Zabbix 7.4.16-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/zabbix:7.4.16-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/zabbix:7.4.16-CE-ubuntu24.04-r2
  • Index digestsha256:6be5b237ce49c1bb255d53858c729e4f54e912220f67a569f3b36c1cb3ec6a7c
  • linux/amd64 digestsha256:a076e237d9451ae3032a101d985d6009cc8e822ae5e7800d0f4c08442a32430a
  • ArchiveReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 now79cc53a828aed550a8598a2f009740575c48ce12ece10321e94dcbd6ffa2a2a7
  • Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
  • Sections9 sections, 4 fully recorded; 10 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.trail.json
ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.trail.jsonReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.trail.mdZabbix product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

1 item not recorded
  • ProductZabbix (zabbix) [MANIFEST.json]
  • Release tag7.4.16-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/zabbix:7.4.16-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:6be5b237ce49c1bb255d53858c729e4f54e912220f67a569f3b36c1cb3ec6a7c [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:a076e237d9451ae3032a101d985d6009cc8e822ae5e7800d0f4c08442a32430a [ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.tar.gz (bytes 380102315) [MANIFEST.json]
  • Archive sha256 at publishf4c050b74012117b34e49bc0278d84c0e8f385946444e5b546f77913b55ed65d [MANIFEST.json, repack_history[0].previous_tarball_sha256]
  • Archive sha256 now79cc53a828aed550a8598a2f009740575c48ce12ece10321e94dcbd6ffa2a2a7 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack history
    • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 f4c050b74012117b34e49bc0278d84c0e8f385946444e5b546f77913b55ed65d · sha256 79cc53a828aed550a8598a2f009740575c48ce12ece10321e94dcbd6ffa2a2a7 · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
    [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/zabbix/zabbix [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref7.4.16 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitb90dda2ec5983a92c9671550b5e32947cf241cd2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash1f86bf79232abe846e52688eac4f5fd49ca1d82f943844e1a342e0094ec5f931 (files 6887) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:d7a98306c5bf0b3a4e5daee765c70141a6889efbfe6556a6efaecaff6e19b3e9 [ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1792496804 (utc 2026-10-20T11:46:44Z) [ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded
  • Chain696 (created 2026-10-27T13:37:48Z · trigger customer_request · upstream version 7.4.16) [chains, chains #696]
  • Requestbuild request #373 (rebuild) (requested at 2026-10-27T02:37:31Z · requested by kitforge-agent · version 7.4.16) [build_requests, build_requests #373]
  • Reasonrevision 7.4.16-CE-ubuntu24.04-r2: same upstream version rebuilt (retarget.py --rev-bump) [build_requests, build_requests #373 request_reason]
  • Supersedesreadystack/zabbix:7.4.16-CE-ubuntu24.04-r1 (chain 608) [chains, chains #608]

The path through the harness

2 items not recorded

1 chain · 5 drives · 18 stages · 3 rewinds

Chain 696 release · shipped

Created 2026-10-27T13:37:48Z, upstream 7.4.16, build request 373 [chains, chains #696]

DriveStartedMinutesBuild hostHow it stopped
9692026-10-27T13:38:48Z40build host 5 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #969] rebuilt from a build line's log
9742026-10-27T15:11:41Z10.8build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #974] rebuilt from a build line's log
9762026-10-27T16:21:07Z4.6build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #976] rebuilt from a build line's log
9802026-10-27T17:04:57Z4.7build host 5 withhold-publish ready_to_ship [drive_runs, drive_runs #980] rebuilt from a build line's log
9982026-10-28T03:49:01Z13.3build host 5 publish-held shipped [drive_runs, drive_runs #998] rebuilt from a build line's log

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-27T13:38:54Z2026-10-27T13:38:55Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-27T13:39:09Z2026-10-27T13:39:10Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-27T13:39:52Z2026-10-27T13:39:53Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-27T13:45:48Z2026-10-27T13:45:49Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 —
remediate 2026-10-27T13:46:40Z2026-10-27T13:46:41Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 —
build_kit 2026-10-27T13:56:31Z2026-10-27T13:56:32Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 —
verdict 2026-10-27T13:57:38Z2026-10-27T13:57:39Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 —
publish_image 2026-10-27T13:58:34Z2026-10-27T13:58:34Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 —
boot_instance 2026-10-27T13:59:05Z2026-10-27T13:59:07Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 —
sbom 2026-10-27T13:59:22Z2026-10-27T13:59:23Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 —
schema_discovery 2026-10-27T13:59:24Z2026-10-27T13:59:25Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 —
admin_handbook 2026-10-27T14:05:04Z2026-10-27T14:05:05Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 —
db_handbook 2026-10-27T14:11:08Z2026-10-27T14:11:09Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 —
seed_data 2026-10-27T14:11:15Z2026-10-27T14:11:16Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 —
seed_validate 2026-10-27T14:11:17Z2026-10-27T14:11:18Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 —
usecase_validate 2026-10-27T14:11:34Z2026-10-27T14:11:34Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 —
finalize_docs 2026-10-27T14:17:27Z2026-10-27T14:17:28Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 —
package_archive 2026-10-27T14:18:49Z2026-10-28T04:02:14Z5
33 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 scout_grade_a
  • G8 script_copies
  • G8 three_way_sha
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 assetchain_coverage
 —

[stage_runs]

Rewinds

  • 2026-10-27T15:42:45Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2299]
  • 2026-10-27T16:45:12Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2300]
  • 2026-10-28T03:48:27Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #1183]
  • Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
  • Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-10-28T04:02:14Z.

96 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook26903 not recordednot recorded —
db_handbook351403 not recordednot recorded —
finalize_docs311003 not recordednot recorded —

[micro_step_runs]

  • Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
  • Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

2 items not recorded

Role: review model.

3 rounds, 3 counted, $4.54 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-10-27T15:23:22Z 52516 findings to repackage [held_rounds, held_rounds #224] rebuilt from a held-review state file $1.82 not recorded not recorded
22026-10-27T16:28:43Z 066 findings to repackage [held_rounds, held_rounds #225] rebuilt from a held-review state file $1.54 not recorded not recorded
32026-10-27T17:10:31Z 003 clean to publish [held_rounds, held_rounds #226] rebuilt from a held-review state file $1.18 not recorded not recorded
  • Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
  • Not recorded: the round cap in force at each round (the state files did not keep it)

Defects

Fully recorded
  • Ledger entries62 [defects, defects where product_slug=zabbix and this tag or chain]
  • Disclosed in the archive61 [docs/defects/defects.json, entries]

62 ledger entries: by severity critical 5, high 32, low 25; by status fixed-before-release 60, open 1, fixed-in-release 1.

DefectSeverityStatusFound byFixed in
RSD-zabbix-da966307b1
Admin handbook: The restore command has no -d, so psql connects to the default database (named after the user, i.e. [defects, defects #76763]		criticalfixed-before-releaseheld review (review model)—
RSD-zabbix-ad5cfbcb16
Ships a known default credential (Admin) [defects, defects #111334]		highopenbuild strategy record—
RSD-zabbix-86db801f76
The Docker Hub run example puts POSTGRES_PASSWORD on the command line (-e), where the shell's history keeps it [defects, defects #113492]		lowfixed-in-releaseagent case study7.4.16-CE-ubuntu24.04-r2
RSD-zabbix-2966447352
Admin handbook: The paragraph tells the customer to start the server against the empty database first (which loads the schema) and then restore into that initialized database, and in the next sentence forbids… [defects, defects #113793]		criticalfixed-before-releaseheld review (review model)—
RSD-zabbix-01f0556caa
Admin handbook: The restore command combines -t with standard input redirected from backup.sql; docker refuses ("the input device is not a TTY") and nothing is restored. [defects, defects #113794]		criticalfixed-before-releaseheld review (review model)—
RSD-zabbix-1db1e83f03
Admin handbook: The text above says to restore into a new empty database, but the command restores into `zabbix`, the database the backup came from. [defects, defects #113795]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-10c363c721
Database handbook: The restore block (opened by `docker run -it --rm \` at line 595) uses -t with stdin redirected from a file; docker rejects it, so the documented restore fails. [defects, defects #113796]		criticalfixed-before-releaseheld review (review model)—
RSD-zabbix-b9eebcee06
Database handbook: Same restore command as line 595 (-it with `< backup.sql`); it fails before psql runs, so the documented Backup and Restore procedure does not work. [defects, defects #113797]		criticalfixed-before-releaseheld review (review model)—
RSD-zabbix-c4113ad456
Admin handbook: The backup runs with -it while stdout is redirected to a file (a TTY adds carriage returns to the dump, or docker refuses outright) and passes no PGPASSWORD, so a password prompt would be written… [defects, defects #113798]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-d30999ea7f
Admin handbook: The backup redirects stdout to a file while allocating a TTY (-t); the dump can be corrupted by the pseudo-terminal. [defects, defects #113799]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-338f7dc012
Database handbook: The pg_dump backup is redirected to backup.sql while -t allocates a TTY, which corrupts the dump (or docker refuses when stdin is not a terminal). [defects, defects #113800]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-e26aeec37c
Admin handbook: Without -it the command cannot prompt, and the container has no PGPASSWORD (only POSTGRES_PASSWORD), so psql fails with "no password supplied". [defects, defects #113801]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-eb5ae7e7cf
Admin handbook: `required` is not a valid libpq sslmode (the container never starts), and the claim that allow/prefer do not enforce TLS is false for the server connection: the entrypoint sets DBTLSConnect=required… [defects, defects #113802]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-c063b129d1
Database handbook: Contradicts lines 102, 153 and 895 of the same handbook; with allow/prefer the server does enforce TLS. [defects, defects #113803]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-99b0d21ccc
Database handbook: `prefer` is presented as the value that is the default when unset and as non-enforcing; setting it explicitly changes behaviour (server requires TLS), unlike leaving it unset. [defects, defects #113804]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-ce24a81dfb
Database handbook: The environment variable `DBTLSCAFile` is not read by the entrypoint (only ZBX_CONF_-prefixed names), so the server never gets the CA file; and without DBTLSConnect=verify_full the server does not… [defects, defects #113805]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-316d37a307
API guide: The server's own database connection is configured for encryption only, never certificate validation, so verify-full is not honoured by zabbix_server as described. [defects, defects #113806]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-7c56088cd9
API guide: The example mounts the CA at /var/lib/zabbix/postgresql/root.crt without PGSSLROOTCERT; libpq does not read that path, so verify-full fails with "root certificate file … does not exist". [defects, defects #113807]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-b51927ba41
Admin handbook: The variable name is misspelled (PGSQLROOTCERT); a customer who sets it gets no certificate verification, and the default file name is root.crt, not root.cert. [defects, defects #113808]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-d3445529e3
Admin handbook: False: the default start (no TLS parameters) is healthy and the quick start never sets them. [defects, defects #113809]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-63109df839
Admin handbook: An --env-file value becomes a container environment variable and is printed in full by docker inspect, so the stated protection is false. [defects, defects #113810]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-3fb3c08f2d
Admin handbook: Telling the customer that a restored database makes the initialization fail contradicts line 519 and the entrypoint, and steers them away from the working restore flow. [defects, defects #113811]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-650bb9181e
Admin handbook: The quoted log line does not exist. [defects, defects #113812]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-ab2eeae123
API guide: Contradicts line 839 of the same guide ("cannot start without a valid connection") and the entrypoint. [defects, defects #113813]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-b6e027a2e6
API guide: The entrypoint does not create the database; contradicts line 330 ("The database must exist"). [defects, defects #113814]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-860f931165
API guide: The procedure never loads the dump: the customer would end up with a fresh empty Zabbix database and believe the backup was restored. [defects, defects #113815]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-c90d574084
API guide: The entrypoint never attempts the load on an initialized database, so this "already exists" failure does not happen at container start (it only happens with a manual psql restore). [defects, defects #113816]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-0743b8b897
API guide: The sentence is garbled and contradicts the preceding clause ("enforcing TLS"). [defects, defects #113817]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-4bfcd21006
API guide: The parameters named secure the PostgreSQL connection, not the trapper port; a customer following this keeps agent traffic unencrypted while believing it is protected. [defects, defects #113818]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-219a4ff4b8
API guide: The paragraph says the image contains no setuid wrappers and then that the container starts with no-new-privileges; both are false for the documented run command and contradict the admin handbook. [defects, defects #113819]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-8df7dd7bbd
API guide: Misspelled parameter name; a customer who copies it gets a container that exits at start. [defects, defects #113820]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-6efcf4a582
API guide: Environment variable names are unique, so "one per variable" with the same name keeps only the last module; the others are silently unused (the error class the previous round recorded). [defects, defects #113821]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-3b3c4cd5c7
Database handbook: The same variable twice collapses to one value, so module1.so is never loaded and no error mentions it. [defects, defects #113822]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-0f0b1b2e20
Database handbook: An active agent configured only with Server never contacts the trapper; no data arrives. [defects, defects #113823]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-661a1858d5
Database handbook: States the default as `disable`, which contradicts lines 102/376 and the entrypoint (unset means no PGSSLMODE and no DBTLSConnect line). [defects, defects #113824]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-58178f2a6c
Database handbook: Contradicts lines 279-280 ("approximately 50 worker processes"). [defects, defects #113825]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-a4a662aa64
Database handbook: Overstated; contradicts the Security Considerations section. [defects, defects #113826]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-072a0bb142
Database handbook: Says "three mandatory" and then lists an optional one. [defects, defects #113827]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-bb40e63b06
Database handbook: The same mount is described three different ways in the handbook (also line 126 "server-to-database or server-to-agent"); this one mentions an API connection that does not exist. [defects, defects #113828]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-926c751601
Database handbook: The sentence is garbled: a PostgreSQL client container has nothing to do with the netcat probe. [defects, defects #113829]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-77fea1cb6b
Admin handbook: Inconsistent descriptions of the mount between sections of the same handbook. [defects, defects #113830]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-aaffe633c8
Admin handbook: Dangling cross-reference. [defects, defects #113831]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-f3b07e5966
Admin handbook: The example puts the password on the command line and also passes --env-file, contradicting the handbook's own security guidance. [defects, defects #113832]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-c66249b2fc
Admin handbook: Wrong path. [defects, defects #113833]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-839f327d07
API guide: Contradicts the admin handbook line 354 (only *.conf). [defects, defects #113834]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-a9b3eed211
API guide: Wrong reference. [defects, defects #113835]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-460ed39236
Release notes: Doubled punctuation in a generated sentence. [defects, defects #113836]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-2ccbc3a0bf
API guide: Previous-round major not fixed. [defects, defects #115829]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-074b18606e
API guide: Plain DBTLSConnect is not read by the entrypoint (only ZBX_CONF_-prefixed names reach zabbix_server.conf; entrypoint script compgen -v ZBX_CONF_), and the entrypoint already writes… [defects, defects #115830]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-4a32f81b28
Admin handbook: Upstream Zabbix frontend (zabbix.conf.php $ZBX_SERVER/$ZBX_SERVER_PORT; manual 'Zabbix server is not running' status check, Execute now) connects to the server's trapper port 10051. [defects, defects #115831]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-c60b9c4fb7
API guide: Same class as admin handbook line 295: upstream frontend connects to server port 10051 (ZBX_SERVER setting). [defects, defects #115832]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-d708ab0a9e
Admin handbook: Zabbix has no /api/json route; the API is api_jsonrpc.php (upstream API manual; strategy doc_facts.api_base and NOT_TRUE name api_jsonrpc.php); every other API sentence in the three guides uses… [defects, defects #115833]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-9c7a3171e3
Database handbook: A passive agent never contacts the server; the server polls it on 10050 (upstream agent docs). [defects, defects #115834]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-1113dac0f8
Admin handbook: Ran psql < dump into the live initialised database: 1011 'already exists' and 1218 ERROR lines, value I had changed afterwards stayed changed (Admin name still CHANGED, not the dump's ORIGINALVAL). [defects, defects #115835]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-ef3fab6b66
Database handbook: Entrypoint writes Include=/etc/zabbix/zabbix_server.d/*.conf only (strategy runtime_scaffold); admin handbook lines 353 and 178 say only .conf files; ran with a.conf/b.conf/x.txt: only the .conf… [defects, defects #115836]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-47478c564c
Database handbook: doc_facts.ports lists agents in active mode, zabbix_sender and proxies; there are no server-to-server links on the trapper port; every other section of this handbook omits them. [defects, defects #115837]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-86d069525b
API guide: Passive agents are polled by the server (upstream), they do not connect to 10051; contradicts the guide's own lines 464-468 (only active-mode agents, sender, proxies). [defects, defects #115838]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-8b209b6eac
API guide: allow and prefer do not require TLS for the libpq schema load (libpq semantics; DB handbook line 893 says so). [defects, defects #115839]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-4c78f288c5
Database handbook: The entrypoint sets SSLCertLocation/SSLKeyLocation/SSLCALocation under /var/lib/zabbix/ssl for web monitoring only; proxy and agent TLS use the TLS*File parameters whose paths can point anywhere… [defects, defects #115840]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-98f0229d03
API guide: strategy runtime_scaffold: entrypoint writes SSLCertLocation/SSLKeyLocation/SSLCALocation=/var/lib/zabbix/ssl/{certs,keys,ssl_ca} (web monitoring only); admin handbook Optional Mounts and DB… [defects, defects #116738]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-79cbdf8a89
API guide: Upstream: the server upgrades the DB schema (dbversion) at start and the frontend checks it against its own DB version ('The frontend does not match Zabbix database'), so a frontend left on another… [defects, defects #116739]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-ec6678b1c7
Database handbook: Upstream agent docs: active checks are requested by periodic connections (RefreshActiveChecks, send buffer) to ServerActive; no persistent connection is kept and the server sends no jobs to an… [defects, defects #116740]		lowfixed-before-releaseheld review (review model)—

Verification

2 items not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:a076e237d9451ae3032a101d985d6009cc8e822ae5e7800d0f4c08442a32430a · published digest sha256:a076e237d9451ae3032a101d985d6009cc8e822ae5e7800d0f4c08442a32430a · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 272) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 696 package_archive gate_result.g8.result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-28T03:49:27Z · failing Docker Scout counts 126 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • First own scan of the releaseA (at 2026-10-28T04:02:24Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-27T06:30:41Z) [image_scans, image_scans #1368]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-28T03:49:10Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3632764935 · transparency-log entry · integrated 2026-11-01T14:42:03Z) [ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:6be5b237ce49c1bb255d53858c729e4f54e912220f67a569f3b36c1cb3ec6a7c · state attached · log index 3533099815 · transparency-log entry
    • kind sbom · digest sha256:6be5b237ce49c1bb255d53858c729e4f54e912220f67a569f3b36c1cb3ec6a7c · state attached · log index 3533100355 · transparency-log entry
    • kind vsa · digest sha256:6be5b237ce49c1bb255d53858c729e4f54e912220f67a569f3b36c1cb3ec6a7c · state attached · log index 3533100801 · transparency-log entry
    • kind provenance · digest sha256:a076e237d9451ae3032a101d985d6009cc8e822ae5e7800d0f4c08442a32430a · state attached · log index 3533101142 · transparency-log entry
    • kind sbom · digest sha256:a076e237d9451ae3032a101d985d6009cc8e822ae5e7800d0f4c08442a32430a · state attached · log index 3533101508 · transparency-log entry
    • kind vsa · digest sha256:a076e237d9451ae3032a101d985d6009cc8e822ae5e7800d0f4c08442a32430a · state attached · log index 3533102207 · transparency-log entry
    (at 2026-10-28T03:59:52Z) [attestations.json, results]

Offline clean-room rebuilds

  • 2026-10-27T15:23:25Z on build host 5 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:a076e237d9451ae3032a101d985d6009cc8e822ae5e7800d0f4c08442a32430a [clean-room rebuild ledger, runs[468]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
  • Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

Fully recorded
  • Image pushed (internal tag), publish_image passed2026-10-27T13:58:34Z [stage_runs, stage_runs chain 696 stage publish_image]
  • Release tag promoted2026-10-28T04:01:28Z (method imagetools_create_retag_by_digest_no_rebuild · digest sha256:6be5b237ce49c1bb255d53858c729e4f54e912220f67a569f3b36c1cb3ec6a7c · tag readystack/zabbix:7.4.16-CE-ubuntu24.04-r2) [deliverables/provenance/PROMOTION_RECORD.json, promoted_at]
  • Archive manifests written2026-10-28T03:52:02Z [PUBLISH_MANIFEST.json, published_at]
  • Archive cut over on prodasset, package_archive passed2026-10-28T04:02:14Z [stage_runs, stage_runs chain 696 stage package_archive]
  • Cut-over markerpresent (chain 696) [.cutover.json]
  • Release checklist and site event2026-10-28T04:02:12Z (status complete · site event 245 · steps grade a verified done · release tag promoted done · cosign signed done · release evidence recorded done · contract gate passed done · archive published done · hub readme live done · reproducibility recorded done · defects ledger published done · catalog available done · build request fulfilled done · seo regenerated skipped · site catalogue refreshed done · site grade recorded done · site queue synced done · customer requests charged done · owners notified done) [deliverables/provenance/RELEASE_CHECKLIST.json, run_at]

Packages and CPU level

Fully recorded
  • Packages in the image145 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 869 · probed 2026-11-02T17:12:44Z · source backfill) [release_images, isa_level_hard]

History

1 event
  • 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.tar.gz)—
.cutover.jsonbeside the archive (prodasset /data/production/zabbix/7.4.16-CE-ubuntu24.04-r2/)—
MANIFEST.jsonbeside the archive (prodasset /data/production/zabbix/7.4.16-CE-ubuntu24.04-r2/)—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/zabbix/7.4.16-CE-ubuntu24.04-r2/)—
ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/zabbix/7.4.16-CE-ubuntu24.04-r2/)—
ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/zabbix/7.4.16-CE-ubuntu24.04-r2/)—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/zabbix/7.4.16-CE-ubuntu24.04-r2/)—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)373
chainssadb, ReadyStack's engine database (not published)696
defectssadb, ReadyStack's engine database (not published)zabbix 7.4.16-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 696
held_roundssadb, ReadyStack's engine database (not published)chain 696
image_scanssadb, ReadyStack's engine database (not published)1368
micro_step_runssadb, ReadyStack's engine database (not published)chain 696
release_imagessadb, ReadyStack's engine database (not published)zabbix 7.4.16-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 696
stage_runssadb, ReadyStack's engine database (not published)chain 696
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/RELEASE_CHECKLIST.jsonthe chain's workspace on the controller (not published)—