virt-operator v1.9.1-CE-debian12-r2 build trail
How ReadyStack built readystack/virtoperator:v1.9.1-CE-debian12-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/virtoperator:v1.9.1-CE-debian12-r2 - Index digestsha256:c7cb0c36ad11555a5d7a0fd4d104f331eaa60a76599069a7f55cc836b8bc5079
- linux/amd64 digestsha256:be9ccc3a11c3ebcf9701ce573df96a8140dd7d4d41be5d747bde72729ea3fe78
- Archive
ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.tar.gz - Archive SHA-256 nowd52e3136be1acd3b50ffe3a03d0497d36eaf93f9e2d0ffcad290ad27356a19bc
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-08T09:16:51Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.trail.json.sigstore ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- Productvirt-operator (virtoperator) [MANIFEST.json]
- Release tagv1.9.1-CE-debian12-r2 [MANIFEST.json]
- Imagereadystack/virtoperator:v1.9.1-CE-debian12-r2 [MANIFEST.json]
- Image index digestsha256:c7cb0c36ad11555a5d7a0fd4d104f331eaa60a76599069a7f55cc836b8bc5079 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:be9ccc3a11c3ebcf9701ce573df96a8140dd7d4d41be5d747bde72729ea3fe78 [ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-virtoperator-v1.9.1-CE-debian12-r2.tar.gz (bytes 1173361973) [MANIFEST.json]
- Archive sha256 at publishd52e3136be1acd3b50ffe3a03d0497d36eaf93f9e2d0ffcad290ad27356a19bc [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://github.com/kubevirt/kubevirt [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream refv1.9.1 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commitc3d19093f9c7b843b3879b18dc088911c081c39e [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hashde7abf04e51b6cf004d0365dfe6d8c5251edeeb69bfa0caa3d8b366b85fe6f36 (files 12717) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:885a60b39a44b82d2e5a944cfeaa8a490c8e21fbde58708d6be41675d7d2e990 [ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1791523273 (utc 2026-10-09T05:21:13Z) [ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.rebuild.json, inputs.source_date_epoch]
- Base images
- ref quay.io/kubevirt/builder:2606231619-4fe2cd536f@sha256:a48a7dd5a1b80602269b8c714fdaa54f729a9a4a4d096f7ee0d15c94cef343e8 · platform digest sha256:a48a7dd5a1b80602269b8c714fdaa54f729a9a4a4d096f7ee0d15c94cef343e8
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.rebuild.json, engine]
- Engine commit(s)
- commit ca87f22b0bc07284fe7d35ddd7b8fced30d8dfd5 · dirty yes · first drive 3727
- commit 652df6e0e6aa50b44c0f12948b3d5baab047fc1f · dirty yes · first drive 3739
Why this release exists
Fully recorded- Chain873 (created 2026-11-08T07:47:46Z · trigger customer_request · upstream version v1.9.1) [chains, chains #873]
- Requestbuild request #576 (rebuild) (requested at 2026-11-08T07:44:41Z · requested by kitforge-agent · version v1.9.1) [build_requests, build_requests #576]
- ReasonKubeVirt v1.9.1 r2 security set: golang.org/x/net v0.62.0 (GO-2026-6860/6866, CVE-2026-78661), PR #225 [build_requests, build_requests #576 request_reason]
- Supersedesreadystack/virtoperator:v1.9.1-CE-debian12-r1 (chain 784) [chains, chains #784]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 873 release · ready_to_ship
Created 2026-11-08T07:47:46Z, upstream v1.9.1, build request 576 [chains, chains #873]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 3727 | 2026-11-08T07:48:15Z | 40 | build host 3 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3727] |
| 3739 | 2026-11-08T09:10:32Z | — | build host 3 publish-held | not recorded [drive_runs, drive_runs #3739] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-08T07:48:26Z | 2026-11-08T07:48:27Z | 1 | 4
|
order_json 26277c1296e5… |
acquire |
2026-11-08T07:48:36Z | 2026-11-08T07:48:37Z | 1 | 12
|
source_tree 725922dbd71a…license_file 5febf914b9f9…custody_inputs 9a8dd51f2f26…source_tree_hash 88b570c0f69e…source_file_manifest 31fc6c388e5c… |
plan |
2026-11-08T07:49:13Z | 2026-11-08T07:49:14Z | 1 | 10
|
recon_report 7a016eff053b…input_pin_plan b31275f40f68…toolchain_lock 889fe63bf94f… |
assemble_kit |
2026-11-08T07:59:24Z | 2026-11-08T07:59:25Z | 1 | 27
|
dockerfile 4140755b1368…build_recipe 806274826a32…system_pinning 01ba4719c80b…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health 5536d1f5dccb…verify_offline_sh 3e8184ea230c…base_image_digests a455fc90be98…dockerfile_offline 4140755b1368…first_build_digest 6c6cbe3ab988… |
remediate |
2026-11-08T08:00:12Z | 2026-11-08T08:00:12Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log f7c4ea8237a8…security_report eb539a036192… |
build_kit |
2026-11-08T08:14:57Z | 2026-11-08T08:14:58Z | 1 | 9
|
cosign_stamp 9ed47e226e5e…locked_digest 54c42b965f45…freeze_manifest d394676469fc…offline_rebuild_transcript 0dd5341568f4… |
verdict |
2026-11-08T08:15:34Z | 2026-11-08T08:15:35Z | 1 | 8
|
scout_verdict dd89ab10ee42… |
publish_image |
2026-11-08T08:16:09Z | 2026-11-08T08:16:10Z | 1 | 7
|
hub_readme aae3ab0a29a5…promotion_record 9ccf81e2f2da… |
boot_instance |
2026-11-08T08:16:12Z | 2026-11-08T08:16:13Z | 1 | 3
|
instance_handle c9e89d1f311a… |
sbom |
2026-11-08T08:16:24Z | 2026-11-08T08:16:25Z | 1 | 5
|
sbom_md 6798de1ccaff…sbom_json fe8cf0f52791… |
schema_discovery |
2026-11-08T08:16:27Z | 2026-11-08T08:16:28Z | 1 | 7
|
schema_hash fbeb37a21e65…dependency_tree d0eb7c37766d…table_classification f07ca6deb29b… |
admin_handbook |
2026-11-08T08:16:31Z | 2026-11-08T08:16:31Z | 1 | 7
|
api_map 6c6580e1f855…admin_handbook 350f8fa01e2d… |
db_handbook |
2026-11-08T08:16:34Z | 2026-11-08T08:16:35Z | 1 | 8
|
db_handbook 8ff409839cee…seed_isolation 2293f10ddb0b… |
seed_data |
2026-11-08T08:16:37Z | 2026-11-08T08:16:38Z | 1 | 6
|
seed_data_sql d051f67cbcef…seed_cases_json a4da9470c626… |
seed_validate |
2026-11-08T08:16:40Z | 2026-11-08T08:16:41Z | 1 | 3
|
seed_data_contract 670aa66da23d… |
usecase_validate |
2026-11-08T08:16:43Z | 2026-11-08T08:16:44Z | 1 | 10
|
failed_tests fb242aa9d8bb…passed_tests c2d96de8fe62…test_results 8ea31369744a…usecase_contract 87b9b2477b7c… |
finalize_docs |
2026-11-08T08:16:48Z | 2026-11-08T08:16:49Z | 1 | 9
|
defects_json 1a931234aba9…release_notes fb19313269ed…api_integration_guide 6006437a3f09… |
package_archive invalidated 2026-11-08T09:09:59Z |
2026-11-08T08:28:11Z | 2026-11-08T08:28:15Z | 1 | 34 (final gate PASS)
|
sale_tar d19d5db3fc62…checksums b79e951e247a…verify_md 2122ee184f0a…rebuild_md ef2a1180b3c0…manifest_txt 4332adfb25a5…actions_jsonl b0bd8212cc0d…provenance_md bfadfa1c198f…assetchain_log_md e9eccaec0c0f…assetchain_log_json 59489837c626… |
[stage_runs]
Rewinds
- 2026-11-08T09:09:59Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #25685]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-08T08:28:15Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 7052 | — |
remediate | 2 | 0 | 0 | 1 | 0 | 11004 | L-A08, L-038, L-036, L-034, L-032 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.76 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-08T08:29:20Z | 0 | 0 | 1 | clean to publish [held_rounds, held_rounds #1489] | $0.76 | 3 rounds, $40.00 | d19d5db3fc62… |
Defects
Fully recorded- Ledger entries1 [defects, defects where product_slug=virtoperator and this tag or chain]
- Disclosed in the archive1 [docs/defects/defects.json, entries]
1 ledger entry: by severity low 1; by status open 1.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-virtoperator-bbfc62adc3Release notes: Runtime user is given only by name in the release notes, while every other record gives uid 1001; the name is correct (uid 1001 = nonroot-user in the image) but the number customers need for… [defects, defects #173147] | low | open | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:be9ccc3a11c3ebcf9701ce573df96a8140dd7d4d41be5d747bde72729ea3fe78 · published digest sha256:be9ccc3a11c3ebcf9701ce573df96a8140dd7d4d41be5d747bde72729ea3fe78 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 420) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-08T09:10:55Z · failing Docker Scout counts 3 packages with copyleft licences (GPL, LGPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-08T09:10:44Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3752027628 · transparency-log entry
- log index 3752030189 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3753079581 · transparency-log entry · integrated 2026-11-08T09:15:11Z) [ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:c7cb0c36ad11555a5d7a0fd4d104f331eaa60a76599069a7f55cc836b8bc5079 · state attached · log index 3753084103 · transparency-log entry
- kind sbom · digest sha256:c7cb0c36ad11555a5d7a0fd4d104f331eaa60a76599069a7f55cc836b8bc5079 · state attached · log index 3753085089 · transparency-log entry
- kind vsa · digest sha256:c7cb0c36ad11555a5d7a0fd4d104f331eaa60a76599069a7f55cc836b8bc5079 · state attached · log index 3753085677 · transparency-log entry
- kind provenance · digest sha256:be9ccc3a11c3ebcf9701ce573df96a8140dd7d4d41be5d747bde72729ea3fe78 · state attached · log index 3753086333 · transparency-log entry
- kind sbom · digest sha256:be9ccc3a11c3ebcf9701ce573df96a8140dd7d4d41be5d747bde72729ea3fe78 · state attached · log index 3753087379 · transparency-log entry
- kind vsa · digest sha256:be9ccc3a11c3ebcf9701ce573df96a8140dd7d4d41be5d747bde72729ea3fe78 · state attached · log index 3753089583 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/virtoperator/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-08T08:29:28Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:be9ccc3a11c3ebcf9701ce573df96a8140dd7d4d41be5d747bde72729ea3fe78 [clean-room rebuild ledger, runs[637]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-08T08:16:10Z [stage_runs, stage_runs chain 873 stage publish_image]
- Archive manifests written2026-11-08T09:13:20Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv2 (used v4 · baseline v2 · elf files 281 · probed 2026-11-08T08:07:39Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-08T09:16:51Z generated: by KitForge release/build_trail.py · generator commit 652df6e0e6aa50b44c0f12948b3d5baab047fc1f
- 2026-11-08T09:18:31Z publication: promoted at 2026-11-08T09:17:30Z · promoted digest sha256:c7cb0c36ad11555a5d7a0fd4d104f331eaa60a76599069a7f55cc836b8bc5079 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 356 · checklist status complete · checklist at 2026-11-08T09:18:31Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/virtoperator/v1.9.1-CE-debian12-r2/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/virtoperator/v1.9.1-CE-debian12-r2/), as staged for publishing | — |
ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.rebuild.json | beside the archive (prodasset /data/production/virtoperator/v1.9.1-CE-debian12-r2/), as staged for publishing | — |
ReadyStack-virtoperator-v1.9.1-CE-debian12-r2.rebuild.json.sigstore | beside the archive (prodasset /data/production/virtoperator/v1.9.1-CE-debian12-r2/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/virtoperator/v1.9.1-CE-debian12-r2/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 576 |
chains | sadb, ReadyStack's engine database (not published) | 873 |
defects | sadb, ReadyStack's engine database (not published) | virtoperator v1.9.1-CE-debian12-r2 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 873 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 873 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 873 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 873 |
release_images | sadb, ReadyStack's engine database (not published) | virtoperator v1.9.1-CE-debian12-r2 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 873 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 873 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |