and panics. [defects, defects #205770]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-824f2506e5
Admin handbook: Misattributes the /api/config caveat to the admin panel. [defects, defects #205771]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-9e67ffe05b
Admin handbook: Tells the customer to run an integrity check that the image cannot perform. [defects, defects #205772]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-082475be87
Database handbook: States HTTP 200 for the disclosed hint; the server answers 400 with the hint in the error message. [defects, defects #205773]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-22489d010f
API guide: Wrong status code for the disclosed hint. [defects, defects #205774]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-c268702dbc
API guide: Wrong status code for the disclosed hint. [defects, defects #205775]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-cad81f7b78
API guide: The body is an error object with status 400, not a JSON string. [defects, defects #205776]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-71121295c0
Database handbook: The plain email address is rejected with 400; the header must be base64url-encoded. [defects, defects #205777]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-386c5d5fe8
Admin handbook: Does not say the email header must be base64url encoded. [defects, defects #205778]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-586f74fb26
API guide: The email header must be base64url encoded. [defects, defects #205779]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-85b6251d70
API guide: The email header must be base64url encoded. [defects, defects #205780]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-72ea8ef2d8
Database handbook: Wrong emulated API version. [defects, defects #205781]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-a657edb4ae
Database handbook: Confuses the Vaultwarden release with the emulated Bitwarden API version; contradicts line 1342. [defects, defects #205782]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-ec69f0a29f
API guide: An empty verification token is not accepted on an SMTP-less server. [defects, defects #205783]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-a4589c183d
API guide: Omits that the token is returned and required. [defects, defects #205784]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-308b5d7464
API guide: Says to send the master password; the endpoint expects the derived hash. [defects, defects #205785]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-47b7af58df
API guide: Tells the reader to drop the quotes that protect the $ characters. [defects, defects #205786]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-797e986362
API guide: States that the hint is disclosed even with SMTP active, contradicting the rest of the guide. [defects, defects #205787]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-50e7052a24
API guide: The setting is not required when SMTP is configured, and the hint is not returned 'directly' with a 200. [defects, defects #205788]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-efbdea6a24
Admin handbook: 'Before the first start' is false; the token can be added at any later re-create. [defects, defects #205789]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-3f93c255c6
API guide: 'Before the first start' is false. [defects, defects #205790]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-d191d1c316
Admin handbook: Says only failed logins count; contradicts line 670. [defects, defects #205791]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-77e54c91f5
API guide: 'Failed ... including successful ones' contradicts itself. [defects, defects #205792]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-0a4ee740d0
API guide: 'Unsuccessful ... including successful' contradicts itself. [defects, defects #205793]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-16792b9456
Admin handbook: Names a non-existent command. [defects, defects #205794]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-2e10067134
Admin handbook: Implies the image is based on ubuntu:24.04. [defects, defects #205795]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-5ec0046f4d
Admin handbook: Step count is wrong. [defects, defects #205796]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-24458ab33e
Admin handbook: Self-contradictory instruction. [defects, defects #205797]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-0be2fe65cf
Database handbook: 'Required' contradicts the default documented elsewhere. [defects, defects #205798]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-4dd5570e62
Database handbook: The health check does not use docker exec. [defects, defects #205799]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-d24a91c401
Database handbook: Interval contradicts line 178. [defects, defects #205800]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-6a44833208
Database handbook: The log does record INFO lines. [defects, defects #205801]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-e325594b84
Database handbook: Self-contradictory. [defects, defects #205802]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-29470a5ce2
Database handbook: Unsupported sizes (measured 295 files, 169 MB; binary 39.4 MB). [defects, defects #205803]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-aa8008bab3
Database handbook: Unsupported sizes. [defects, defects #205804]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-27341afc1c
Database handbook: Invites overriding DATABASE_URL and PORT. [defects, defects #205805]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-61cdb92f19
API guide: Describes email queueing; the default deployment has no SMTP. [defects, defects #205806]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-1cd90fc841
API guide: Says the hint is returned when SMTP is configured. [defects, defects #205807]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-6755783ae6
API guide: Wrong condition for SIGNUPS_ALLOWED. [defects, defects #205808]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-d80e492da1
API guide: Says /alive proves the database is accessible. [defects, defects #205809]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-974834b2b2
API guide: Lists /alive among endpoints that need no database connection. [defects, defects #205810]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-b71424f1fa
API guide: The server does send CORS headers for the DOMAIN origin. [defects, defects #205811]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-181ac2549a
API guide: Unsupported blanket compatibility claim. [defects, defects #205812]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-fd9cc7bdc1
API guide: The list is not the admin panel's endpoints. [defects, defects #205813]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-8b09f913eb
Admin handbook: Paraphrase of a round-1 major: the sentence sends the reader to a check the image cannot run and contradicts the preceding paragraph. [defects, defects #208609]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-fabb16043d
API guide: Tells integrators to send the master password; the endpoint expects the client-derived hash. [defects, defects #208610]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-d39b97ba63
API guide: Says send-verification-email takes the master password; it does not, and an integrator should never send a master password to it. [defects, defects #208611]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-2c19d793f6
API guide: States that SMTP alone makes the server send the verification email; by default it still returns the token in the response, so an integrator on an SMTP-configured server waits for a mail that never… [defects, defects #208612]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-ffcfa4ae84
API guide: Same false SMTP condition as line 748. [defects, defects #208613]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-baed11d6c4
API guide: Says registration starts by sending a verification email; on the default deployment nothing is sent and the token comes back in the response. [defects, defects #208614]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-f118e9c221
API guide: Wrong status for a mail failure on the password-hint endpoint. [defects, defects #208615]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-756c2b88c5
API guide: 'Before first startup' is false; the variable works at any re-create until the admin page is saved. [defects, defects #208616]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-17eca0320b
API guide: 'Existing users' register: it is invited addresses, not existing users. [defects, defects #208617]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-96e4e1af7e
API guide: Omits that the token is returned and required. [defects, defects #208618]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-5e44905f33
API guide: Mislabels GET / as a health check. [defects, defects #208619]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-dcb86f5f8e
API guide: Refers to a section that does not exist in this guide. [defects, defects #208620]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-1c4c61c202
API guide: Presents the 400 body as a JSON string; it is an error object. [defects, defects #208621]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-e9e1d9ea6c
Admin handbook: Unconditional claim is false once config.json holds the token. [defects, defects #208622]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-7b71f0b287
Admin handbook: Names docker exec, then shows docker run. [defects, defects #208623]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-08172d8a7d
Admin handbook: Reverses the cause and effect. [defects, defects #208624]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-bae406a6a4
Database handbook: States that no other users exist; /etc/passwd lists many. [defects, defects #208625]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-25320743e7
Database handbook: 'All other requests ... 401' is false (unknown paths answer 404). [defects, defects #208626]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-53a3af6847
Database handbook: Implies /alive stops answering 200 once a lock has lasted 30 s. [defects, defects #208627]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-b2cae68b93
Database handbook: Blanket compatibility claim the records do not support and the API guide contradicts. [defects, defects #208628]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-8b31baa7f5
Database handbook: Names PBKDF2 as the only KDF. [defects, defects #208629]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-6a91ca8317
Database handbook: Points at an extraction step that uses the wrong archive. [defects, defects #208630]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-ea14345d0d
Database handbook: Self-contradictory scope for the rollback sequence. [defects, defects #208631]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-f56dc4f51f
Database handbook: Mixes arguments with environment variables. [defects, defects #208632]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-dd2607db0d
Database handbook: Says /data on the host. [defects, defects #208633]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-d21cc0b25f
Docker Hub README: README says the build kit is free; the bundle MANIFEST prices it at 1000 cents and marks the release not free. [defects, defects #208634]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-c6e7737b5c
API guide: The throttling section says the API has no limits besides the admin login; login and unauthenticated registration/password-hint requests are rate limited per IP and answer 429. [defects, defects #212714]		highfixed-before-releaseheld review (review model)—
RSD-vaultwarden-cd84adfb70
API guide: Invited-address exception is stated without its no-SMTP condition. [defects, defects #212715]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-19f73398fe
API guide: Invited-address exception is stated without its no-SMTP condition. [defects, defects #212716]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-0ca76ebb26
API guide: Pointer sends the reader to a section that holds no authentication details. [defects, defects #212717]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-4830664da7
Database handbook: Either-or condition makes the 400 apply to SMTP-configured servers, which mail the hint and answer 200. [defects, defects #212718]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-48599e367c
Database handbook: Says the hint is returned when Show password hint is enabled, which is false when SMTP is configured. [defects, defects #212719]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-7b850ec775
Database handbook: Names PBKDF2 as the only KDF (repeat of a round-2 minor). [defects, defects #212720]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-1f03d790d6
Database handbook: Tells integrators to send the username and password; the endpoint expects the client-derived hash (paraphrase of a round-2 major). [defects, defects #212721]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-9fc5d8105a
Database handbook: Same as line 726. [defects, defects #212722]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-fc230cb99a
Database handbook: Blanket client-feature claim the records do not support (repeat of a round-2 minor). [defects, defects #212723]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-80159501dc
Database handbook: Blanket compatibility claim the records do not support. [defects, defects #212724]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-d05b4f5c6a
Docker Hub README: README says the build kit is free; MANIFEST prices it at 1000 cents and marks the release not free. [defects, defects #212725]		lowopenheld review (review model)—
RSD-vaultwarden-4b9acf7f98
Docker Hub README: Links block repeats the 'free with an account' claim for the build kit. [defects, defects #212726]		lowopenheld review (review model)—
RSD-vaultwarden-8b3e7ec002
Database handbook: States a 30-second probe timeout; the image's HEALTHCHECK and rs-probe both time out at 10 seconds. [defects, defects #215013]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-a687cee1d7
Database handbook: Ties the unhealthy verdict to the 30 s database timeout; the probe times out at 10 s. [defects, defects #215014]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-389a9a4234
Database handbook: Says the probe receives the 503; the probe gives up at 10 s, before the 30 s 503. [defects, defects #215015]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-3759984195
Database handbook: Blanket claim that all Bitwarden clients work; the records test none. [defects, defects #215016]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-ef22c73280
Database handbook: Names four official client types as working; the records test none. [defects, defects #215017]		lowfixed-before-releaseheld review (review model)—
RSD-vaultwarden-29e93f2a28
Admin handbook: Says a non-writable directory leaves the container healthy; an empty non-writable /data makes it exit. [defects, defects #215018]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:5b443a7a4b758529c03b0fa0da00cfcc0082557850eef3963154ea7501be145b · published digest sha256:5b443a7a4b758529c03b0fa0da00cfcc0082557850eef3963154ea7501be145b · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 758) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T15:28:13Z · failing Docker Scout counts 14 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T15:28:00Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3766684788 · transparency-log entry · integrated 2026-11-09T15:34:33Z) [ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:da5cba976e32ce820a3ae9ff9e8841ddd68dafb8a284ac04f2dc63c6c7b736b0 · state attached · log index 3766695133 · transparency-log entry
    • kind sbom · digest sha256:da5cba976e32ce820a3ae9ff9e8841ddd68dafb8a284ac04f2dc63c6c7b736b0 · state attached · log index 3766696376 · transparency-log entry
    • kind vsa · digest sha256:da5cba976e32ce820a3ae9ff9e8841ddd68dafb8a284ac04f2dc63c6c7b736b0 · state attached · log index 3766697853 · transparency-log entry
    • kind provenance · digest sha256:5b443a7a4b758529c03b0fa0da00cfcc0082557850eef3963154ea7501be145b · state attached · log index 3766699195 · transparency-log entry
    • kind sbom · digest sha256:5b443a7a4b758529c03b0fa0da00cfcc0082557850eef3963154ea7501be145b · state attached · log index 3766700245 · transparency-log entry
    • kind vsa · digest sha256:5b443a7a4b758529c03b0fa0da00cfcc0082557850eef3963154ea7501be145b · state attached · log index 3766701278 · transparency-log entry
    (at 2026-11-09T15:34:34Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/vaultwarden/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T11:42:37Z on build host 1 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:5b443a7a4b758529c03b0fa0da00cfcc0082557850eef3963154ea7501be145b [clean-room rebuild ledger, runs[695]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-09T09:01:20Z [stage_runs, stage_runs chain 917 stage publish_image]
  • Archive manifests written2026-11-09T15:32:08Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 70 · probed 2026-11-09T08:46:59Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T15:36:45Z generated: by KitForge release/build_trail.py · generator commit 770a4fd03ab213ac04f7939e621ff9536bb071e2
  • 2026-11-09T15:38:44Z publication: promoted at 2026-11-09T15:37:36Z · promoted digest sha256:da5cba976e32ce820a3ae9ff9e8841ddd68dafb8a284ac04f2dc63c6c7b736b0 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 421 · checklist status complete · checklist at 2026-11-09T15:38:44Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/vaultwarden/1.37.5-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/vaultwarden/1.37.5-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/vaultwarden/1.37.5-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-vaultwarden-1.37.5-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/vaultwarden/1.37.5-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/vaultwarden/1.37.5-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)546
chainssadb, ReadyStack's engine database (not published)917
defectssadb, ReadyStack's engine database (not published)vaultwarden 1.37.5-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 917
held_roundssadb, ReadyStack's engine database (not published)chain 917
lesson_recallssadb, ReadyStack's engine database (not published)chain 917
micro_step_runssadb, ReadyStack's engine database (not published)chain 917
release_imagessadb, ReadyStack's engine database (not published)vaultwarden 1.37.5-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 917
stage_runssadb, ReadyStack's engine database (not published)chain 917
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—