virt-controller v1.9.1-CE-debian12-r2 build trail
How ReadyStack built readystack/virtcontroller:v1.9.1-CE-debian12-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/virtcontroller:v1.9.1-CE-debian12-r2 - Index digestsha256:4d3bda37aecbdf99ff07c02f17978f8ee800179f0172981d17b0ac26ea9142ec
- linux/amd64 digestsha256:d19615aad99d9715a0cf91e41647795dac2d49ee7c2b6acc83d2fbed1c1212c5
- Archive
ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.tar.gz - Archive SHA-256 now944ed5740bd11aeb7250f314cc886db4e604a648eccf3c157cb57365b6abb0c9
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-08T08:43:58Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.trail.json.sigstore ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- Productvirt-controller (virtcontroller) [MANIFEST.json]
- Release tagv1.9.1-CE-debian12-r2 [MANIFEST.json]
- Imagereadystack/virtcontroller:v1.9.1-CE-debian12-r2 [MANIFEST.json]
- Image index digestsha256:4d3bda37aecbdf99ff07c02f17978f8ee800179f0172981d17b0ac26ea9142ec [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:d19615aad99d9715a0cf91e41647795dac2d49ee7c2b6acc83d2fbed1c1212c5 [ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.tar.gz (bytes 1173391903) [MANIFEST.json]
- Archive sha256 at publish944ed5740bd11aeb7250f314cc886db4e604a648eccf3c157cb57365b6abb0c9 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/kubevirt/kubevirt [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv1.9.1 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commitc3d19093f9c7b843b3879b18dc088911c081c39e [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashde7abf04e51b6cf004d0365dfe6d8c5251edeeb69bfa0caa3d8b366b85fe6f36 (files 12717) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:f46908e4746e939fdfbc4c004a3d9fe8bab4f412fa518d0be6e928e42118902f [ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1791523273 (utc 2026-10-09T05:21:13Z) [ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.rebuild.json, inputs.source_date_epoch]
- Base images
- ref quay.io/kubevirt/builder:2606231619-4fe2cd536f@sha256:a48a7dd5a1b80602269b8c714fdaa54f729a9a4a4d096f7ee0d15c94cef343e8 · platform digest sha256:a48a7dd5a1b80602269b8c714fdaa54f729a9a4a4d096f7ee0d15c94cef343e8
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.rebuild.json, engine]
- Engine commit(s)
- commit ca87f22b0bc07284fe7d35ddd7b8fced30d8dfd5 · dirty yes · first drive 3729
- commit a5797296229775110455db099d4b5aa29941c582 · dirty yes · first drive 3733
Why this release exists
Fully recorded- Chain875 (created 2026-11-08T07:49:42Z · trigger customer_request · upstream version v1.9.1) [chains, chains #875]
- Requestbuild request #578 (rebuild) (requested at 2026-11-08T07:44:44Z · requested by kitforge-agent · version v1.9.1) [build_requests, build_requests #578]
- ReasonKubeVirt v1.9.1 r2 security set: golang.org/x/net v0.62.0 (GO-2026-6860/6866, CVE-2026-78661), PR #225 [build_requests, build_requests #578 request_reason]
- Supersedesreadystack/virtcontroller:v1.9.1-CE-debian12-r1 (chain 790) [chains, chains #790]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 875 release · ready_to_ship
Created 2026-11-08T07:49:42Z, upstream v1.9.1, build request 578 [chains, chains #875]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 3729 | 2026-11-08T07:50:13Z | 34.1 | build host 4 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3729] |
| 3733 | 2026-11-08T08:37:50Z | — | build host 4 publish-held | not recorded [drive_runs, drive_runs #3733] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-08T07:50:25Z | 2026-11-08T07:50:26Z | 1 | 4
|
order_json 74f643b1e3e4… |
acquire |
2026-11-08T07:50:34Z | 2026-11-08T07:50:36Z | 1 | 12
|
source_tree 725922dbd71a…license_file 5febf914b9f9…custody_inputs f4d09b8fbdb6…source_tree_hash 56992ab2c009…source_file_manifest 87636f1f4a64… |
plan |
2026-11-08T07:51:15Z | 2026-11-08T07:51:16Z | 1 | 10
|
recon_report 4689de8bdfa7…input_pin_plan 7326c8bd50cd…toolchain_lock 7ebd0ff65043… |
assemble_kit |
2026-11-08T07:59:24Z | 2026-11-08T07:59:25Z | 1 | 27
|
dockerfile 8af278e7417d…build_recipe cbb2e4a4cc1c…system_pinning 01ba4719c80b…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health adec92f6d8c7…verify_offline_sh 3e8184ea230c…base_image_digests 4acda0c088e7…dockerfile_offline 8af278e7417d…first_build_digest 624f3cb64791… |
remediate |
2026-11-08T08:00:11Z | 2026-11-08T08:00:12Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log c0069d92e542…security_report fdaa194a83f2… |
build_kit |
2026-11-08T08:12:19Z | 2026-11-08T08:12:20Z | 1 | 9
|
cosign_stamp 5a47cc7913d2…locked_digest 1b62c562e46a…freeze_manifest 75cf9c41cb4d…offline_rebuild_transcript a680c57446b9… |
verdict |
2026-11-08T08:12:56Z | 2026-11-08T08:12:56Z | 1 | 8
|
scout_verdict 236e5eede7b2… |
publish_image |
2026-11-08T08:13:25Z | 2026-11-08T08:13:26Z | 1 | 7
|
hub_readme 22a0ff995d71…promotion_record fdfcbaac0084… |
boot_instance |
2026-11-08T08:13:29Z | 2026-11-08T08:13:29Z | 1 | 3
|
instance_handle a8d5203ffa38… |
sbom |
2026-11-08T08:13:38Z | 2026-11-08T08:13:39Z | 1 | 5
|
sbom_md 5195bfce4cd7…sbom_json cd6759ccb7fa… |
schema_discovery |
2026-11-08T08:13:41Z | 2026-11-08T08:13:42Z | 1 | 7
|
schema_hash 1ce9814e9858…dependency_tree 731cf7ab7497…table_classification 9464805897b2… |
admin_handbook |
2026-11-08T08:13:45Z | 2026-11-08T08:13:45Z | 1 | 7
|
api_map c829d577635d…admin_handbook f739a1a60e53… |
db_handbook |
2026-11-08T08:13:48Z | 2026-11-08T08:13:49Z | 1 | 8
|
db_handbook 9929c2b85aaa…seed_isolation e4a74a0cde64… |
seed_data |
2026-11-08T08:13:51Z | 2026-11-08T08:13:52Z | 1 | 6
|
seed_data_sql 56ec92707259…seed_cases_json d09148082cf9… |
seed_validate |
2026-11-08T08:13:54Z | 2026-11-08T08:13:55Z | 1 | 3
|
seed_data_contract 3052464606ac… |
usecase_validate |
2026-11-08T08:13:58Z | 2026-11-08T08:13:58Z | 1 | 10
|
failed_tests 8772203e5553…passed_tests 31f7ca9d6ca8…test_results 93d37a85f8a9…usecase_contract a41c01df6186… |
finalize_docs |
2026-11-08T08:14:03Z | 2026-11-08T08:14:03Z | 1 | 9
|
defects_json e9abfc9c3b30…release_notes b1c5c383943b…api_integration_guide c09c413178cc… |
package_archive invalidated 2026-11-08T08:37:25Z |
2026-11-08T08:24:13Z | 2026-11-08T08:24:16Z | 1 | 34 (final gate PASS)
|
sale_tar 59b3969a85b2…checksums b374dc74b04d…verify_md aaa4b783c3ba…rebuild_md d9bee38015b7…manifest_txt f8717fdc7e44…actions_jsonl 3ec93281d394…provenance_md a2fe65527b69…assetchain_log_md e9eccaec0c0f…assetchain_log_json e121452efeff… |
[stage_runs]
Rewinds
- 2026-11-08T08:37:25Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #25596]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-08T08:24:16Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 7319 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 10729 | L-A08, L-038, L-036, L-034, L-032 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.67 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-08T08:25:54Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1487] | $0.67 | 3 rounds, $40.00 | 59b3969a85b2… |
Defects
Fully recorded- Ledger entries0 [defects, defects where product_slug=virtcontroller and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
0 ledger entries.
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:d19615aad99d9715a0cf91e41647795dac2d49ee7c2b6acc83d2fbed1c1212c5 · published digest sha256:d19615aad99d9715a0cf91e41647795dac2d49ee7c2b6acc83d2fbed1c1212c5 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 339) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T08:38:11Z · failing Docker Scout counts 3 packages with copyleft licences (GPL, LGPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T08:38:01Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3751969430 · transparency-log entry
- log index 3751970963 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3752489541 · transparency-log entry · integrated 2026-11-08T08:42:17Z) [ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:4d3bda37aecbdf99ff07c02f17978f8ee800179f0172981d17b0ac26ea9142ec · state attached · log index 3752494471 · transparency-log entry
- kind sbom · digest sha256:4d3bda37aecbdf99ff07c02f17978f8ee800179f0172981d17b0ac26ea9142ec · state attached · log index 3752496320 · transparency-log entry
- kind vsa · digest sha256:4d3bda37aecbdf99ff07c02f17978f8ee800179f0172981d17b0ac26ea9142ec · state attached · log index 3752498937 · transparency-log entry
- kind provenance · digest sha256:d19615aad99d9715a0cf91e41647795dac2d49ee7c2b6acc83d2fbed1c1212c5 · state attached · log index 3752501430 · transparency-log entry
- kind sbom · digest sha256:d19615aad99d9715a0cf91e41647795dac2d49ee7c2b6acc83d2fbed1c1212c5 · state attached · log index 3752503887 · transparency-log entry
- kind vsa · digest sha256:d19615aad99d9715a0cf91e41647795dac2d49ee7c2b6acc83d2fbed1c1212c5 · state attached · log index 3752507010 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/virtcontroller/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-08T08:26:02Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:d19615aad99d9715a0cf91e41647795dac2d49ee7c2b6acc83d2fbed1c1212c5 [clean-room rebuild ledger, runs[636]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-08T08:13:26Z [stage_runs, stage_runs chain 875 stage publish_image]
- Archive manifests written2026-11-08T08:40:30Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv2 (used v4 · baseline v2 · elf files 280 · probed 2026-11-08T08:06:24Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-08T08:43:58Z generated: by KitForge release/build_trail.py · generator commit a5797296229775110455db099d4b5aa29941c582
- 2026-11-08T08:45:36Z publication: promoted at 2026-11-08T08:44:37Z · promoted digest sha256:4d3bda37aecbdf99ff07c02f17978f8ee800179f0172981d17b0ac26ea9142ec · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 354 · checklist status complete · checklist at 2026-11-08T08:45:36Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/virtcontroller/v1.9.1-CE-debian12-r2/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/virtcontroller/v1.9.1-CE-debian12-r2/), as staged for publishing | — |
ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.rebuild.json | beside the archive (prodasset /data/production/virtcontroller/v1.9.1-CE-debian12-r2/), as staged for publishing | — |
ReadyStack-virtcontroller-v1.9.1-CE-debian12-r2.rebuild.json.sigstore | beside the archive (prodasset /data/production/virtcontroller/v1.9.1-CE-debian12-r2/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/virtcontroller/v1.9.1-CE-debian12-r2/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 578 |
chains | sadb, ReadyStack's engine database (not published) | 875 |
defects | sadb, ReadyStack's engine database (not published) | virtcontroller v1.9.1-CE-debian12-r2 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 875 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 875 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 875 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 875 |
release_images | sadb, ReadyStack's engine database (not published) | virtcontroller v1.9.1-CE-debian12-r2 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 875 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 875 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |