WireGuard 0.0.20250522-CE-ubuntu24.04-r2 build trail
How ReadyStack built readystack/wireguard:0.0.20250522-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/wireguard:0.0.20250522-CE-ubuntu24.04-r2 - Index digestsha256:4a8c6c1edca1bd8b08d5a621229c80a3d2fea48e84270e2f6842f5d8ddc5f506
- linux/amd64 digestsha256:d0d5392b6d8114de99080751263fe89e4a17ddb59805cbf4e50e4b68840f34a8
- Archive
ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.tar.gz - Archive SHA-256 now5fa4f4735b2c7213eaf95e2c9c58e4723041fe1cc7fb45d29aeec29e4ff6e2a9
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-07T08:26:37Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductWireGuard (wireguard) [MANIFEST.json]
- Release tag0.0.20250522-CE-ubuntu24.04-r2 [MANIFEST.json]
- Imagereadystack/wireguard:0.0.20250522-CE-ubuntu24.04-r2 [MANIFEST.json]
- Image index digestsha256:4a8c6c1edca1bd8b08d5a621229c80a3d2fea48e84270e2f6842f5d8ddc5f506 [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:d0d5392b6d8114de99080751263fe89e4a17ddb59805cbf4e50e4b68840f34a8 [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.tar.gz (bytes 446538248) [MANIFEST.json]
- Archive sha256 at publish5fa4f4735b2c7213eaf95e2c9c58e4723041fe1cc7fb45d29aeec29e4ff6e2a9 [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://git.zx2c4.com/wireguard-go [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream ref0.0.20250522 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commitf333402bd9cbe0f3eeb02507bd14e23d7d639280 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash2e29cb47cf21a63d63f493a69e65e0a53adc975d58337280681e571fb728dcd3 (files 107) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:a0202b8f22596c892b4edd6046b6a9133d5644930e8c26a70febdfcc832d5bbd [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1747871102 (utc 2025-05-21T23:45:02Z) [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
- ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.rebuild.json, engine]
- Engine commit(s)
- commit 0640ae3d5c24dd6ccf85da33ada7ba9659eea77c · dirty yes · first drive 3576
- commit 0185b65902e7de72275f275e796ced5f2061c824 · dirty yes · first drive 3622
Why this release exists
Fully recorded- Chain846 (created 2026-11-07T05:10:12Z · trigger customer_request · upstream version 0.0.20250522) [chains, chains #846]
- Requestbuild request #525 (rebuild) (requested at 2026-11-07T02:01:49Z · requested by kitforge-agent · version 0.0.20250522) [build_requests, build_requests #525]
- Reasonrerelease agenda REVISION -> 0.0.20250522-CE-ubuntu24.04-r2 (decay loop, IMP-08) [build_requests, build_requests #525 request_reason]
- Supersedesreadystack/wireguard:0.0.20250522-CE-ubuntu24.04-r1 (chain 767) [chains, chains #767]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 846 release · ready_to_ship
Created 2026-11-07T05:10:12Z, upstream 0.0.20250522, build request 525 [chains, chains #846]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 3576 | 2026-11-07T05:10:31Z | 10 | build host 4 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3576] |
| 3622 | 2026-11-07T08:22:36Z | — | build host 4 publish-held | not recorded [drive_runs, drive_runs #3622] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-07T05:10:41Z | 2026-11-07T05:10:42Z | 1 | 4
|
order_json bb57b6b44142… |
acquire |
2026-11-07T05:10:46Z | 2026-11-07T05:10:47Z | 1 | 12
|
source_tree 5e81f219d5f3…license_file 91276db973f2…custody_inputs 2a064ac7e7f6…source_tree_hash 24e629f34e56…source_file_manifest c4bbf20b868e… |
plan |
2026-11-07T05:11:12Z | 2026-11-07T05:11:13Z | 1 | 10
|
recon_report 2e2f06838e7b…input_pin_plan 56105f1ca028…toolchain_lock a767a781a856… |
assemble_kit |
2026-11-07T05:12:21Z | 2026-11-07T05:12:22Z | 1 | 27
|
dockerfile 272e589b11d7…build_recipe 18c1a920be4a…system_pinning 841a12bde79b…build_offline_sh 6633aa31b6b4…generate_sbom_sh ce0f1e6f1e70…first_boot_health baa4d8592ad7…verify_offline_sh 3e8184ea230c…base_image_digests 2438669402e1…dockerfile_offline 272e589b11d7…first_build_digest dc914230eb60… |
remediate |
2026-11-07T05:12:44Z | 2026-11-07T05:12:45Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 1b580ed4bf2e…security_report e8e503e0ede6… |
build_kit |
2026-11-07T05:14:46Z | 2026-11-07T05:14:47Z | 1 | 9
|
cosign_stamp 5c133bce6128…locked_digest 515a9cdd952b…freeze_manifest 450039031947…offline_rebuild_transcript 7eaec8e81d6d… |
verdict |
2026-11-07T05:15:23Z | 2026-11-07T05:15:24Z | 1 | 8
|
scout_verdict 875fc17e2b46… |
publish_image |
2026-11-07T05:15:57Z | 2026-11-07T05:15:58Z | 1 | 7
|
hub_readme 032b4d3c87ae…promotion_record 681cd47a7d3a… |
boot_instance |
2026-11-07T05:16:03Z | 2026-11-07T05:16:06Z | 2 | 3
|
instance_handle f0ac0f7e204b… |
sbom |
2026-11-07T05:16:16Z | 2026-11-07T05:16:17Z | 1 | 5
|
sbom_md e011f0d6c95b…sbom_json fe85e388e29e… |
schema_discovery |
2026-11-07T05:16:20Z | 2026-11-07T05:16:20Z | 1 | 7
|
schema_hash 013af02c8980…dependency_tree 9fdf899f2966…table_classification a9bc8d64545a… |
admin_handbook |
2026-11-07T05:16:26Z | 2026-11-07T05:16:27Z | 1 | 7
|
api_map 91775f2b2366…admin_handbook 60f74c41c9d9… |
db_handbook |
2026-11-07T05:16:34Z | 2026-11-07T05:16:35Z | 1 | 8
|
db_handbook 73e7304eb4ea…seed_isolation a98840b12b40… |
seed_data |
2026-11-07T05:16:41Z | 2026-11-07T05:16:42Z | 1 | 6
|
seed_data_sql c860d4a93108…seed_cases_json 4c91039cbb11… |
seed_validate |
2026-11-07T05:16:45Z | 2026-11-07T05:16:45Z | 1 | 3
|
seed_data_contract 23e201695cb6… |
usecase_validate |
2026-11-07T05:17:02Z | 2026-11-07T05:17:03Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests c64a9f673ea1…test_results 799a108f1875…usecase_contract 03b953c2b55e… |
finalize_docs |
2026-11-07T05:17:08Z | 2026-11-07T05:17:09Z | 1 | 9
|
defects_json a01f9b11df54…release_notes d95c8ce9d6f2…api_integration_guide 346e5f4a93eb… |
package_archive invalidated 2026-11-07T08:22:10Z |
2026-11-07T05:20:26Z | 2026-11-07T05:20:28Z | 1 | 34 (final gate PASS)
|
sale_tar 6be15dcbd660…checksums ae06c063576e…verify_md da027317349a…rebuild_md 13576940f6e7…manifest_txt 496345ca3808…actions_jsonl 5573862d06d3…provenance_md a105f9d7f379…assetchain_log_md e9eccaec0c0f…assetchain_log_json 8a06dac9da6a… |
[stage_runs]
Rewinds
- 2026-11-07T08:22:10Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #24297]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-07T05:20:28Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 5797 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 6004 | L-A183, L-A15 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.43 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-07T05:21:01Z | 0 | 0 | 1 | clean to publish [held_rounds, held_rounds #1437] | $0.43 | 3 rounds, $40.00 | 6be15dcbd660… |
Defects
Fully recorded- Ledger entries1 [defects, defects where product_slug=wireguard and this tag or chain]
- Disclosed in the archive1 [docs/defects/defects.json, entries]
1 ledger entry: by severity low 1; by status fixed-before-release 1.
| Defect | Severity | Status | Found by | Fixed in |
|---|---|---|---|---|
RSD-wireguard-dec500d683Docker Hub README: Live peer addition offered without saying it is not persistent. [defects, defects #162546] | low | fixed-before-release | held review (review model) | — |
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:d0d5392b6d8114de99080751263fe89e4a17ddb59805cbf4e50e4b68840f34a8 · published digest sha256:d0d5392b6d8114de99080751263fe89e4a17ddb59805cbf4e50e4b68840f34a8 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 51) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, trademark_shipped, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-07T08:22:59Z · failing Docker Scout counts 91 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-07T08:22:47Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3730219036 · transparency-log entry
- log index 3730219779 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3733489051 · transparency-log entry · integrated 2026-11-07T08:25:29Z) [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:4a8c6c1edca1bd8b08d5a621229c80a3d2fea48e84270e2f6842f5d8ddc5f506 · state attached · log index 3733490856 · transparency-log entry
- kind sbom · digest sha256:4a8c6c1edca1bd8b08d5a621229c80a3d2fea48e84270e2f6842f5d8ddc5f506 · state attached · log index 3733492454 · transparency-log entry
- kind vsa · digest sha256:4a8c6c1edca1bd8b08d5a621229c80a3d2fea48e84270e2f6842f5d8ddc5f506 · state attached · log index 3733494180 · transparency-log entry
- kind provenance · digest sha256:d0d5392b6d8114de99080751263fe89e4a17ddb59805cbf4e50e4b68840f34a8 · state attached · log index 3733495660 · transparency-log entry
- kind sbom · digest sha256:d0d5392b6d8114de99080751263fe89e4a17ddb59805cbf4e50e4b68840f34a8 · state attached · log index 3733497062 · transparency-log entry
- kind vsa · digest sha256:d0d5392b6d8114de99080751263fe89e4a17ddb59805cbf4e50e4b68840f34a8 · state attached · log index 3733498934 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/wireguard/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-07T05:21:04Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:d0d5392b6d8114de99080751263fe89e4a17ddb59805cbf4e50e4b68840f34a8 [clean-room rebuild ledger, runs[609]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-07T05:15:58Z [stage_runs, stage_runs chain 846 stage publish_image]
- Archive manifests written2026-11-07T08:24:13Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 752 · probed 2026-11-07T05:13:39Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-07T08:26:37Z generated: by KitForge release/build_trail.py · generator commit 7ef80b962831a5d2b4b7f2ab3f3543ad393c660a
- 2026-11-07T08:27:44Z publication: promoted at 2026-11-07T08:27:06Z · promoted digest sha256:4a8c6c1edca1bd8b08d5a621229c80a3d2fea48e84270e2f6842f5d8ddc5f506 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 341 · checklist status complete · checklist at 2026-11-07T08:27:44Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r2/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r2/), as staged for publishing | — |
ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.rebuild.json | beside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r2/), as staged for publishing | — |
ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r2.rebuild.json.sigstore | beside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r2/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r2/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 525 |
chains | sadb, ReadyStack's engine database (not published) | 846 |
defects | sadb, ReadyStack's engine database (not published) | wireguard 0.0.20250522-CE-ubuntu24.04-r2 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 846 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 846 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 846 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 846 |
release_images | sadb, ReadyStack's engine database (not published) | wireguard 0.0.20250522-CE-ubuntu24.04-r2 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 846 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 846 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |