WireGuard 0.0.20250522-CE-ubuntu24.04-r5 build trail
How ReadyStack built readystack/wireguard:0.0.20250522-CE-ubuntu24.04-r5 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.
This trail
As JSON- Image
readystack/wireguard:0.0.20250522-CE-ubuntu24.04-r5 - Index digestsha256:bd92edd6870fd3f2605e152256f8779eb749ee79c3e272fc9999fe725029988c
- linux/amd64 digestsha256:530486d8de2f90ce13092e20179ece5530d40185676e18a21410f66bbc1f20b9
- Archive
ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.tar.gz - Archive SHA-256 now66c80533739bf6f57bbd2ff8f0c8a433f527ed85960924988ba48593db39418b
- Pins record
docs/PINS.md,docs/provenance/PINS.jsonin the archive (since generated) - Generated2026-11-12T23:45:48Z by KitForge release/build_trail.py
- Sections9 sections, 8 fully recorded; 1 item not recorded
Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:
cosign verify-blob --key https://readystack.dev/keys/cosign.pub \ --bundle ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.trail.json.sigstore ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.trail.json
IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level
Identity
Fully recorded- ProductWireGuard (wireguard) [MANIFEST.json]
- Release tag0.0.20250522-CE-ubuntu24.04-r5 [MANIFEST.json]
- Imagereadystack/wireguard:0.0.20250522-CE-ubuntu24.04-r5 [MANIFEST.json]
- Image index digestsha256:bd92edd6870fd3f2605e152256f8779eb749ee79c3e272fc9999fe725029988c [docs/provenance/LOCKED_DIGEST.txt]
- linux/amd64 image digestsha256:530486d8de2f90ce13092e20179ece5530d40185676e18a21410f66bbc1f20b9 [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.rebuild.json, subject.image_manifest_digest]
- ArchiveReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.tar.gz (bytes 466144747) [MANIFEST.json]
- Archive sha256 at publish66c80533739bf6f57bbd2ff8f0c8a433f527ed85960924988ba48593db39418b [MANIFEST.json, tarball_sha256]
- Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
- Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
- Upstream repositoryhttps://git.zx2c4.com/wireguard-go [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream ref0.0.20250522 [docs/provenance/SOURCE_TREE_HASH.json]
- Upstream commitf333402bd9cbe0f3eeb02507bd14e23d7d639280 [docs/provenance/SOURCE_TREE_HASH.json]
- Source tree hash2e29cb47cf21a63d63f493a69e65e0a53adc975d58337280681e571fb728dcd3 (files 107) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
- Kit tree hashsha256:d8baf923e8cf90841dfe269d7cecc2fd4cb4d31c4870a21fa1e23ffb496d33f1 [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.rebuild.json, inputs.tree_hash]
- SOURCE_DATE_EPOCH1794451831 (utc 2026-11-12T02:50:31Z) [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.rebuild.json, inputs.source_date_epoch]
- Base images
- ref golang:1.27.4-bookworm@sha256:4fa7c968ba93f1635670522dbb01a2c78150443e1385746924566079f36570ea · platform digest sha256:fb7cceb528b47141eccd9b60bf3cbd27d5ef5f8cf5b7d338bec866da495b50dc
- ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
- BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.rebuild.json, engine]
- Engine commit(s)
- commit f90b852f37265087900c9acdca31849ac5b61408 · dirty yes · first drive 4506
Why this release exists
Fully recorded- Chain1048 (created 2026-11-12T23:25:49Z · trigger customer_request · upstream version 0.0.20250522) [chains, chains #1048]
- Requestbuild request #731 (rebuild) (requested at 2026-11-12T02:50:33Z · requested by kitforge-agent · version 0.0.20250522) [build_requests, build_requests #731]
- Reasonrevision 0.0.20250522-CE-ubuntu24.04-r5: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #731 request_reason]
- Supersedesreadystack/wireguard:0.0.20250522-CE-ubuntu24.04-r4 (chain 944) [chains, chains #944]
The path through the harness
Fully recorded1 chain · 2 drives · 18 stages · 1 rewind
Chain 1048 release · ready_to_ship
Created 2026-11-12T23:25:49Z, upstream 0.0.20250522, build request 731 [chains, chains #1048]
| Drive | Started | Minutes | Build host | How it stopped |
|---|---|---|---|---|
| 4506 | 2026-11-12T23:26:14Z | 10.2 | build host 3 withhold-publish | ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4506] |
| 4508 | 2026-11-12T23:41:46Z | — | build host 3 publish-held | not recorded [drive_runs, drive_runs #4508] |
Stages, in order
| Stage | First start | Passed | Attempts | Gate checks passed | Artifacts (SHA-256) |
|---|---|---|---|---|---|
intake |
2026-11-12T23:26:25Z | 2026-11-12T23:26:26Z | 1 | 4
|
order_json 114cc92e2e8a… |
acquire |
2026-11-12T23:26:31Z | 2026-11-12T23:26:31Z | 1 | 12
|
source_tree 5e81f219d5f3…license_file 91276db973f2…custody_inputs 2a064ac7e7f6…source_tree_hash 24e629f34e56…source_file_manifest c4bbf20b868e… |
plan |
2026-11-12T23:26:57Z | 2026-11-12T23:26:58Z | 1 | 10
|
recon_report fb22270dfc21…input_pin_plan f63e5531316c…toolchain_lock 4e0f9b9a5826… |
assemble_kit |
2026-11-12T23:28:22Z | 2026-11-12T23:28:23Z | 1 | 27
|
dockerfile 9e7a46bf1181…build_recipe aee5aa377e49…system_pinning aa8db05a9a8a…build_offline_sh 6ab4f08a6ec7…generate_sbom_sh ce0f1e6f1e70…first_boot_health d609f0123741…verify_offline_sh 3e8184ea230c…base_image_digests 3c92e2de3df7…dockerfile_offline 9e7a46bf1181…first_build_digest 1e7d8981c3d8… |
remediate |
2026-11-12T23:28:47Z | 2026-11-12T23:28:47Z | 1 | 8
|
vendored_apt e3b0c44298fc…remediation_log 5cd00a9e1d2e…security_report 8645b77dafdb… |
build_kit |
2026-11-12T23:30:53Z | 2026-11-12T23:30:53Z | 1 | 9
|
cosign_stamp 8fb7449192d7…locked_digest 27f46f4bb61c…freeze_manifest 14ca492973d8…offline_rebuild_transcript 9b835f510572… |
verdict |
2026-11-12T23:31:21Z | 2026-11-12T23:31:22Z | 1 | 8
|
scout_verdict 146b5b12d055… |
publish_image |
2026-11-12T23:31:52Z | 2026-11-12T23:31:53Z | 1 | 7
|
hub_readme a3372645a1f5…promotion_record b4968a47be69… |
boot_instance |
2026-11-12T23:31:58Z | 2026-11-12T23:32:03Z | 2 | 3
|
instance_handle 112ff9fa38a9… |
sbom |
2026-11-12T23:32:11Z | 2026-11-12T23:32:11Z | 1 | 5
|
sbom_md 09e9808c3371…sbom_json baa2b883ffcb… |
schema_discovery |
2026-11-12T23:32:14Z | 2026-11-12T23:32:15Z | 1 | 7
|
schema_hash 013af02c8980…dependency_tree 9fdf899f2966…table_classification a9bc8d64545a… |
admin_handbook |
2026-11-12T23:32:21Z | 2026-11-12T23:32:22Z | 1 | 7
|
api_map 91775f2b2366…admin_handbook dc7745258e7d… |
db_handbook |
2026-11-12T23:32:30Z | 2026-11-12T23:32:31Z | 1 | 8
|
db_handbook 79e11911269c…seed_isolation a98840b12b40… |
seed_data |
2026-11-12T23:32:37Z | 2026-11-12T23:32:38Z | 1 | 6
|
seed_data_sql c860d4a93108…seed_cases_json cf09743af05c… |
seed_validate |
2026-11-12T23:32:40Z | 2026-11-12T23:32:41Z | 1 | 3
|
seed_data_contract 6e1b21e5268a… |
usecase_validate |
2026-11-12T23:32:58Z | 2026-11-12T23:32:59Z | 1 | 10
|
failed_tests b2247b16f5f7…passed_tests c64a9f673ea1…test_results 799a108f1875…usecase_contract 97c4f6de9885… |
finalize_docs |
2026-11-12T23:33:03Z | 2026-11-12T23:33:04Z | 1 | 9
|
defects_json c5a2d1f2dc7f…release_notes 640c98f5bae5…api_integration_guide 1549fd7fa275… |
package_archive invalidated 2026-11-12T23:41:22Z |
2026-11-12T23:36:26Z | 2026-11-12T23:36:28Z | 1 | 37 (final gate PASS)
|
sale_tar 4181593c1091…checksums 175cfeccd69c…verify_md d1a642c33b21…rebuild_md 87dbd215cc7d…manifest_txt 91070c1a9a5b…actions_jsonl 160af4df5241…provenance_md 12a1c094e5d5…assetchain_log_md e9eccaec0c0f…assetchain_log_json c9040e5639c6… |
[stage_runs]
Rewinds
- 2026-11-12T23:41:22Z:
package_archivetopackage_archiveon docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #34955]
Model work per stage
Fully recordedRole: writer model. Calls up to 2026-11-12T23:36:28Z.
4 calls over 2 stages
| Stage | Calls | Refused | Errors | Max attempt | Forced commits | Real tokens | Lesson rules shown |
|---|---|---|---|---|---|---|---|
plan | 2 | 0 | 0 | 1 | 0 | 5961 | L-A183, L-A15 |
remediate | 2 | 0 | 0 | 1 | 0 | 6221 | L-A183, L-A15 |
[micro_step_runs] [lesson_recalls]
Review
Fully recordedRole: review model.
1 round, 1 counted, $0.23 recorded cost
| Round | Started | Critical | Major | Minor | Verdict | Cost | Cap in force | Archive reviewed |
|---|---|---|---|---|---|---|---|---|
| 1 | 2026-11-12T23:36:59Z | 0 | 0 | 0 | clean to publish [held_rounds, held_rounds #1844] | $0.23 | 3 rounds, $40.00 | 4181593c1091… |
Defects
Fully recorded- Ledger entries0 [defects, defects where product_slug=wireguard and this tag or chain]
- Disclosed in the archive0 [docs/defects/defects.json, entries]
0 ledger entries.
Verification
1 item not recorded- Reproduced before publishingyes (rebuilt digest sha256:530486d8de2f90ce13092e20179ece5530d40185676e18a21410f66bbc1f20b9 · published digest sha256:530486d8de2f90ce13092e20179ece5530d40185676e18a21410f66bbc1f20b9 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 60) [docs/provenance/REPRO_VERIFICATION.json, verified]
- Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
- Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-12T23:42:06Z · failing Docker Scout counts 37 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
- Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-12T23:41:56Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
- Image signature transparency-log entries
- log index 3841270611 · transparency-log entry
- log index 3841270861 · transparency-log entry
- rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3841332397 · transparency-log entry · integrated 2026-11-12T23:44:23Z) [ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
- Signed attestations
- kind provenance · digest sha256:bd92edd6870fd3f2605e152256f8779eb749ee79c3e272fc9999fe725029988c · state attached · log index 3841333255 · transparency-log entry
- kind sbom · digest sha256:bd92edd6870fd3f2605e152256f8779eb749ee79c3e272fc9999fe725029988c · state attached · log index 3841334054 · transparency-log entry
- kind vsa · digest sha256:bd92edd6870fd3f2605e152256f8779eb749ee79c3e272fc9999fe725029988c · state attached · log index 3841335019 · transparency-log entry
- kind provenance · digest sha256:530486d8de2f90ce13092e20179ece5530d40185676e18a21410f66bbc1f20b9 · state attached · log index 3841335761 · transparency-log entry
- kind sbom · digest sha256:530486d8de2f90ce13092e20179ece5530d40185676e18a21410f66bbc1f20b9 · state attached · log index 3841336222 · transparency-log entry
- kind vsa · digest sha256:530486d8de2f90ce13092e20179ece5530d40185676e18a21410f66bbc1f20b9 · state attached · log index 3841337103 · transparency-log entry
- Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/wireguard/recipe) [docs/provenance/PINS.json]
Offline clean-room rebuilds
- 2026-11-12T23:37:04Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
rebuilt sha256:530486d8de2f90ce13092e20179ece5530d40185676e18a21410f66bbc1f20b9 [clean-room rebuild ledger, runs[811]]
- Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
Publication
Fully recorded 1 pending at generation- Image pushed (internal tag), publish_image passed2026-11-12T23:31:53Z [stage_runs, stage_runs chain 1048 stage publish_image]
- Archive manifests written2026-11-12T23:43:19Z [PUBLISH_MANIFEST.json, published_at]
- Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)
Packages and CPU level
Fully recorded- x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 126 · probed 2026-11-12T23:29:36Z · source build_kit) [release_images, isa_level_hard]
History
2 events- 2026-11-12T23:45:48Z generated: by KitForge release/build_trail.py · generator commit f90b852f37265087900c9acdca31849ac5b61408
- 2026-11-12T23:47:08Z publication: promoted at 2026-11-12T23:46:28Z · promoted digest sha256:bd92edd6870fd3f2605e152256f8779eb749ee79c3e272fc9999fe725029988c · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 525 · checklist status complete · checklist at 2026-11-12T23:47:08Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json
Records
25 records| Record | Where it is | Rows |
|---|---|---|
docs/defects/defects.json | inside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.tar.gz) | — |
docs/provenance/IMAGE_EVIDENCE.json | inside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.tar.gz) | — |
docs/provenance/LOCKED_DIGEST.txt | inside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.tar.gz) | — |
docs/provenance/PINS.json | inside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.tar.gz) | — |
docs/provenance/REPRO_VERIFICATION.json | inside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.tar.gz) | — |
docs/provenance/SOURCE_TREE_HASH.json | inside the archive (ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.tar.gz) | — |
MANIFEST.json | beside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r5/), as staged for publishing | — |
PUBLISH_MANIFEST.json | beside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r5/), as staged for publishing | — |
ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.rebuild.json | beside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r5/), as staged for publishing | — |
ReadyStack-wireguard-0.0.20250522-CE-ubuntu24.04-r5.rebuild.json.sigstore | beside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r5/), as staged for publishing | — |
SCOUT_EVIDENCE.json | beside the archive (prodasset /data/production/wireguard/0.0.20250522-CE-ubuntu24.04-r5/), as staged for publishing | — |
clean-room rebuild ledger | the clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published) | — |
build_requests | sadb, ReadyStack's engine database (not published) | 731 |
chains | sadb, ReadyStack's engine database (not published) | 1048 |
defects | sadb, ReadyStack's engine database (not published) | wireguard 0.0.20250522-CE-ubuntu24.04-r5 |
drive_runs | sadb, ReadyStack's engine database (not published) | chain 1048 |
held_rounds | sadb, ReadyStack's engine database (not published) | chain 1048 |
lesson_recalls | sadb, ReadyStack's engine database (not published) | chain 1048 |
micro_step_runs | sadb, ReadyStack's engine database (not published) | chain 1048 |
release_images | sadb, ReadyStack's engine database (not published) | wireguard 0.0.20250522-CE-ubuntu24.04-r5 |
stage_events | sadb, ReadyStack's engine database (not published) | chain 1048 |
stage_runs | sadb, ReadyStack's engine database (not published) | chain 1048 |
attestations.json | the chain's workspace on the controller (not published) | — |
deliverables/provenance/PROMOTION_RECORD.json | the chain's workspace on the controller (not published) | — |
g8_result.json | the chain's workspace on the controller (not published) | — |