Woodpecker v3.19.0-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/woodpecker:v3.19.0-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/woodpecker:v3.19.0-CE-ubuntu24.04-r2
  • Index digestsha256:a786fe80b1e39932f5e4ed9c8fe35febc1e85f47d32bc5682a55494e6dd02302
  • linux/amd64 digestsha256:836c5f9ef4f115ef243e1823f3f421891bfdccb0f6a80e6b4d3f9e6f09cbc585
  • ArchiveReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now8a5d2d3afdab3249285656d2a663dd29242400eb17aa8042a8aa9e91da3e8550
  • Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
  • Sections9 sections, 3 fully recorded; 13 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.trail.json
ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.trail.jsonReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.trail.mdWoodpecker product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

1 item not recorded
  • ProductWoodpecker (woodpecker) [MANIFEST.json]
  • Release tagv3.19.0-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/woodpecker:v3.19.0-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:a786fe80b1e39932f5e4ed9c8fe35febc1e85f47d32bc5682a55494e6dd02302 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:836c5f9ef4f115ef243e1823f3f421891bfdccb0f6a80e6b4d3f9e6f09cbc585 [ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.tar.gz (bytes 496893820) [MANIFEST.json]
  • Archive sha256 at publishe03f5180a93a2397a0b29fa9f63889bb69c71633faa4cf82a4769bccc200d222 [MANIFEST.json, repack_history[0].previous_tarball_sha256]
  • Archive sha256 now8a5d2d3afdab3249285656d2a663dd29242400eb17aa8042a8aa9e91da3e8550 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack history
    • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 e03f5180a93a2397a0b29fa9f63889bb69c71633faa4cf82a4769bccc200d222 · sha256 8a5d2d3afdab3249285656d2a663dd29242400eb17aa8042a8aa9e91da3e8550 · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
    [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/woodpecker-ci/woodpecker [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv3.19.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit9f5568c20a1f7195d23c4194c49d53bd2580be41 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash39b3ee913f31d444fd764101b3ce1fcbd9a1f7d1de409cc555bfcf1fbd0f02ba (files 1693) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:e6310f747807a5dd5dc3d314ab33d86edb820634f171249c1a96a0bafe311bd3 [ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1791396171 (utc 2026-10-07T18:02:51Z) [ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded
  • Chain694 (created 2026-10-27T13:10:05Z · trigger customer_request · upstream version v3.19.0) [chains, chains #694]
  • Requestbuild request #371 (rebuild) (requested at 2026-10-27T02:37:24Z · requested by kitforge-agent · version v3.19.0) [build_requests, build_requests #371]
  • Reasonrevision v3.19.0-CE-ubuntu24.04-r2: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #371 request_reason]
  • Supersedesreadystack/woodpecker:v3.19.0-CE-ubuntu24.04-r1 (chain 561) [chains, chains #561]

The path through the harness

2 items not recorded

1 chain · 4 drives · 18 stages · 3 rewinds

Chain 694 release · shipped

Created 2026-10-27T13:10:05Z, upstream v3.19.0, build request 371 [chains, chains #694]

DriveStartedMinutesBuild hostHow it stopped
9682026-10-27T13:10:28Z25.2build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #968] rebuilt from a build line's log
9702026-10-27T14:22:25Z3.7build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #970] rebuilt from a build line's log
9722026-10-27T14:50:23Z6.2build host 5 publish-held stage_failed at package_archive [drive_runs, drive_runs #972] rebuilt from a build line's log
9772026-10-27T16:30:11Z6.3build host 5 publish-held shipped [drive_runs, drive_runs #977] rebuilt from a build line's log

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-27T13:10:34Z2026-10-27T13:10:35Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-27T13:10:39Z2026-10-27T13:10:40Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-27T13:11:07Z2026-10-27T13:11:08Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-27T13:16:36Z2026-10-27T13:16:37Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 —
remediate 2026-10-27T13:17:16Z2026-10-27T13:17:17Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 —
build_kit 2026-10-27T13:23:42Z2026-10-27T13:23:43Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 —
verdict 2026-10-27T13:24:34Z2026-10-27T13:24:35Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 —
publish_image 2026-10-27T13:25:20Z2026-10-27T13:25:21Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 —
boot_instance 2026-10-27T13:25:26Z2026-10-27T13:25:28Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 —
sbom 2026-10-27T13:25:42Z2026-10-27T13:25:43Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 —
schema_discovery 2026-10-27T13:25:49Z2026-10-27T13:25:50Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 —
admin_handbook 2026-10-27T13:25:57Z2026-10-27T13:25:58Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 —
db_handbook 2026-10-27T13:26:07Z2026-10-27T13:26:08Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 —
seed_data 2026-10-27T13:26:15Z2026-10-27T13:26:16Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 —
seed_validate 2026-10-27T13:26:19Z2026-10-27T13:26:20Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 —
usecase_validate 2026-10-27T13:28:08Z2026-10-27T13:28:09Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 —
finalize_docs 2026-10-27T13:28:14Z2026-10-27T13:28:15Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 —
package_archive 2026-10-27T13:35:37Z2026-10-27T16:36:24Z4
33 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 scout_grade_a
  • G8 script_copies
  • G8 three_way_sha
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 assetchain_coverage
 —

[stage_runs]

Rewinds

  • 2026-10-27T13:56:46Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2294]
  • 2026-10-27T14:49:47Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #1151]
  • 2026-10-27T16:29:40Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #1158]
  • Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
  • Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-10-27T16:36:24Z.

9 calls over 3 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
usecase_validate5001 not recordednot recorded —

[micro_step_runs]

  • Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
  • Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

2 items not recorded

Role: review model.

2 rounds, 2 counted, $0.87 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-10-27T13:37:04Z 020 findings to repackage [held_rounds, held_rounds #682] rebuilt from a held-review state file $0.52 not recorded not recorded
22026-10-27T14:27:01Z 000 clean to publish [held_rounds, held_rounds #683] rebuilt from a held-review state file $0.35 not recorded not recorded
  • Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
  • Not recorded: the round cap in force at each round (the state files did not keep it)

Defects

Fully recorded
  • Ledger entries110 [defects, defects where product_slug=woodpecker and this tag or chain]
  • Disclosed in the archive10 [docs/defects/defects.json, entries]

110 ledger entries: by severity critical 10, high 35, low 65; by status fixed-before-release 82, fixed-in-release 24, open 4.

DefectSeverityStatusFound byFixed in
RSD-woodpecker-ab37b146cd
Admin handbook: A locked-out administrator who follows this sentence sets the new WOODPECKER_ADMIN value and runs `docker restart`, which does not apply it; they stay locked out with no error. [defects, defects #45839]		criticalfixed-before-releaseheld review (review model)—
RSD-woodpecker-3301106fba
Admin handbook: Operating-fact (strategy doc_facts.data_persistence) text copied into every handbook says the key encrypts secrets; fix the strategy fact, which also feeds DB_HANDBOOK.md:268 and the repeats at… [defects, defects #45840]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-8b3a3f7af4
Admin handbook: The documented way to admit users fails for the second login added in a row, with no mention in the handbook. [defects, defects #45841]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-faf4f7c182
Admin handbook: A demotion that stays in force only if the old list is really gone: after `docker restart` the container still carries the old list, so the user is made administrator again at their next sign-in. [defects, defects #45842]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-9208eea266
Admin handbook: Restarting does not apply the shortened list; the deleted user is re-created as an administrator at their next sign-in. [defects, defects #45843]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-6faa778e25
Admin handbook: Same restart-does-not-apply-env error in the demotion procedure. [defects, defects #45844]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-1e53639c96
Admin handbook: Same restart-does-not-apply-env error in the user-removal procedure. [defects, defects #45845]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-1a65a8fca1
Admin handbook: A stopped container's environment cannot be edited; 'update the environment variable and restart' leaves the old list in force, so the removed user returns as administrator. [defects, defects #45846]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-0e9b3be3bc
Admin handbook: Customers who set the key believe their secrets are encrypted; in this release they remain plain text. [defects, defects #45847]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-5511e87d8c
Admin handbook: Describes the behaviour of an encryption that is not active in this release. [defects, defects #45848]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-4543381db5
Admin handbook: Presents the key as a working encryption control. [defects, defects #45849]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-af18a48ac4
API guide: Not fixed from the prior round: the endpoint reference presents POST /api/debug/pprof/symbol as a normal documented operation while the 'not served' list names only the GET paths, so an integrator… [defects, defects #45850]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-2b67d35b4b
Database handbook: The Quick Start tells the customer to run an agent image that is not published: ReadyStack ships no woodpecker-agent repository, so the `docker run` fails with 'pull access denied / repository does… [defects, defects #45851]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-ea1316a7f1
Database handbook: Offered as the way to 'pack the data directory into a tar file', but with no `-v wp-data:/var/lib/woodpecker` it archives the image's own empty /var/lib/woodpecker (no woodpecker.sqlite), so the… [defects, defects #45852]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-b1bf59e06b
Database handbook: The 'restore a database backup' example mounts no volume, so tar extracts into the throwaway container's own filesystem and exits 0; nothing reaches wp-data and a stopped container is left behind. [defects, defects #45853]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-16d532c812
Database handbook: Describes decryption failures that cannot happen because nothing is encrypted; a wrong or absent key does not change anything. [defects, defects #45854]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-dfba94c5d0
Database handbook: WOODPECKER_SERVER is a gRPC host:port address; with the http:// scheme the agent exits immediately, and the Quick Start (line 406) already uses the bare host:port form, so the two sections contradict. [defects, defects #45855]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-44bc62fbd9
Database handbook: The tar restore procedure runs `docker rm woodpecker` at its start and then ends with `docker start woodpecker`, which fails because the container no longer exists; the restored server is never… [defects, defects #45856]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-f101349fcc
Database handbook: False security statement: the shared WOODPECKER_AGENT_SECRET is stored in clear text in the agents table (and this handbook says so at lines 304 and 1844), so a backup file discloses the credential… [defects, defects #45857]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-52d3be13f8
Admin handbook: The 'all other /api endpoints require a token' rule is false for GET /api/healthz, GET /api/version and GET /api/stream/events (the same statement is repeated in the other handbooks). [defects, defects #45858]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-025443e5fe
Admin handbook: Contradicts the next sentence (a shell, tar) and every backup procedure, which run `tar`, `sh` and `sqlite3` from this image (same claim at DB_HANDBOOK.md:619, 739, 790). [defects, defects #45859]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-828d08f3df
Admin handbook: 'The archive file' does not say which of the two archives BUILD_OFFLINE.sh writes can be loaded; the DB handbook (line 1556) names rebuilt.docker.tar. [defects, defects #45860]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-2aec928306
Admin handbook: Contradicts lines 1122/1151 ('Tokens do not expire'). [defects, defects #45861]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-8339b6aab5
Admin handbook: Woodpecker server v3.19.0 has no email sending option, so 'links in emails' is unsupported. [defects, defects #45862]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-0c22f0d78a
Admin handbook: The pprof paths are listed as available endpoints with no note that at the default log level they return the web UI page. [defects, defects #45863]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-8c07ac96ed
API guide: 'This release does not route them' is false at debug log level; a customer who wants profiling is told it is impossible. [defects, defects #45864]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-c6f0de98ad
Database handbook: Contradicts the backup procedures in the same handbook that run tar, sh and sqlite3 from the image. [defects, defects #45865]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-b0dadcc1bc
Database handbook: Same false 'only woodpecker-server' claim as line 619 (repeated at line 790). [defects, defects #45866]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-49590533f2
Database handbook: Template restore command has neither -i (stdin never reaches tar) nor -v (nothing is restored into wp-data). [defects, defects #45867]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-e2208158af
Database handbook: Same unqualified pprof listing (also at line 1039). [defects, defects #45868]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-f94127a444
Database handbook: The server does not execute pipelines (agents do), so the stated use of /tmp is unsupported; the only documented use is the sqlite3 .backup temp file. [defects, defects #45869]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-db7e5451b5
Admin handbook: Offers 'close registration' as a way to stop a deleted, still-listed administrator returning. [defects, defects #47718]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-d4874f5455
Admin handbook: Same wrong alternative in the user-removal procedure: WOODPECKER_OPEN=false is the default and is exactly the configuration in which a listed user is re-created as an administrator, so 'close… [defects, defects #47719]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-3640b799ae
Admin handbook: Names a restore into the live data directory with `docker exec -i woodpecker <program>` as the way to run tar; it leaves the running server on the old data (and overwrites its open database file). [defects, defects #47720]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-5e555d0349
Database handbook: Calls the agent connection 'secure', but the image serves gRPC on 9000 without TLS in the documented run command; the agent secret and pipeline traffic cross the network in clear text. [defects, defects #47721]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-cc14586e47
Database handbook: Presents `docker exec -i woodpecker tar -xf - -C /var/lib/woodpecker` as how to restore a database backup. [defects, defects #47722]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-f0b8497123
Admin handbook: The exception list omits three endpoints that answer without a token; the handbook's Operating facts list them. [defects, defects #47723]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-639e4a95de
Admin handbook: 'For the first time' contradicts 'the next time they sign in' elsewhere and suggests an already-registered user can never be promoted this way. [defects, defects #47724]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-81fe169257
Admin handbook: Same incomplete exception list in the 401 troubleshooting section. [defects, defects #47725]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-5925aedf05
Admin handbook: 'All other endpoints' is false for three endpoints, and the four-item list above it omits them. [defects, defects #47726]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-40f145442d
Database handbook: Incomplete exception list, 'all other endpoints'. [defects, defects #47727]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-f6a54d2340
Database handbook: Same incomplete exception list. [defects, defects #47728]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-a6204962fe
Database handbook: Same incomplete exception list. [defects, defects #47729]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-767bac372f
Database handbook: Conflates two failures: it says the server cannot read the file but quotes the read-only-write error, which only appears when the file is readable. [defects, defects #47730]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-727ddf77d0
Database handbook: The command as written (`docker exec woodpecker sh`) gives no shell; the Admin handbook line 1893 correctly uses `-it`. [defects, defects #47731]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-fc0569acce
Database handbook: The failure is not caused by 'different arguments'; with a forge configured the extra word does not stop the server (DB_HANDBOOK.md:749 states the real no-forge cause). [defects, defects #47732]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-f138864eb0
Database handbook: The example cannot write any file from the container's data and leaves a stopped container behind; it is not a usable procedure. [defects, defects #47733]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-d9b7febbac
Database handbook: 'The exceptions are' lists only four of seven. [defects, defects #47734]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-fe0ded1fbf
Database handbook: 'Except those listed below' omits three endpoints that answer without a token. [defects, defects #47735]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-548d379427
Database handbook: 'Secure the communication channel' reads as transport encryption; the key only signs authentication tokens. [defects, defects #47736]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-fc78015d66
Database handbook: The reassuring 'no forge OAuth credentials' omits that every signed-in user's forge access token is stored in the database and so in every backup. [defects, defects #47737]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-39ab592ade
Admin handbook: The example that follows (`docker run --rm --entrypoint tar -i -v wp-data:/var/lib/woodpecker IMAGE -xvf - -C /var/lib/woodpecker`) extracts a backup into the same wp-data volume the running server… [defects, defects #48283]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-cd8bd2d6cc
Database handbook: Presents extraction into wp-data as how to restore a database backup, without stopping the server or using a new volume; contradicts the 'Do not restore a database this way' sentence at… [defects, defects #48284]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-c2ea64d141
Database handbook: The following command (`docker run --rm -i --entrypoint tar -v wp-data:/var/lib/woodpecker IMAGE -xf - -C /var/lib/woodpecker`) extracts into the live wp-data volume; the server stays on the old… [defects, defects #48285]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-a050a7d7ba
Admin handbook: No record shows privilege escalation is blocked: no-new-privileges is not set and setuid binaries are present, so the sentence is unsupported. [defects, defects #48286]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-e9727d09c6
Admin handbook: Contradicts the message the same handbook gives at line 2509 and the measured output. [defects, defects #48287]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-da1d35c4c3
Admin handbook: A malformed header returns 403, not 401, so the second half of the sentence is false (and the list above it, line 2271, only gives 'without the header'). [defects, defects #48288]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-43264fb6f1
Database handbook: States a startup requirement the server does not enforce. [defects, defects #48289]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-e6bd3babe1
Database handbook: A backup example that copies the live SQLite file from a running server, while every other section requires stopping it first (or using sqlite3 .backup). [defects, defects #48290]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-07ee762fdb
Admin handbook: Four-item list with no mention of the three others, unlike the same list at ADMIN_HANDBOOK.md:1507; same incomplete-exception-list class confirmed fixed elsewhere. [defects, defects #48291]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-17b7438c05
Database handbook: Incomplete exception list; the three other token-less endpoints are listed elsewhere (DB_HANDBOOK.md:853) but not here. [defects, defects #48292]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-119a0f8d91
Admin handbook: Absolute statement contradicts the DB handbook; a directory owned by uid 999 works. [defects, defects #48293]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-9c0fbfca01
Admin handbook: Says the documented run command sets no WOODPECKER_ADMIN, directly beside/after a documented command that does; a customer is told to add a variable that is already there. [defects, defects #48294]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-5a7b9d98fb
Admin handbook: Says the documented run command sets no WOODPECKER_ADMIN, directly beside/after a documented command that does; a customer is told to add a variable that is already there. [defects, defects #48295]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-5643a69a0c
Database handbook: Says the documented run command sets no WOODPECKER_ADMIN, directly beside/after a documented command that does; a customer is told to add a variable that is already there. [defects, defects #48296]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-d143d1c775
Database handbook: States that the database holds no OAuth client secret. [defects, defects #48699]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-3936a32283
Admin handbook: The documented command `curl ... [defects, defects #48700]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-5cfe4bbd9f
Admin handbook: Paraphrase of the round-3 class: implies the documented run command sets no WOODPECKER_ADMIN, which it does. [defects, defects #48701]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-b224565ecc
Admin handbook: Presented under 'Server fails to start' as a startup requirement; the server starts and is healthy without it. [defects, defects #48702]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-21140ded44
Database handbook: Items 2-4 (administrator, agent secret, public URL) are not enforced at startup; DB_HANDBOOK.md:233 itself says the server starts without WOODPECKER_ADMIN. [defects, defects #48703]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-a062e3cda9
Admin handbook: Absolute statement; a world-writable or uid-999-owned directory works (the round-3 fix reached only line 1531). [defects, defects #48704]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-9c553f9251
Database handbook: Same absolute-statement class; contradicts DB_HANDBOOK.md:593/1435/2117. [defects, defects #48705]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-38d8b992cc
Database handbook: Absolute statement contradicted by the next paragraph (line 2117) and by the live test. [defects, defects #48706]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-2f290253fe
Database handbook: Attaches the 'sql: no rows' message to the refused reconnect; the same handbook (303, 1785, 1876) and ADMIN_HANDBOOK.md (359, 2451) give that message for the connected agent and 'agent could not… [defects, defects #48707]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-407c1a088a
Database handbook: Unconditional claim that the container fails; with a forge configured it keeps running, as DB_HANDBOOK.md:708 says. [defects, defects #48708]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-7511c967f4
Admin handbook: With the documented environment an unknown word does not cause an error or exit. [defects, defects #48709]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-2515f6062c
The Docker Hub run example puts WOODPECKER_GITHUB_SECRET and WOODPECKER_AGENT_SECRET on the command line (-e), where the shell's history keeps them [defects, defects #109454]		lowfixed-before-releaseagent case study—
RSD-woodpecker-3a6c572ef5
The image's org.opencontainers.image.version label says 24.04 (inherited from the Ubuntu base), not this release [defects, defects #109455]		lowfixed-in-releaseimage scanv3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-2d01c73007
Admin handbook: The sentence tells the reader to write the secret as it is 'in woodpecker.env' without quotes, but no handbook defines woodpecker.env or --env-file; every run command in the handbooks passes the… [defects, defects #109858]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-cdcd8a6e6b
Admin handbook: Measured: after the documented PATCH (admin=false) on a user, `GET /api/users` with that user's token returned 403 while `GET /api/user` returned 200, so only administrator endpoints are refused. [defects, defects #112672]		lowfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-99a614826e
Admin handbook: Unconditional claim. Measured: a mode-777 host directory bind-mounted into the image is writable by uid 999 (write succeeded); only a directory without uid-999 write permission fails ('cannot create… [defects, defects #112673]		lowfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-621da6d5bf
Database handbook: Absolute statement that contradicts the next sentence of the same paragraph ('ensure it is world-writable or owned by UID 999') and lines 593/1435/2117. [defects, defects #112674]		lowfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-7ccd8e7521
Database handbook: Measured on the image: `docker run --rm --entrypoint sh -v DIR:/d:ro IMAGE -c 'echo hi > /d/x'` prints 'sh: 1: cannot create /d/x: Read-only file system'; without :ro on a 755 directory owned by… [defects, defects #112675]		lowfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-1d77bd3132
Admin handbook: Round-4 finding 'documented curl GET /api/user/token returns the web UI page' was fixed by appending an explanation (line 1110) after the unchanged GET command at 1105-1107, so the page still… [defects, defects #112676]		lowfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-3df70103b1
Admin handbook: IMAGE_CONFIG.json: Healthcheck Interval 5s, StartPeriod 15s. [defects, defects #112677]		lowfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-5c97dba79e
Admin handbook: Measured on the image: `docker run --rm --entrypoint tar -v V:/var/lib/woodpecker IMAGE xf - -C /var/lib/woodpecker < wp-data.tar` printed 'tar: This does not look like a tar archive', exit 2; only… [defects, defects #112678]		lowfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-38d18a0c88
Admin handbook: Measured: without -i the volume holds nothing (tar form) or a 0-byte woodpecker.sqlite (cat form); nothing is 'corrupted', and the tar form is not silent (error, exit 2). [defects, defects #112679]		lowfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-e7645fa7bb
Admin handbook: Same absolute-statement class as the round-3/4 findings. [defects, defects #112680]		lowfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-4231344e05
Database handbook: A customer relying on this sentence would believe GET /api/forges and GET /api/signature/public-key require a personal access token; they do not, and this document's own line 640 already says so, so… [defects, defects #112681]		highfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-c2c703278a
Database handbook: A customer following this sentence literally to recover a locked-out administrator sets the new WOODPECKER_ADMIN value and runs `docker restart`, which does not apply it (Docker environment… [defects, defects #112682]		criticalfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-7281a91d8e
Database handbook: Same lockout as the line-1148 instance: `docker restart` does not pick up a new WOODPECKER_ADMIN value, so an administrator following this text remains locked out. [defects, defects #112683]		criticalfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-165f4448a3
Admin handbook: A customer reading only this list (immediately under the corrected paragraph naming GET /api/forges and GET /api/signature/public-key as the public endpoints) would conclude those two still need a… [defects, defects #112684]		highfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-0278bbb942
Database handbook: A customer rebuilding offline and choosing the 'docker import' alternative this sentence offers ends up with an image that has no ENTRYPOINT, no EXPOSE, and no HEALTHCHECK -- i.e. [defects, defects #112685]		highfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-f23c6866b0
API guide: An integrator who reads the 'Endpoint reference' heading for POST /api/debug/pprof/symbol and then checks this 'not served' list to see if it's safe to rely on would wrongly conclude the POST route… [defects, defects #112686]		highopenheld review (review model)—
RSD-woodpecker-b0fd82d5a8
Database handbook: A customer following this bullet expects `docker exec <container> curl .../api/debug/pprof` (or a browser hit) to return profiling data; on the default log level it silently returns the web UI's… [defects, defects #112687]		lowopenheld review (review model)—
RSD-woodpecker-9849329217
Database handbook: A customer building a monitoring check or API client against this bullet expects GET /api/healthz to return health JSON/status; it returns the web UI's HTML fallback page (200) instead, which could… [defects, defects #112688]		lowopenheld review (review model)—
RSD-woodpecker-f98536619f
Database handbook: A customer building an API client against this bullet expects GET /api/version to return version data; it returns the web UI's HTML fallback page (200) instead of the {"source":...,"version":...}… [defects, defects #112689]		lowopenheld review (review model)—
RSD-woodpecker-ba9912bf99
Database handbook: Same false narrowing as line 1213 but with no exception clause at all ('All API requests must be authenticated'), directly contradicting line 640 in this same document and the live behavior of GET… [defects, defects #112690]		highfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-66d39fecc8
VERIFY.md: cosign's --key flag does not fetch a public key from a bare https:// URL; it takes a local file path, stdin, or a KMS-style URI. [defects, defects #112691]		criticalfixed-before-releaseheld review (review model)—
RSD-woodpecker-edbfacf2df
Release notes: Same broken cosign invocation as VERIFY.md (missing the `<(curl -fsSL ...)` wrapper cosign's --key flag requires for a remote key). [defects, defects #112692]		criticalfixed-before-releaseheld review (review model)—
RSD-woodpecker-fcd74c8ddc
PROVENANCE.md: Same broken cosign invocation as VERIFY.md/RELEASE_NOTES.md — cosign cannot fetch a public key from a bare https:// URL passed to --key. [defects, defects #112693]		criticalfixed-before-releaseheld review (review model)—
RSD-woodpecker-fd177940ac
Security report: Same broken cosign invocation repeated in the security report — the document whose entire purpose is letting the customer independently confirm the signature. [defects, defects #112694]		criticalfixed-before-releaseheld review (review model)—
RSD-woodpecker-79bc516f40
Admin handbook: False: the handler only accepts the token via the Authorization header as `Bearer <token>`; there is no query-parameter path at all. [defects, defects #112695]		criticalfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-d3a8fc344b
Database handbook: False. The forge's OAuth token is used only for the initial login redirect; it is never accepted as an API credential. API calls require a Woodpecker-issued personal access token (a JWT signed with… [defects, defects #112696]		criticalfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-2740e84f47
Database handbook: False: `docker build` with no `-t` does not invent a repository:tag — it produces an untagged image referenced only by its image ID. [defects, defects #112697]		criticalfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-3eee527fc0
Admin handbook: This URL does not exist on the upstream project's site — Woodpecker's real documentation is hosted at woodpecker-ci.org/docs/... [defects, defects #112698]		highfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-1a7afaa613
Database handbook: Same non-existent URL as in the admin handbook, repeated 6 more times in this file (lines 306, 501, 515, 551, 649, 905), again in place of this release's own bundled and version-matched API reference. [defects, defects #112699]		highfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-77219ae7a6
Security report: "at least `latest`" is a nonsensical version floor — 'latest' is not a version. [defects, defects #112700]		lowfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-2fc188e87a
Security report: PROMOTION_RECORD.json contains no dependency-version data whatsoever (only chain_id, release/internal tags, promotion status, and cosign sign/push output). [defects, defects #112701]		lowfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2
RSD-woodpecker-a5a61cbc35
Admin handbook: Incomplete: this exact release also supports Forgejo and Bitbucket/Bitbucket Data Center as forges (each with its own WOODPECKER_* enable flag and OAuth client/secret variables), but every… [defects, defects #112702]		lowfixed-in-releaseheld review (review model)v3.19.0-CE-ubuntu24.04-r2

Verification

3 items not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:836c5f9ef4f115ef243e1823f3f421891bfdccb0f6a80e6b4d3f9e6f09cbc585 · published digest sha256:836c5f9ef4f115ef243e1823f3f421891bfdccb0f6a80e6b4d3f9e6f09cbc585 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 194) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 694 package_archive gate_result.g8.result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-27T16:30:30Z · failing Docker Scout counts 100 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • First own scan of the releaseA (at 2026-10-27T16:36:34Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-27T06:30:41Z) [image_scans, image_scans #1343]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-27T16:30:17Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [docs/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3632651063 · transparency-log entry · integrated 2026-11-01T14:33:45Z) [ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]

Offline clean-room rebuilds

  • 2026-10-27T13:37:07Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:836c5f9ef4f115ef243e1823f3f421891bfdccb0f6a80e6b4d3f9e6f09cbc585 [clean-room rebuild ledger, runs[460]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
  • Not recorded: the attestations' transparency-log entries (no attestation record in the release's workspace)
  • Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

2 items not recorded
  • Image pushed (internal tag), publish_image passed2026-10-27T13:25:21Z [stage_runs, stage_runs chain 694 stage publish_image]
  • Archive manifests written2026-10-27T16:32:25Z [PUBLISH_MANIFEST.json, published_at]
  • Archive cut over on prodasset, package_archive passed2026-10-27T16:36:24Z [stage_runs, stage_runs chain 694 stage package_archive]
  • Cut-over markerpresent (chain 694) [.cutover.json]
  • Not recorded: when the release tag was promoted (the promotion record in the archive was written before the promotion, and the release's workspace no longer holds this chain)
  • Not recorded: the site event's time (the release checklist is in the chain's workspace, which no longer holds this chain)

Packages and CPU level

Fully recorded
  • Packages in the image237 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 747 · probed 2026-11-02T17:11:29Z · source backfill) [release_images, isa_level_hard]

History

1 event
  • 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records

Records

23 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PROMOTION_RECORD.jsoninside the archive (ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.tar.gz)—
.cutover.jsonbeside the archive (prodasset /data/production/woodpecker/v3.19.0-CE-ubuntu24.04-r2/)—
MANIFEST.jsonbeside the archive (prodasset /data/production/woodpecker/v3.19.0-CE-ubuntu24.04-r2/)—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/woodpecker/v3.19.0-CE-ubuntu24.04-r2/)—
ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/woodpecker/v3.19.0-CE-ubuntu24.04-r2/)—
ReadyStack-woodpecker-v3.19.0-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/woodpecker/v3.19.0-CE-ubuntu24.04-r2/)—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/woodpecker/v3.19.0-CE-ubuntu24.04-r2/)—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)371
chainssadb, ReadyStack's engine database (not published)694
defectssadb, ReadyStack's engine database (not published)woodpecker v3.19.0-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 694
held_roundssadb, ReadyStack's engine database (not published)chain 694
image_scanssadb, ReadyStack's engine database (not published)1343
micro_step_runssadb, ReadyStack's engine database (not published)chain 694
release_imagessadb, ReadyStack's engine database (not published)woodpecker v3.19.0-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 694
stage_runssadb, ReadyStack's engine database (not published)chain 694