Woodpecker v3.20.1-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/woodpecker:v3.20.1-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/woodpecker:v3.20.1-CE-ubuntu24.04-r1
  • Index digestsha256:c9a37524cca176db982104db7aa087782321bb170274f4e77ebc4e7e887d6f33
  • linux/amd64 digestsha256:34ecdf21c55d620ceb48f5b0b7c2e5038975945bb289216aaa91ae47f0bd53ea
  • ArchiveReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 now57ca36221390f77891e08d6741c3e1a54ce5949d765006eebe475d91ea833105
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T15:19:32Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.trail.json
ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.trail.jsonReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.trail.mdWoodpecker product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductWoodpecker (woodpecker) [MANIFEST.json]
  • Release tagv3.20.1-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/woodpecker:v3.20.1-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:c9a37524cca176db982104db7aa087782321bb170274f4e77ebc4e7e887d6f33 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:34ecdf21c55d620ceb48f5b0b7c2e5038975945bb289216aaa91ae47f0bd53ea [ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.tar.gz (bytes 510535666) [MANIFEST.json]
  • Archive sha256 at publish57ca36221390f77891e08d6741c3e1a54ce5949d765006eebe475d91ea833105 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/woodpecker-ci/woodpecker [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv3.20.1 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit3f1bb0bd0db28e410ad797034d75780116122c91 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashd66ceaca9c7b409dcb5c895a1aa9e92a77c3345e3a99f9125c0cba89bd06e09c (files 1736) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:17d84568228c703adabd675e05e16f7a044325cb17bf393c6b41c2f0c01aad78 [ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793302722 (utc 2026-10-29T19:38:42Z) [ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 · platform digest sha256:fea12ba16096adec0f699ce1c4da2154d320450e56c1f63671f95d2a3551c77b
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Engine commit(s)
    • commit c20aa19bc0ab8c9fef7ff40e1f6a18c4169b166e · dirty yes · first drive 3839
    • commit 567cdfb885bf0ce20007674847d596470bb7360f · dirty yes · first drive 3862
    • commit 56ff0831ecebed815a837c90402216ab4c9685cd · dirty yes · first drive 3905
    • commit b29f462ba272213173a4375440fb6180b85d1510 · dirty yes · first drive 3916
    • commit 97b0018368740f49044fa71c7402a6680999e669 · dirty yes · first drive 3919
    • commit 92f2f07d6805e851f28fd697333da6ed7c235c16 · dirty yes · first drive 3921
    • commit 9f41ab74d9d3a9eb9a02d518e82effca6659bf55 · dirty yes · first drive 3927
    • commit cff175c7916b19e138784c06e8e05392550947fe · dirty yes · first drive 3941
    • commit 893ddf91074580cc5f11ded7558920733b65fc43 · dirty yes · first drive 3942
    • commit 3129b4dca8b836efd047cb995ff6df15301a7ff6 · dirty yes · first drive 3958
    • commit 194d03b190b87186e97e0197f890de6db920b757 · dirty yes · first drive 3964
    • commit 0f08e26ee402fd26c98aca5274d6a37e78400064 · dirty yes · first drive 3970
    • commit b5c9dcd9199edee322072a4a29a36a940f9c45a9 · dirty yes · first drive 4052
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain894 (created 2026-11-08T16:54:44Z · trigger customer_request · upstream version v3.20.1) [chains, chains #894]
  • Requestbuild request #590 (rebuild) (requested at 2026-11-08T15:08:59Z · requested by kitforge-agent · version v3.20.1) [build_requests, build_requests #590]
  • Reasonretarget to v3.20.1: a newer upstream release (rule 1) [build_requests, build_requests #590 request_reason]
  • Supersedesreadystack/woodpecker:v3.19.0-CE-ubuntu24.04-r2 (chain 694) [chains, chains #694]

The path through the harness

Fully recorded

2 chains · 16 drives · 18 stages · 6 rewinds

Chain 736 behind it · abandoned

Created 2026-10-28T00:03:55Z, upstream v3.19.0, build request 420 [chains, chains #736]

Abandoned: chain 736 abandoned: stale (it targets 'v3.19.0', the strategy 'v3.20.1') [watch_queue, watch_queue #12443 resolution]

DriveStartedMinutesBuild hostHow it stopped
8182026-10-28T00:04:17Z50.5build host 4 withhold-publish ready_to_ship [drive_runs, drive_runs #818] rebuilt from a build line's log
8242026-10-28T03:14:41Z7.5build host 4 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #824] rebuilt from a build line's log
37552026-11-08T10:09:30Z2.1build host 4 withhold-publish stage_failed at assemble_kit; first failed check exists:first_build_digest; 1 tick [drive_runs, drive_runs #3755]

Chain 894 release · ready_to_ship

Created 2026-11-08T16:54:44Z, upstream v3.20.1, build request 590 [chains, chains #894]

DriveStartedMinutesBuild hostHow it stopped
38392026-11-08T16:55:05Z60build host 4 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3839]
38622026-11-08T18:40:09Z10.4build host 4 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 1 tick [drive_runs, drive_runs #3862]
39052026-11-09T00:14:52Z7build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3905]
39162026-11-09T01:20:38Z3.5build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3916]
39192026-11-09T01:51:04Z2.4build host 4 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3919]
39212026-11-09T01:57:19Z2build host 4 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3921]
39272026-11-09T02:28:56Z1.2build host 4 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3927]
39412026-11-09T03:43:32Z2.1build host 4 withhold-publish stage_failed at package_archive; first failed check g8; 1 tick [drive_runs, drive_runs #3941]
39422026-11-09T03:52:56Z3.4build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3942]
39582026-11-09T05:10:55Z3build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3958]
39642026-11-09T05:40:45Z3.7build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3964]
39702026-11-09T06:18:21Z3.4build host 4 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3970]
40522026-11-09T15:14:48Z—build host 4 publish-held not recorded [drive_runs, drive_runs #4052]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-08T16:55:16Z2026-11-08T16:55:17Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 67f3b13b88b3…
acquire 2026-11-08T16:55:22Z2026-11-08T16:55:23Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 4f00153b23ba…
license_file a203768e1e09…
custody_inputs 1c79abc52f50…
source_tree_hash d17811a5866e…
source_file_manifest f348a3fa4f1e…
plan 2026-11-08T16:55:54Z2026-11-08T16:55:55Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report ab91c286b770…
input_pin_plan db3039947de9…
toolchain_lock e20f98c531bb…
assemble_kit 2026-11-08T17:00:14Z2026-11-08T17:00:15Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 1256cdbd4496…
build_recipe 8a8c7f48aeaa…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health d9c8270d59c0…
verify_offline_sh 3e8184ea230c…
base_image_digests 5ff84f1a1b4b…
dockerfile_offline 1256cdbd4496…
first_build_digest 50f6c195afa0…
remediate 2026-11-08T17:00:45Z2026-11-08T17:00:45Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 445d9dbb50f8…
security_report 0c0679d98d95…
build_kit 2026-11-08T17:06:25Z2026-11-08T17:06:26Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 3bb4a8b24f6b…
locked_digest 97759d15dc1a…
freeze_manifest 7b85eaf98fdc…
offline_rebuild_transcript a1f5c4003891…
verdict 2026-11-08T17:06:58Z2026-11-08T17:06:59Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 9760b87d7d79…
publish_image 2026-11-08T17:07:34Z2026-11-08T17:07:35Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 6eabcfe4f92a…
promotion_record 93024cffd347…
boot_instance 2026-11-08T17:07:40Z2026-11-08T17:07:46Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 2e47bd3f03d1…
sbom 2026-11-08T17:07:55Z2026-11-08T17:07:56Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 43b5d9435e13…
sbom_json b6629830c609…
schema_discovery 2026-11-08T17:08:02Z2026-11-08T17:08:03Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash a6785dc1c3c1…
dependency_tree d7466562c4b7…
table_classification 1ce3557862ff…
admin_handbook 2026-11-08T17:17:32Z2026-11-08T17:17:33Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map ec55961a5137…
admin_handbook 2be217946e22…
db_handbook 2026-11-08T17:26:17Z2026-11-08T17:26:18Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook e150c1ef9af6…
seed_isolation 821dd7281789…
seed_data 2026-11-08T17:26:27Z2026-11-08T17:26:28Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 6c5aa95e8381…
seed_cases_json ae6df0212fb9…
seed_validate 2026-11-08T17:26:32Z2026-11-08T17:26:33Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 150ec5178e1e…
usecase_validate 2026-11-08T17:26:56Z2026-11-08T17:26:56Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests c9f0e5d4353d…
passed_tests e3b96768cd8c…
test_results 45957d9660cc…
usecase_contract 912c7b824c3c…
finalize_docs 2026-11-08T17:42:05Z2026-11-08T17:42:06Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 80ed4e0af402…
release_notes 788265525283…
api_integration_guide 08a5c90e3075…
package_archive invalidated 2026-11-09T15:14:23Z 2026-11-08T17:55:07Z2026-11-09T06:21:46Z12
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 75aece0cd2ef…
checksums fa981bc0e68a…
verify_md 61824b39b49b…
rebuild_md aba012c298bf…
manifest_txt 36b7e8bf9c77…
actions_jsonl cc1de01123b9…
provenance_md f5cba422db10…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json e6e8d87065f7…

[stage_runs]

Rewinds

  • 2026-11-09T00:46:42Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27728]
  • 2026-11-09T01:49:35Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27817]
  • 2026-11-09T05:10:09Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28028]
  • 2026-11-09T05:40:03Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28046]
  • 2026-11-09T06:16:58Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28082]
  • 2026-11-09T15:14:23Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #29257]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T06:21:46Z.

268 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 07150 L-A183, L-A15
remediate2001 07679 L-A183, L-A15
admin_handbook613103 11478256 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook763603 17588245 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
usecase_validate1001 01652 L-A59
finalize_docs1266403 251003354 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

6 rounds, 6 counted, $10.39 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T00:22:39Z 21022 findings to repackage [held_rounds, held_rounds #1557] $2.42 3 rounds, $40.00 4ea44ac3b953…
22026-11-09T01:24:44Z 0040 clean to repackage [held_rounds, held_rounds #1560] $2.61 3 rounds, $40.00 66903eec1810…
32026-11-09T03:56:53Z 014 findings to repackage [held_rounds, held_rounds #1580] $1.71 3 rounds, $40.00 e49f57731c3b…
42026-11-09T05:14:25Z 012 findings to repackage [held_rounds, held_rounds #1583] $0.88 3 rounds, $40.00 e5cf4a20f8e7…
52026-11-09T05:45:04Z 0219 findings to repackage [held_rounds, held_rounds #1587] $2.46 3 rounds, $40.00 08ceac23e7cb…
62026-11-09T06:23:02Z 000 clean to publish [held_rounds, held_rounds #1591] $0.31 3 rounds, $40.00 75aece0cd2ef…

Defects

Fully recorded
  • Ledger entries103 [defects, defects where product_slug=woodpecker and this tag or chain]
  • Disclosed in the archive101 [docs/defects/defects.json, entries]

103 ledger entries: by severity high 15, low 86, critical 2; by status fixed-in-release 2, fixed-before-release 101.

DefectSeverityStatusFound byFixed in
RSD-woodpecker-a96a309974
API guide: An integrator who reads the 'Endpoint reference' heading for POST /api/debug/pprof/symbol and then checks this 'not served' list to see if it's safe to rely on would wrongly conclude the POST route… [defects, defects #187792]		highfixed-in-releaseheld review (review model)v3.20.1-CE-ubuntu24.04-r1
RSD-woodpecker-77c2050e8b
Database handbook: A customer following this bullet expects `docker exec <container> curl .../api/debug/pprof` (or a browser hit) to return profiling data; on the default log level it silently returns the web UI's… [defects, defects #187793]		lowfixed-in-releaseheld review (review model)v3.20.1-CE-ubuntu24.04-r1
RSD-woodpecker-3cf02f5810
Database handbook: A customer building a monitoring check or API client against this bullet expects GET /api/healthz to return health JSON/status; it returns the web UI's HTML fallback page (200) instead, which could… [defects, defects #187794]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-f84fa999d0
Database handbook: A customer building an API client against this bullet expects GET /api/version to return version data; it returns the web UI's HTML fallback page (200) instead of the {"source":...,"version":...}… [defects, defects #187795]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-8479c66040
Admin handbook: The documented database backup cannot run. [defects, defects #187944]		criticalfixed-before-releaseheld review (review model)—
RSD-woodpecker-b2f11b3f91
Admin handbook: The documented restore cannot run: same misplaced `-c` before the image, so docker rejects the command and nothing is written into wp-data-new; the customer then starts the server on an empty volume. [defects, defects #187945]		criticalfixed-before-releaseheld review (review model)—
RSD-woodpecker-e0b9e1c8ac
Admin handbook: Same misplaced `-c` before the image name: docker takes it as --cpu-shares and the command fails (held-run on the held digest: image 'echo hi' is not on this host). [defects, defects #187946]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-ede1d2f2c3
Admin handbook: `docker run --rm --entrypoint sh IMAGE -c ...` and `docker exec woodpecker sh -c ...` ran on the held digest (sh is dash; `echo $0` printed sh). [defects, defects #187947]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-fc2c5925b8
Admin handbook: Measured on the held digest: with -e WOODPECKER_ADMIN='alice bob' GET /api/users shows alice without admin_env (the value is read as the single login 'alice bob'), whereas WOODPECKER_ADMIN=alice,bob… [defects, defects #187948]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-cc0e79182a
Database handbook: Measured: GET /login on the held digest returns 200 (the web UI), GET /authorize returns 303 to https://github.com/login/oauth/authorize?...&redirect_uri=http%3A%2F%2Flocalhost%3A8000%2Fauthorize. [defects, defects #187949]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-f9761dd81f
Database handbook: The server sends redirect_uri=<WOODPECKER_HOST>/authorize to GitHub (curl -D- on /authorize, held digest); /login is the web UI page. [defects, defects #187950]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-6750dd1276
API guide: Measured on the held digest: started with WOODPECKER_GITHUB_SECRET='my new pass $x!' and ran sqlite3 'select oauth_client_id, oauth_client_secret from forges' -> cid|my new pass $x!. [defects, defects #187951]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-e4b6334e0f
API guide: IMAGE_BINARIES.txt lists 38 commands: sh, dash, cat, sqlite3, rs-probe, env, printf, sleep... [defects, defects #187952]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-55414e6713
API guide: IMAGE_BINARIES.txt (38 commands incl. [defects, defects #187953]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-cf21a571a6
API guide: Image name after `-c`: docker parses it as --cpu-shares and the command fails (held-run refused with the next word as the image); even if it ran, there is no -v so it would not see the data volume. [defects, defects #187954]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-6401e7e0d7
API guide: Measured on the held digest with WOODPECKER_PROMETHEUS_AUTH_TOKEN=tk: no header 401, 'Bearer bad' 403, 'Authorization: bad' 403, 'Bearer tk' 200, ?access_token=tk 401; unset -> 404. [defects, defects #187955]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-0b95edc9bf
API guide: Listed under 'The following endpoints are public and do not require a token' yet says it requires a token. [defects, defects #187956]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-bd126bddbc
API guide: Measured: POST /api/user/token returns the same token every call and does not refresh it; the same guide says so at L604, L1220 and L2451. [defects, defects #187957]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-92612b9cda
API guide: Upstream v3.20.1 server/api/signature_public_key.go: 'Get server's signature public key' (ed25519 PEM); agent tokens are HMAC-signed with the gRPC secret (this guide L2083), not verified with this… [defects, defects #187958]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-9f61682cf7
API guide: Same as L898: the key is not used for gRPC; agent tokens are signed with the shared gRPC secret. [defects, defects #187959]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-32509aa4c9
Database handbook: Same as API guide L898: the endpoint is not used to verify agent credentials. [defects, defects #187960]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-4206dfb62a
Database handbook: Same as API guide L898. [defects, defects #187961]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-78da8d71c8
API guide: Measured: GET /api/agents and GET /api/agents/1 print the token field after creation; ADMIN_HANDBOOK L221 says administrators see it in the token field. [defects, defects #187962]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-b244f6bcb1
API guide: Measured: GET /api/nonexistent and GET /api/info return 200 text/html (the UI fallback); this guide says so itself at L2209. [defects, defects #187963]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-5f5361a055
API guide: Contradicts this guide at L1089/L2155 ('on reconnect it is refused and exits') and the 'AgentID not found in database ... [defects, defects #187964]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-449626a413
API guide: Measured: GET /version and GET /api/version -> {"source":"https://github.com/woodpecker-ci/woodpecker","version":"3.20.1"}, no timestamp. [defects, defects #187965]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-fcaa68090c
API guide: Measured: POST /api/users bob -> 200; POST carol (later) -> 500 'on insert duplicate based on constraints was detected' while bob was still listed; it is not timing-related. [defects, defects #187966]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-121accb164
API guide: No documented or measured API lets an administrator revoke another user's token; the sentence describes a 'token-to-revoke command' that does not exist. [defects, defects #187967]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-20ecc2d611
API guide: Measured: /api/info and /api/nonexistent both 200 text/html. [defects, defects #187968]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-6a97724af5
API guide: Measured: held-wait reported health=healthy 6 s after start. [defects, defects #187969]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-c3011c02f0
Database handbook: IMAGE_CONFIG.json Healthcheck: Interval 5s, StartPeriod 15s, Timeout 60s; measured healthy after 6 s. [defects, defects #187970]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-1857d67e95
Database handbook: StartPeriod is a grace period, not a delay; measured healthy 6 s after start. [defects, defects #187971]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-a99d543bae
Database handbook: `/metrics` is served at the root (GET /metrics), not under /api, as the handbook itself shows (L898). [defects, defects #187972]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-f81acd1814
Database handbook: Agents reach the server through WOODPECKER_SERVER=host:9000 (ADMIN_HANDBOOK L983); WOODPECKER_HOST is the OAuth redirect base (measured redirect_uri=<HOST>/authorize), not an agent setting. [defects, defects #187973]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-8e17c7c3fb
Database handbook: Measured: container with only WOODPECKER_GITHUB=true and no agent secret reaches health=healthy. [defects, defects #187974]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-aa1b79f8da
Database handbook: IMAGE_CONFIG.json Entrypoint: ["woodpecker-server"]; the binary is /usr/bin/woodpecker-server and `test -e /woodpecker-server` in the container says missing. [defects, defects #187975]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-8c4e7f029d
Database handbook: Contradicts the same section at L1249 and L1397 ('Keep this variable in your docker run command') and the Operating facts, which say a demoted login still listed is admin again after a restart. [defects, defects #187976]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-dac7e13109
API guide: Contradicts this guide at L1611 ('keep it in your docker run command') and the handbooks' Operating facts. [defects, defects #187977]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-63cdf6edcd
Admin handbook: Measured on the held digest (GitHub configured): GET /api/forges -> [{"id":1,"type":"github","url":"https://github.com"}] - only the configured forge, not the supported ones. [defects, defects #188780]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-54cc2ecfc3
Admin handbook: Measured on the held digest (GitHub configured): GET /api/forges -> [{"id":1,"type":"github","url":"https://github.com"}] - only the configured forge, not the supported ones. [defects, defects #188781]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-f9bf8976ee
API guide: Measured on the held digest (GitHub configured): GET /api/forges -> [{"id":1,"type":"github","url":"https://github.com"}] - only the configured forge, not the supported ones. [defects, defects #188782]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-c3d45def55
Database handbook: Measured on the held digest (GitHub configured): GET /api/forges -> [{"id":1,"type":"github","url":"https://github.com"}] - only the configured forge, not the supported ones. [defects, defects #188783]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-91fe594cd9
API guide: Measured on the held digest (GitHub configured): GET /api/forges -> [{"id":1,"type":"github","url":"https://github.com"}] - only the configured forge, not the supported ones. [defects, defects #188784]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-80d56ab005
API guide: Measured on the held digest (GitHub configured): GET /api/forges -> [{"id":1,"type":"github","url":"https://github.com"}] - only the configured forge, not the supported ones. [defects, defects #188785]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-6b7c68f80c
API guide: Measured on the held digest (GitHub configured): GET /api/forges -> [{"id":1,"type":"github","url":"https://github.com"}] - only the configured forge, not the supported ones. [defects, defects #188786]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-7727ee4cad
API guide: Measured on the held digest (GitHub configured): GET /api/forges -> [{"id":1,"type":"github","url":"https://github.com"}] - only the configured forge, not the supported ones. [defects, defects #188787]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-ed6545f857
API guide: Measured on the held digest (GitHub configured): GET /api/forges -> [{"id":1,"type":"github","url":"https://github.com"}] - only the configured forge, not the supported ones. [defects, defects #188788]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-b094bf4968
API guide: Measured on the held digest (GitHub configured): GET /api/forges -> [{"id":1,"type":"github","url":"https://github.com"}] - only the configured forge, not the supported ones. [defects, defects #188789]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-0e4e52b9a9
Admin handbook: Upstream v3.20.1 server/api/signature_public_key.go: 'Get server's signature public key' (ed25519 PEM, text/plain 200). [defects, defects #188790]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-ed1460a767
API guide: Upstream v3.20.1 server/api/signature_public_key.go: 'Get server's signature public key' (ed25519 PEM, text/plain 200). [defects, defects #188791]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-b8b5147234
API guide: Upstream v3.20.1 server/api/signature_public_key.go: 'Get server's signature public key' (ed25519 PEM, text/plain 200). [defects, defects #188792]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-aefdad5094
Admin handbook: Measured on the held digest with WOODPECKER_PROMETHEUS_AUTH_TOKEN set (round-1 measurement, same behaviour): no header 401, wrong token 403, correct Bearer token 200. [defects, defects #188793]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-8e350728b3
Database handbook: Measured on the held digest with WOODPECKER_PROMETHEUS_AUTH_TOKEN set (round-1 measurement, same behaviour): no header 401, wrong token 403, correct Bearer token 200. [defects, defects #188794]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-c62f50be16
API guide: Agents reach the server through WOODPECKER_SERVER=host:9000 (ADMIN_HANDBOOK L976-979); WOODPECKER_HOST is the base of the OAuth redirect (measured earlier: redirect_uri=<WOODPECKER_HOST>/authorize)… [defects, defects #188795]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-290a073b65
API guide: Agents reach the server through WOODPECKER_SERVER=host:9000 (ADMIN_HANDBOOK L976-979); WOODPECKER_HOST is the base of the OAuth redirect (measured earlier: redirect_uri=<WOODPECKER_HOST>/authorize)… [defects, defects #188796]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-69896e85fe
API guide: Agents reach the server through WOODPECKER_SERVER=host:9000 (ADMIN_HANDBOOK L976-979); WOODPECKER_HOST is the base of the OAuth redirect (measured earlier: redirect_uri=<WOODPECKER_HOST>/authorize)… [defects, defects #188797]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-b9c1231c20
API guide: Contradiction inside the shipped documents: they also print `-e WOODPECKER_AGENT_SECRET=...` (API guide L1676 and L2095; ADMIN_HANDBOOK L1015 and Operating facts L218; DB_HANDBOOK Operating facts… [defects, defects #188798]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-ba418ee6e1
Database handbook: Contradiction inside the shipped documents: they also print `-e WOODPECKER_AGENT_SECRET=...` (API guide L1676 and L2095; ADMIN_HANDBOOK L1015 and Operating facts L218; DB_HANDBOOK Operating facts… [defects, defects #188799]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-db114ab717
API guide: Contradiction inside the shipped documents: they also print `-e WOODPECKER_AGENT_SECRET=...` (API guide L1676 and L2095; ADMIN_HANDBOOK L1015 and Operating facts L218; DB_HANDBOOK Operating facts… [defects, defects #188800]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-6a7f18a042
API guide: Same guide, L1018 'The gRPC connection is plain text' and L2076 'The signing key signs agent tokens but does not encrypt the connection'; IMAGE_CONFIG.json exposes 9000/tcp with no TLS setting. [defects, defects #188801]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-c9e7c6eb87
API guide: The same guide (L1868, L1919-1921) and both handbooks say the backup holds the OAuth client secret, forge access/refresh tokens and agent secrets in plain text (measured: forges.oauth_client_secret… [defects, defects #188802]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-1ecc2f67c9
API guide: Upstream v3.20.1 server/api/user.go PostToken/DeleteToken act on session.User(c), the caller. [defects, defects #188803]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-f9d6b0a37c
Database handbook: Measured on the held digest: two POST /api/user/token calls returned the identical string, equal to the token used to authenticate (the call itself needs a valid token). [defects, defects #188804]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-86eba29d94
Database handbook: DB_HANDBOOK has no 'Installation' section (headings: Introduction, Operating facts, Architecture Overview, System Requirements, Running the Container, ... [defects, defects #188805]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-4f93e51322
Database handbook: Measured on the held digest: WOODPECKER_GITLAB=true with only _CLIENT and _SECRET starts healthy and writes forges row gitlab|https://gitlab.com. [defects, defects #188806]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-a261f8f48e
API guide: Measured: GitLab starts and defaults to gitlab|https://gitlab.com without WOODPECKER_GITLAB_URL; ADMIN_HANDBOOK L715 and DB_HANDBOOK L757 say optional. [defects, defects #188807]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-739b306aa6
Database handbook: RELEASE_NOTES 'Base image: none (FROM scratch): a chiselled Ubuntu 24.04 runtime'; ADMIN_HANDBOOK L333 'chiselled Ubuntu runtime'; IMAGE_BINARIES.txt lists 38 commands (no ls, id, tar, bash). [defects, defects #188808]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-5c0e436b45
Database handbook: Held-digest startup log order: 'Initializing Schema' ... [defects, defects #188809]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-5148c2c569
Database handbook: DB_HANDBOOK Operating facts L198/L202: a user still listed in WOODPECKER_ADMIN is re-created, as an administrator, at the next sign-in after DELETE /api/users/<login>. [defects, defects #188810]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-efbeec8b05
Admin handbook: `woodpecker-server` is only an example container name; ADMIN_HANDBOOK L979 uses WOODPECKER_SERVER=ci.example.com:9000. [defects, defects #188811]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-09079a6fc3
API guide: Same guide L561/L617 and the handbooks: personal access tokens do not expire (the token minted from the user hash carries no exp claim). [defects, defects #188812]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-cfc9b2c2dd
Database handbook: DB_HANDBOOK L1284 'Tokens do not expire'; upstream user.go PostToken signs without expiry. [defects, defects #188813]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-eada8e12fc
API guide: Without -i/-t the shell reads end-of-file on stdin and exits at once, leaving a stopped container (no --rm); the same section says to use `docker exec -it woodpecker sh` for an interactive shell. [defects, defects #188814]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-252f91a16d
API guide: Run as written it copies the live database file of a running server; the same guide (L1925) says to stop the server before this form, and the online form is the sqlite3 .backup command. [defects, defects #188815]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-28d19224e4
API guide: Customer-actionable claim contradicts the server: DELETE /api/agents/<id> does not interrupt running jobs, it is refused with 409 while the agent has a running task, so the record (and the old… [defects, defects #193011]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-cd2be31333
API guide: Round-2 finding paraphrased in a section the fix missed: the endpoint lists only the configured forge, not the forges Woodpecker can integrate with. [defects, defects #193012]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-61d22a29fd
API guide: 'installed forge integrations' repeats the supported-vs-configured forge error from round 2 (and 'signature verification' is the key for requests the server sends, not webhooks). [defects, defects #193013]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-1d262768de
API guide: 'This is required' is wrong: the image sets WOODPECKER_HOST by default and the server starts without it being set. [defects, defects #193014]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-e303a1feab
Admin handbook: Same omission as API guide L1000: the DELETE is refused (409) while the agent has a running task; the sentence also appears at ADMIN L218 and API L2149 in similar form. [defects, defects #193015]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-a5c77069b9
Admin handbook: The rotation procedure passes the new secret with -e while the same command keeps --env-file ./woodpecker.env, which still holds the OLD secret, and never tells the customer to update the file. [defects, defects #195948]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-64910da7d0
API guide: Round-3 finding paraphrased in sections the fix missed: 'signature verification' is left undefined (API L535, L585, L920, L1531 and ADMIN 'Public key for verifying signatures'), while L2286 already… [defects, defects #195949]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-88dec4f4df
Database handbook: Repeats the round-3 finding 'This is required': the server starts without WOODPECKER_HOST (it only logs a warning) and without WOODPECKER_AGENT_SECRET (API guide L2073 says so). [defects, defects #195950]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-8bb7ddd822
API guide: Round-4 major paraphrased in the API guide: the shared-secret run command passes WOODPECKER_AGENT_SECRET with -e while the same command keeps --env-file ./woodpecker.env (which the guide's own… [defects, defects #197304]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-e538525052
API guide: The rotation procedure of the round-4 major is still not fixed here: it says to recreate the server 'with the new value' directly under a command that passes the secret with -e next to --env-file,… [defects, defects #197305]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-aa9df8e939
API guide: Rotation step paraphrases the round-4 major: 'the new value' is passed without telling the customer to update the env file the standard command reads on every start. [defects, defects #197306]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-44659bf099
API guide: Rotation step paraphrases the round-4 major: 'the new value' is passed without telling the customer to update the env file the standard command reads on every start. [defects, defects #197307]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-e5b8197fb9
API guide: Rotation step paraphrases the round-4 major: 'the new value' is passed without telling the customer to update the env file the standard command reads on every start. [defects, defects #197308]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-94904e17ae
Admin handbook: Rotation step paraphrases the round-4 major: 'the new value' is passed without telling the customer to update the env file the standard command reads on every start. [defects, defects #197309]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-8d99f941ed
Database handbook: Rotation step paraphrases the round-4 major: 'the new value' is passed without telling the customer to update the env file the standard command reads on every start. [defects, defects #197310]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-8984d850fd
Database handbook: Repeats the round-3/4 finding 'This is required': the server starts without WOODPECKER_AGENT_SECRET; only a configured forge is needed to start. [defects, defects #197311]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-fd54058e62
Admin handbook: 'must contain ... a long random agent secret' repeats the 'required' error: the server starts without WOODPECKER_AGENT_SECRET. [defects, defects #197312]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-b826d2d584
Admin handbook: Same 'required' error: 'must contain ... [defects, defects #197313]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-6e17481685
API guide: 'must set ... an agent secret' repeats the 'required' error; the same guide says at L2073 that the server starts without it. [defects, defects #197314]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-c93763f019
Admin handbook: The stated condition for the HTTP 500 is wrong and the remedy over-broad: the second POST fails only while the earlier added user has not yet signed in (forge_remote_id still 0), not while that user… [defects, defects #197315]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-2e031bf68f
Admin handbook: The stated condition for the HTTP 500 is wrong and the remedy over-broad: the second POST fails only while the earlier added user has not yet signed in (forge_remote_id still 0), not while that user… [defects, defects #197316]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-3cbe864276
Admin handbook: The stated condition for the HTTP 500 is wrong and the remedy over-broad: the second POST fails only while the earlier added user has not yet signed in (forge_remote_id still 0), not while that user… [defects, defects #197317]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-051802951d
API guide: The stated condition for the HTTP 500 is wrong and the remedy over-broad: the second POST fails only while the earlier added user has not yet signed in (forge_remote_id still 0), not while that user… [defects, defects #197318]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-83c4f32486
API guide: The stated condition for the HTTP 500 is wrong and the remedy over-broad: the second POST fails only while the earlier added user has not yet signed in (forge_remote_id still 0), not while that user… [defects, defects #197319]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-1ea17287f5
API guide: The stated condition for the HTTP 500 is wrong and the remedy over-broad: the second POST fails only while the earlier added user has not yet signed in (forge_remote_id still 0), not while that user… [defects, defects #197320]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-277e0cc339
API guide: The stated condition for the HTTP 500 is wrong and the remedy over-broad: the second POST fails only while the earlier added user has not yet signed in (forge_remote_id still 0), not while that user… [defects, defects #197321]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-9ba8e50bf0
API guide: The stated condition for the HTTP 500 is wrong and the remedy over-broad: the second POST fails only while the earlier added user has not yet signed in (forge_remote_id still 0), not while that user… [defects, defects #197322]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-57a51cd46b
API guide: The stated condition for the HTTP 500 is wrong and the remedy over-broad: the second POST fails only while the earlier added user has not yet signed in (forge_remote_id still 0), not while that user… [defects, defects #197323]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-b29f9438f2
API guide: The stated condition for the HTTP 500 is wrong and the remedy over-broad: the second POST fails only while the earlier added user has not yet signed in (forge_remote_id still 0), not while that user… [defects, defects #197324]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:34ecdf21c55d620ceb48f5b0b7c2e5038975945bb289216aaa91ae47f0bd53ea · published digest sha256:34ecdf21c55d620ceb48f5b0b7c2e5038975945bb289216aaa91ae47f0bd53ea · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 166) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T15:15:10Z · failing Docker Scout counts 11 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T15:15:00Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3766597799 · transparency-log entry · integrated 2026-11-09T15:18:12Z) [ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:c9a37524cca176db982104db7aa087782321bb170274f4e77ebc4e7e887d6f33 · state attached · log index 3766598550 · transparency-log entry
    • kind sbom · digest sha256:c9a37524cca176db982104db7aa087782321bb170274f4e77ebc4e7e887d6f33 · state attached · log index 3766599037 · transparency-log entry
    • kind vsa · digest sha256:c9a37524cca176db982104db7aa087782321bb170274f4e77ebc4e7e887d6f33 · state attached · log index 3766599434 · transparency-log entry
    • kind provenance · digest sha256:34ecdf21c55d620ceb48f5b0b7c2e5038975945bb289216aaa91ae47f0bd53ea · state attached · log index 3766600052 · transparency-log entry
    • kind sbom · digest sha256:34ecdf21c55d620ceb48f5b0b7c2e5038975945bb289216aaa91ae47f0bd53ea · state attached · log index 3766600624 · transparency-log entry
    • kind vsa · digest sha256:34ecdf21c55d620ceb48f5b0b7c2e5038975945bb289216aaa91ae47f0bd53ea · state attached · log index 3766601307 · transparency-log entry
    (at 2026-11-09T15:18:13Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/woodpecker/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T00:22:46Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:34ecdf21c55d620ceb48f5b0b7c2e5038975945bb289216aaa91ae47f0bd53ea [clean-room rebuild ledger, runs[676]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-08T17:07:35Z [stage_runs, stage_runs chain 894 stage publish_image]
  • Archive manifests written2026-11-09T15:16:47Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 64 · probed 2026-11-09T15:17:51Z · source g8) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T15:19:32Z generated: by KitForge release/build_trail.py · generator commit 60e683e982890f94be6ec847d4971fb308805ca8
  • 2026-11-09T15:20:53Z publication: promoted at 2026-11-09T15:20:06Z · promoted digest sha256:c9a37524cca176db982104db7aa087782321bb170274f4e77ebc4e7e887d6f33 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 418 · checklist status complete · checklist at 2026-11-09T15:20:53Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

26 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/woodpecker/v3.20.1-CE-ubuntu24.04-r1/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/woodpecker/v3.20.1-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/woodpecker/v3.20.1-CE-ubuntu24.04-r1/), as staged for publishing—
ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/woodpecker/v3.20.1-CE-ubuntu24.04-r1/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/woodpecker/v3.20.1-CE-ubuntu24.04-r1/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)590
chainssadb, ReadyStack's engine database (not published)736, 894
defectssadb, ReadyStack's engine database (not published)woodpecker v3.20.1-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 736, chain 894
held_roundssadb, ReadyStack's engine database (not published)chain 894
lesson_recallssadb, ReadyStack's engine database (not published)chain 894
micro_step_runssadb, ReadyStack's engine database (not published)chain 894
release_imagessadb, ReadyStack's engine database (not published)woodpecker v3.20.1-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 894
stage_runssadb, ReadyStack's engine database (not published)chain 894
watch_queuesadb, ReadyStack's engine database (not published)12443
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—