Woodpecker v3.20.1-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/woodpecker:v3.20.1-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/woodpecker:v3.20.1-CE-ubuntu24.04-r2
  • Index digestsha256:cf5deacba0a709a244dbef42535a6018f68821d5304750a5fa67216259a22326
  • linux/amd64 digestsha256:5bfc6ee2996955d554260ecf7057f2b7e17908460299aa905d79d51c2f73add8
  • ArchiveReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now536371bdff5dd6073cc487bea425c890e3e6e13480d0a9e302846041181b6180
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-13T14:39:40Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.trail.json
ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.trail.jsonReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.trail.mdWoodpecker product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductWoodpecker (woodpecker) [MANIFEST.json]
  • Release tagv3.20.1-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/woodpecker:v3.20.1-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:cf5deacba0a709a244dbef42535a6018f68821d5304750a5fa67216259a22326 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:5bfc6ee2996955d554260ecf7057f2b7e17908460299aa905d79d51c2f73add8 [ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.tar.gz (bytes 510725488) [MANIFEST.json]
  • Archive sha256 at publish536371bdff5dd6073cc487bea425c890e3e6e13480d0a9e302846041181b6180 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/woodpecker-ci/woodpecker [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv3.20.1 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit3f1bb0bd0db28e410ad797034d75780116122c91 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashd66ceaca9c7b409dcb5c895a1aa9e92a77c3345e3a99f9125c0cba89bd06e09c (files 1736) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:3b5880f55823a2554e9b5c0a468f5098259d3a0a249e7461047d45d16879b210 [ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1794451837 (utc 2026-11-12T02:50:37Z) [ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.27.4-bookworm@sha256:4fa7c968ba93f1635670522dbb01a2c78150443e1385746924566079f36570ea · platform digest sha256:fb7cceb528b47141eccd9b60bf3cbd27d5ef5f8cf5b7d338bec866da495b50dc
    • ref ubuntu:24.04@sha256:2198e4c65076e9cb0b3d695219df667c0e3b0072da64ca3c2648aca17dcecaf5 · platform digest sha256:77eb101c607d6e3d4f5ad0c8a02c2136c689b98aba1f359e6502ba517e5c57ec
    [ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit 53328f4754ecefc18b308504e3b02f89c9062497 · dirty yes · first drive 4556
    • commit 22bd7fe105ce4abd921b562e7fdb46640eaaf501 · dirty yes · first drive 4589
    • commit cc13315a73108cc715b57a3d1601c0f1860900dc · dirty yes · first drive 4596
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain1065 (created 2026-11-13T10:28:20Z · trigger customer_request · upstream version v3.20.1) [chains, chains #1065]
  • Requestbuild request #420 (rebuild) (requested at 2026-10-27T20:09:24Z · requested by kitforge-agent · version v3.20.1) [build_requests, build_requests #420]
  • Reasonrevision v3.19.0-CE-ubuntu24.04-r3: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #420 request_reason]
  • Supersedesreadystack/woodpecker:v3.20.1-CE-ubuntu24.04-r1 (chain 894) [chains, chains #894]

The path through the harness

Fully recorded

2 chains · 6 drives · 18 stages · 2 rewinds

Chain 736 behind it · abandoned

Created 2026-10-28T00:03:55Z, upstream v3.19.0, build request 420 [chains, chains #736]

Abandoned: chain 736 abandoned: stale (it targets 'v3.19.0', the strategy 'v3.20.1') [watch_queue, watch_queue #12443 resolution]

DriveStartedMinutesBuild hostHow it stopped
8182026-10-28T00:04:17Z50.5build host 4 withhold-publish ready_to_ship [drive_runs, drive_runs #818] rebuilt from a build line's log
8242026-10-28T03:14:41Z7.5build host 4 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #824] rebuilt from a build line's log
37552026-11-08T10:09:30Z2.1build host 4 withhold-publish stage_failed at assemble_kit; first failed check exists:first_build_digest; 1 tick [drive_runs, drive_runs #3755]

Chain 1065 release · ready_to_ship

Created 2026-11-13T10:28:20Z, upstream v3.20.1, build request 420 [chains, chains #1065]

DriveStartedMinutesBuild hostHow it stopped
45562026-11-13T10:28:48Z61.8build host 3 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #4556]
45892026-11-13T14:04:59Z3.6build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #4589]
45962026-11-13T14:34:55Z—build host 3 publish-held not recorded [drive_runs, drive_runs #4596]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-13T10:28:59Z2026-11-13T10:29:00Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json cf2a7df0b7ef…
acquire 2026-11-13T10:29:05Z2026-11-13T10:29:06Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 4f00153b23ba…
license_file a203768e1e09…
custody_inputs 1c79abc52f50…
source_tree_hash d17811a5866e…
source_file_manifest f348a3fa4f1e…
plan 2026-11-13T10:29:35Z2026-11-13T10:29:36Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report ad7a6baf0106…
input_pin_plan 888d639996cb…
toolchain_lock 3e4be02d5dc1…
assemble_kit 2026-11-13T10:33:51Z2026-11-13T10:33:52Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 3466df66d4ab…
build_recipe 32992401749d…
system_pinning aa8db05a9a8a…
build_offline_sh 6ab4f08a6ec7…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 01fb19e825e1…
verify_offline_sh 3e8184ea230c…
base_image_digests 356b9b3e1bc3…
dockerfile_offline 3466df66d4ab…
first_build_digest 7adb5ff65919…
remediate 2026-11-13T10:34:35Z2026-11-13T10:34:36Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 0c439a0263df…
security_report a5063b901e53…
build_kit 2026-11-13T10:39:48Z2026-11-13T10:39:49Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp c85b57e0d103…
locked_digest 01333031b57e…
freeze_manifest 0f63376cbc9c…
offline_rebuild_transcript 66e74b8b4834…
verdict 2026-11-13T10:40:21Z2026-11-13T10:40:22Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 3137311eed7f…
publish_image 2026-11-13T10:41:02Z2026-11-13T10:41:02Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 7e1c7bd34c89…
promotion_record fe104ec18e67…
boot_instance 2026-11-13T10:41:08Z2026-11-13T10:41:13Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 9e838aef5852…
sbom 2026-11-13T10:41:22Z2026-11-13T10:41:23Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 371e5f6ee92a…
sbom_json d8743aff2ee5…
schema_discovery 2026-11-13T10:41:29Z2026-11-13T10:41:29Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 029353bc0d9d…
dependency_tree d7466562c4b7…
table_classification 1ce3557862ff…
admin_handbook 2026-11-13T10:50:44Z2026-11-13T10:50:45Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map ec55961a5137…
admin_handbook e40557c34880…
db_handbook 2026-11-13T11:00:05Z2026-11-13T11:00:06Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 2ebe2c17f988…
seed_isolation 821dd7281789…
seed_data 2026-11-13T11:00:15Z2026-11-13T11:00:16Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 4f26fa20cbb2…
seed_cases_json 13498101c1a3…
seed_validate 2026-11-13T11:00:20Z2026-11-13T11:00:20Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 50f8e894dbac…
usecase_validate 2026-11-13T11:00:41Z2026-11-13T11:00:42Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests 6c628aacd639…
passed_tests d5222fa0a97f…
test_results 962bc7433eb2…
usecase_contract 88ba81708486…
finalize_docs 2026-11-13T11:18:42Z2026-11-13T11:18:43Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json f374ca8c7cec…
release_notes 798103872b32…
api_integration_guide 0ab7a96582e0…
package_archive invalidated 2026-11-13T14:34:32Z 2026-11-13T11:30:35Z2026-11-13T14:08:36Z2
37 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 unpack_files
  • G8 scout_grade_a
  • G8 script_copies
  • G8 upgrade_check
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar b04dc3acf40c…
checksums 4e0a2a552808…
verify_md c51adcbf8ecd…
rebuild_md d2e3dbc15ca0…
manifest_txt 6d837f2d52f2…
actions_jsonl 3123f75751ec…
provenance_md 8e31375bb30a…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json c69ecd633de9…

[stage_runs]

Rewinds

  • 2026-11-13T11:59:37Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #35851]
  • 2026-11-13T14:34:32Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #36282]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-13T14:08:36Z.

197 calls over 6 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 07356 —
remediate2001 011492 L-A08, L-038, L-036, L-034, L-032
admin_handbook481703 7325485 —
db_handbook461703 5302939 —
usecase_validate1001 01536 —
finalize_docs984503 13689681 —

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

2 rounds, 2 counted, $5.39 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-13T11:31:25Z 1935 findings to repackage [held_rounds, held_rounds #1869] $2.79 3 rounds, $40.00 a27c8bd40e3b…
22026-11-13T14:09:08Z 0013 clean to publish [held_rounds, held_rounds #1885] $2.59 3 rounds, $40.00 b04dc3acf40c…

Defects

Fully recorded
  • Ledger entries58 [defects, defects where product_slug=woodpecker and this tag or chain]
  • Disclosed in the archive58 [docs/defects/defects.json, entries]

58 ledger entries: by severity critical 1, low 48, high 9; by status fixed-before-release 58.

DefectSeverityStatusFound byFixed in
RSD-woodpecker-25fd2af8e2
Admin handbook: The backup command is written with `docker exec -it` and redirected to a file. [defects, defects #279808]		criticalfixed-before-releaseheld review (review model)—
RSD-woodpecker-803c8ab054
Admin handbook: Telling customers they must include -it is wrong for any command whose output is captured; it is what makes the L996 backup unusable. [defects, defects #279809]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-09c96ef6d3
Admin handbook: States the server stores no forge credentials; it stores the OAuth client ID and secret in plain text in the forges table, which every backup file contains. [defects, defects #279810]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-9bc5894231
Admin handbook: Contradicts the rest of the handbooks: the forge settings, including the client secret, are stored in the database in plain text and therefore in every backup. [defects, defects #279811]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-2ded94fc25
Admin handbook: A security statement that is the opposite of what the image does; a customer would treat the database volume and its backups as free of the OAuth client secret. [defects, defects #279812]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-4bd6b91c5c
Admin handbook: Contradicted by the same handbook's backup commands that run sh, cat and sqlite3 from the image. [defects, defects #279813]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-89207bdd62
Admin handbook: Claims the identity of agent processes in this image; the image holds no agent. [defects, defects #279814]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-7ee3990a9e
Admin handbook: Overstates the effect: deleting the record does not drop the live connection. [defects, defects #279815]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-1d421e7188
Admin handbook: Contradicts the measured behaviour and the other handbooks. [defects, defects #279816]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-cea3daf3de
Admin handbook: Unsupported: the startup log has no forge or admin lines. [defects, defects #279817]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-f1f12b60a7
Admin handbook: A mistyped variable is silently ignored, so the stated safety net does not exist. [defects, defects #279818]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-918cd6b7a6
Admin handbook: Advises world-writable permissions and contradicts the handbook's own instruction not to bind-mount. [defects, defects #279819]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-e4792ff752
Admin handbook: Contradicts L503: the endpoint returns only the configured forge. [defects, defects #279820]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-d5b47ef777
Admin handbook: Cross-section contradiction. [defects, defects #279821]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-81aa930e38
Admin handbook: Implies only the first name in the list is made an administrator. [defects, defects #279822]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-fd60487595
Database handbook: Tells the customer the image has bash, tar, curl and perl; `docker exec woodpecker tar ...` or `curl` fails with 'executable file not found', and it contradicts the other two guides. [defects, defects #279823]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-3ab5969efb
Database handbook: Contradicts L544/L567 in the same handbook and the measurement. [defects, defects #279824]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-7aabad9804
Database handbook: Refers to a flag and a tag argument the script does not have. [defects, defects #279825]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-800f416756
Database handbook: Contradicts L341 and misleads the agent setup. [defects, defects #279826]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-33da5838c6
Database handbook: Wrong purpose for the key. [defects, defects #279827]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-f0791cba0c
Database handbook: The script does not use the printed digest. [defects, defects #279828]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-838ac189a5
Database handbook: False requirement. [defects, defects #279829]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-e32675012f
Database handbook: 'Restart' would not apply the new variable. [defects, defects #279830]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-76636d2366
Database handbook: A plain restart does not apply the variable. [defects, defects #279831]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-e4090ca952
API guide: False description of the response; an integration built on it would look for a list of supported types. [defects, defects #279832]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-3c89153ec2
API guide: Tells integrators to rely on the key for webhook authenticity, which it does not provide; contradicts L930. [defects, defects #279833]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-89be43cffc
API guide: Following this sentence, a demotion silently does nothing (HTTP 200, user still admin); omitted fields are not cleared, the update is ignored. [defects, defects #279834]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-35d04ca38d
API guide: Describes clearing behaviour that does not exist for users; it is copied from the agent PATCH. [defects, defects #279835]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-c2944db78a
API guide: Same false PATCH semantics; a demotion sent as a partial record silently fails. [defects, defects #279836]		highfixed-before-releaseheld review (review model)—
RSD-woodpecker-454122e2c5
API guide: The sentence under GET /api/healthz says the check probes that endpoint; it probes /healthz. [defects, defects #279837]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-b95806d118
API guide: Contradicts the measurement and L2762. [defects, defects #279838]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-f475919d6f
API guide: False and contradicted by L1135/L2043. [defects, defects #279839]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-2b5f2e73e0
API guide: 'Required' contradicts three other sections. [defects, defects #279840]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-46ca6acb07
API guide: Says agents use port 8000. [defects, defects #279841]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-a99e42755f
API guide: Contradicts L1254 of the admin handbook and DB L341. [defects, defects #279842]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-3198a10925
API guide: Names a URL variable for Bitbucket that the other sections do not. [defects, defects #279843]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-460cc226ca
API guide: Lists a 500 case under 409. [defects, defects #279844]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-f6992505a5
API guide: Self-contradictory. [defects, defects #279845]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-f1ebc66bcb
API guide: Offers a host directory the guide elsewhere rules out. [defects, defects #279846]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-7110803d08
API guide: Describes a result no record shows; with this image the command cannot run. [defects, defects #279847]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-2ce9b2da9c
API guide: Implies any token can list agents; the agent and user endpoints are administrator-only (also L2813). [defects, defects #279848]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-103fb3482f
API guide: Circular instruction. [defects, defects #279849]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-ddb9463144
API guide: 'Without that token' reads as a request without the header getting 404; it gets 401. [defects, defects #279850]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-818c63a9a1
API guide: 'Different secret' is not the condition. [defects, defects #279851]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-cb1ab3fe14
API guide: `localhost` only works for an agent on the server's own host. [defects, defects #279852]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-2630d5ff7c
API guide: States that a value set in the environment persists in the database; until an agent connects with it, nothing is stored. [defects, defects #283479]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-627ece3a1a
Database handbook: Overstates what is in the database (and so in a backup) before any agent has connected. [defects, defects #283480]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-802e1ed282
API guide: Names a `name` field that does not exist and omits `login` and `avatar_url`, which the PATCH overwrites. [defects, defects #283481]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-41323396dc
API guide: Self-contradictory: 'a new token' versus 'the same token string on every call'. [defects, defects #283482]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-48ef3d305e
API guide: Implies any valid token can read a user record; the whole /api/users group is administrator-only (the neighbouring agent lines say so). [defects, defects #283483]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-8b7202b1e9
API guide: Omits `filters`: a PATCH written exactly as documented silently removes an agent's filters. [defects, defects #283484]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-90bd9818a7
Admin handbook: Same omission as the API guide: `filters` is also overwritten by every PATCH. [defects, defects #283485]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-6958547a2e
Database handbook: Lists two of the three fields the PATCH replaces. [defects, defects #283486]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-8505c1c3a4
Admin handbook: 'Required at every start' contradicts the measured start without it and the other sections. [defects, defects #283487]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-5b7fcbd1e8
Database handbook: A 403 is a valid non-administrator token, not an invalid one, and its body is 'User not authorized'. [defects, defects #283488]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-6a1c5a75d7
Database handbook: The suggested check, GET /api/users/YOUR_LOGIN (L1449), is itself refused with 403 for the non-administrator it is meant to diagnose; and an invalid token gives 401, not 403. [defects, defects #283489]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-042ee4057e
Database handbook: The server does not log anything into `last_contact`; it is an API field. [defects, defects #283490]		lowfixed-before-releaseheld review (review model)—
RSD-woodpecker-51828b4d44
Database handbook: Lists Gitea twice and drops Forgejo. [defects, defects #283491]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:5bfc6ee2996955d554260ecf7057f2b7e17908460299aa905d79d51c2f73add8 · published digest sha256:5bfc6ee2996955d554260ecf7057f2b7e17908460299aa905d79d51c2f73add8 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 150) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, unpack_files, upgrade_check, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-13T14:35:16Z · failing Docker Scout counts 11 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-13T14:35:05Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3856023874 · transparency-log entry · integrated 2026-11-13T14:38:09Z) [ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:cf5deacba0a709a244dbef42535a6018f68821d5304750a5fa67216259a22326 · state attached · log index 3856025920 · transparency-log entry
    • kind sbom · digest sha256:cf5deacba0a709a244dbef42535a6018f68821d5304750a5fa67216259a22326 · state attached · log index 3856027485 · transparency-log entry
    • kind vsa · digest sha256:cf5deacba0a709a244dbef42535a6018f68821d5304750a5fa67216259a22326 · state attached · log index 3856029304 · transparency-log entry
    • kind provenance · digest sha256:5bfc6ee2996955d554260ecf7057f2b7e17908460299aa905d79d51c2f73add8 · state attached · log index 3856030414 · transparency-log entry
    • kind sbom · digest sha256:5bfc6ee2996955d554260ecf7057f2b7e17908460299aa905d79d51c2f73add8 · state attached · log index 3856031295 · transparency-log entry
    • kind vsa · digest sha256:5bfc6ee2996955d554260ecf7057f2b7e17908460299aa905d79d51c2f73add8 · state attached · log index 3856032686 · transparency-log entry
    (at 2026-11-13T14:38:10Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/woodpecker/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-13T11:31:30Z on build host 3 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:5bfc6ee2996955d554260ecf7057f2b7e17908460299aa905d79d51c2f73add8 [clean-room rebuild ledger, runs[826]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-13T10:41:02Z [stage_runs, stage_runs chain 1065 stage publish_image]
  • Archive manifests written2026-11-13T14:36:50Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 64 · probed 2026-11-13T10:37:02Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-13T14:39:40Z generated: by KitForge release/build_trail.py · generator commit cc13315a73108cc715b57a3d1601c0f1860900dc
  • 2026-11-13T14:41:06Z publication: promoted at 2026-11-13T14:40:18Z · promoted digest sha256:cf5deacba0a709a244dbef42535a6018f68821d5304750a5fa67216259a22326 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 547 · checklist status complete · checklist at 2026-11-13T14:41:06Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

26 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/woodpecker/v3.20.1-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/woodpecker/v3.20.1-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/woodpecker/v3.20.1-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-woodpecker-v3.20.1-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/woodpecker/v3.20.1-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/woodpecker/v3.20.1-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)420
chainssadb, ReadyStack's engine database (not published)736, 1065
defectssadb, ReadyStack's engine database (not published)woodpecker v3.20.1-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 736, chain 1065
held_roundssadb, ReadyStack's engine database (not published)chain 1065
lesson_recallssadb, ReadyStack's engine database (not published)chain 1065
micro_step_runssadb, ReadyStack's engine database (not published)chain 1065
release_imagessadb, ReadyStack's engine database (not published)woodpecker v3.20.1-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 1065
stage_runssadb, ReadyStack's engine database (not published)chain 1065
watch_queuesadb, ReadyStack's engine database (not published)12443
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—