Zabbix 7.4.16-CE-ubuntu24.04-r3 build trail

How ReadyStack built readystack/zabbix:7.4.16-CE-ubuntu24.04-r3 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/zabbix:7.4.16-CE-ubuntu24.04-r3
  • Index digestsha256:ba8ac1ec6ca4fa0069205e8f7b0afbd047b2a7f064e95506aae6c1e5c29091f9
  • linux/amd64 digestsha256:25fd0a61d27475735e5c55001559feecbe27f9df662868b4a048070e9c0843e6
  • ArchiveReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.tar.gz
  • Archive SHA-256 now9ef95fd42ea2792572fa1a8cb8fa595819caf6e9c788c3f08c2f0dae0c4853bd
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T11:49:09Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.trail.json.sigstore ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.trail.json
ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.trail.jsonReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.trail.json.sigstoreReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.trail.mdZabbix product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductZabbix (zabbix) [MANIFEST.json]
  • Release tag7.4.16-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Imagereadystack/zabbix:7.4.16-CE-ubuntu24.04-r3 [MANIFEST.json]
  • Image index digestsha256:ba8ac1ec6ca4fa0069205e8f7b0afbd047b2a7f064e95506aae6c1e5c29091f9 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:25fd0a61d27475735e5c55001559feecbe27f9df662868b4a048070e9c0843e6 [ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.tar.gz (bytes 383044565) [MANIFEST.json]
  • Archive sha256 at publish9ef95fd42ea2792572fa1a8cb8fa595819caf6e9c788c3f08c2f0dae0c4853bd [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/zabbix/zabbix [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream ref7.4.16 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commitb90dda2ec5983a92c9671550b5e32947cf241cd2 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash1f86bf79232abe846e52688eac4f5fd49ca1d82f943844e1a342e0094ec5f931 (files 6887) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:7a9037d804358df886aa5b0b9708f2f716543a0bd7bb484c908a04f3ea4abb6b [ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1792496804 (utc 2026-10-20T11:46:44Z) [ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.rebuild.json, engine]
  • Engine commit(s)
    • commit 70e6bdff7c0e7d3ec863993e8fb01b616e6715cb · dirty yes · first drive 3832
    • commit 893ddf91074580cc5f11ded7558920733b65fc43 · dirty yes · first drive 3943
    • commit 33cc96c2cc3645c7bfbc3866df5a3c028834af3e · dirty yes · first drive 3953
    • commit bd03c673f7b4ae28f26a4d6e8a5493262c519ef1 · dirty yes · first drive 3961
    • commit fcb013a47b6acf007f0393214805da1af5e637f1 · dirty yes · first drive 3967
    • commit d5dd95cc70cbde883ad7cde173904a80a5a6a342 · dirty yes · first drive 4007
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain892 (created 2026-11-08T16:29:30Z · trigger customer_request · upstream version 7.4.16) [chains, chains #892]
  • Requestbuild request #575 (rebuild) (requested at 2026-11-08T07:26:03Z · requested by kitforge-agent · version 7.4.16) [build_requests, build_requests #575]
  • Reasonrerelease agenda REVISION -> 7.4.16-CE-ubuntu24.04-r3 (decay loop, IMP-08) [build_requests, build_requests #575 request_reason]
  • Supersedesreadystack/zabbix:7.4.16-CE-ubuntu24.04-r2 (chain 696) [chains, chains #696]

The path through the harness

Fully recorded

1 chain · 6 drives · 18 stages · 4 rewinds

Chain 892 release · ready_to_ship

Created 2026-11-08T16:29:30Z, upstream 7.4.16, build request 575 [chains, chains #892]

DriveStartedMinutesBuild hostHow it stopped
38322026-11-08T16:29:54Z42.2build host 3 withhold-publish stage_failed at package_archive; first failed check exists:checksums; 18 ticks [drive_runs, drive_runs #3832]
39432026-11-09T03:55:09Z8.9build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3943]
39532026-11-09T04:53:45Z4.1build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3953]
39612026-11-09T05:27:06Z4.7build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3961]
39672026-11-09T06:02:23Z4.5build host 3 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3967]
40072026-11-09T11:43:21Z—build host 3 publish-held not recorded [drive_runs, drive_runs #4007]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-08T16:30:05Z2026-11-08T16:30:06Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json 339d2153c3bd…
acquire 2026-11-08T16:30:24Z2026-11-08T16:30:26Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree a5c291b97929…
license_file 0d96a4ff68ad…
custody_inputs a8e76f80219d…
source_tree_hash 3e06ed80dd86…
source_file_manifest 8463026f0b50…
plan 2026-11-08T16:30:58Z2026-11-08T16:30:58Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report 57246fa43a94…
input_pin_plan b315efdfb2f4…
toolchain_lock e0719e2bef2d…
assemble_kit 2026-11-08T16:36:48Z2026-11-08T16:36:49Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 79a3518880c4…
build_recipe a885d79c9b91…
system_pinning 33bc7bc47ce9…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health 85fbad4ffc7d…
verify_offline_sh 3e8184ea230c…
base_image_digests 1e09fe3fa2d7…
dockerfile_offline 79a3518880c4…
first_build_digest 80c5983481d8…
remediate 2026-11-08T16:37:12Z2026-11-08T16:37:12Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log e41bdbfed2fc…
security_report 57d3167eb5c5…
build_kit 2026-11-08T16:45:36Z2026-11-08T16:45:37Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp dc8c4ce1b1a4…
locked_digest 4a90809e5d72…
freeze_manifest 2799dfce9fbb…
offline_rebuild_transcript 52ca363ef61f…
verdict 2026-11-08T16:46:31Z2026-11-08T16:46:32Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict 9ba889ea41f6…
publish_image 2026-11-08T16:47:11Z2026-11-08T16:47:12Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme 9f748648ade9…
promotion_record 01762e82f6ae…
boot_instance 2026-11-08T16:47:42Z2026-11-08T16:47:46Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 09d83d3e9605…
sbom 2026-11-08T16:47:58Z2026-11-08T16:47:59Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md 04c48a8cab61…
sbom_json e7c8bcc935eb…
schema_discovery 2026-11-08T16:48:02Z2026-11-08T16:48:03Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 507d26be022f…
dependency_tree 2f36910ab3b9…
table_classification 3bb6250840b0…
admin_handbook 2026-11-08T16:53:15Z2026-11-08T16:53:16Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map ce755365f6e8…
admin_handbook 6869920fc663…
db_handbook 2026-11-08T16:59:09Z2026-11-08T16:59:10Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook abc88b90cb9a…
seed_isolation 02434e8e3f83…
seed_data 2026-11-08T16:59:16Z2026-11-08T16:59:17Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 8ebab5ccda38…
seed_cases_json 1c5afbfa28ba…
seed_validate 2026-11-08T16:59:19Z2026-11-08T16:59:20Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 95eb5fa5af69…
usecase_validate 2026-11-08T16:59:37Z2026-11-08T16:59:38Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 478fab015b56…
test_results 51fdeb7ed6fa…
usecase_contract 7b66012d3f17…
finalize_docs 2026-11-08T17:06:36Z2026-11-08T17:06:37Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 7caa0279de7d…
release_notes 4529af361d46…
api_integration_guide b9cadbc82ded…
package_archive invalidated 2026-11-09T11:42:56Z 2026-11-08T17:12:02Z2026-11-09T06:06:52Z5
34 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar 7d9f0083a2f7…
checksums 14b9289f76b7…
verify_md f1ed78c61ef4…
rebuild_md e337e198aa88…
manifest_txt 156e0c26abbe…
actions_jsonl cbfd49673469…
provenance_md b0105ce7ee25…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json bd9ac97e37e4…

[stage_runs]

Rewinds

  • 2026-11-09T04:48:03Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #27990]
  • 2026-11-09T05:25:44Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28038]
  • 2026-11-09T06:01:19Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28055]
  • 2026-11-09T11:42:56Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28812]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T06:06:52Z.

111 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 09446 L-A183, L-A15
remediate2001 08942 L-A183, L-A15
admin_handbook271003 2141233 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook371703 6194241 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
finalize_docs432003 4219001 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

4 rounds, 4 counted, $6.71 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T04:04:49Z 7818 findings to repackage [held_rounds, held_rounds #1577] $1.75 3 rounds, $40.00 764630b2408e…
22026-11-09T04:58:34Z 0116 findings to repackage [held_rounds, held_rounds #1582] $1.61 3 rounds, $40.00 4ab25025b9a5…
32026-11-09T05:32:33Z 0211 findings to repackage [held_rounds, held_rounds #1585] $1.51 3 rounds, $40.00 af6a10a8616e…
42026-11-09T06:07:36Z 005 clean to publish [held_rounds, held_rounds #1596] $1.84 3 rounds, $40.00 7d9f0083a2f7…

Defects

Fully recorded
  • Ledger entries62 [defects, defects where product_slug=zabbix and this tag or chain]
  • Disclosed in the archive62 [docs/defects/defects.json, entries]

62 ledger entries: by severity high 12, critical 7, low 43; by status open 2, fixed-before-release 60.

DefectSeverityStatusFound byFixed in
RSD-zabbix-201a26520b
Ships a known default credential (Admin) [defects, defects #180402]		highopenbuild strategy record—
RSD-zabbix-a8da5c6ce0
Admin handbook: The documented TLS verification example sets an invalid libpq sslmode and omits PGSSLROOTCERT; the container never starts. [defects, defects #193800]		criticalfixed-before-releaseheld review (review model)—
RSD-zabbix-bb85407053
Admin handbook: The docker run example in Database Connectivity and TLS fails at start. [defects, defects #193801]		criticalfixed-before-releaseheld review (review model)—
RSD-zabbix-a95d13e21e
API guide: Invalid sslmode spelling and missing PGSSLROOTCERT in the documented TLS procedure. [defects, defects #193802]		criticalfixed-before-releaseheld review (review model)—
RSD-zabbix-0d9c0b04b2
API guide: Not indefinite, and the missing file is PGSSLROOTCERT, not the CA file given to Zabbix. [defects, defects #193803]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-9905938aea
API guide: PGSSLROOTCERT is called a client certificate path. [defects, defects #193804]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-c5186e3fea
API guide: Reads as a customer-set requirement; also lists `require` as encrypt-only while any non-disable value enforces TLS. [defects, defects #193805]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-66e29cd6ea
API guide: False: database TLS does not require agent-TLS parameters. [defects, defects #193806]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-c7eb6b7534
Admin handbook: Same section contradicts itself; a customer choosing prefer expecting opportunistic TLS gets a server that refuses a non-TLS database. [defects, defects #193807]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-e39bb962a0
Database handbook: Understates the rule stated in the Operating facts. [defects, defects #193808]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-8a5f299e01
Database handbook: Contradicts the admin handbook. [defects, defects #193809]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-1a75abf3b3
Admin handbook: The documented TLS example fails to start; CA file is presented as optional. [defects, defects #193810]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-7292c751d2
Database handbook: The documented restore flow restores nothing. [defects, defects #193811]		criticalfixed-before-releaseheld review (review model)—
RSD-zabbix-bc1c6c2922
Database handbook: Order of steps wrong; contradicts the Data and Backups section. [defects, defects #193812]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-d2c86e236f
Database handbook: The restore command silently restores nothing and reports success. [defects, defects #193813]		criticalfixed-before-releaseheld review (review model)—
RSD-zabbix-8dde559c52
Database handbook: Documented restore targets the live database and fails; contradicts line 582. [defects, defects #193814]		criticalfixed-before-releaseheld review (review model)—
RSD-zabbix-d77499ecf3
API guide: Restore command targets the database the dump came from. [defects, defects #193815]		criticalfixed-before-releaseheld review (review model)—
RSD-zabbix-f24fa116b9
API guide: Contradicts 'new empty database'. [defects, defects #193816]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-57eb00f6d9
Admin handbook: Entrypoint does not create the database. [defects, defects #193817]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-aa8ebc1709
API guide: False claim that log output is kept in the database. [defects, defects #193818]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-a26696ef1a
API guide: Claims a boot, health and user check that the script skips. [defects, defects #193819]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-770c868f22
Admin handbook: Overstates what VERIFY_OFFLINE.sh checks. [defects, defects #193820]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-58c9c3304b
Database handbook: Overstates what VERIFY_OFFLINE.sh checks. [defects, defects #193821]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-54281b669f
API guide: Wrong location; admin handbook says archive root. [defects, defects #193822]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-2946e8d69d
API guide: Contradicts the DB handbook. [defects, defects #193823]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-c6d19377a7
API guide: Passive proxies do not send to 10051. [defects, defects #193824]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-4421959c5b
Admin handbook: Contradicts API guide and upstream behaviour. [defects, defects #193825]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-64d2570c1b
API guide: Reads as if SNMP/IPMI are absent. [defects, defects #193826]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-93c57af99e
Database handbook: Contradicts the other sections. [defects, defects #193827]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-c679bedeb6
API guide: Contradicts line 527. [defects, defects #193828]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-09ef2822cb
API guide: Server TLS files (TLSCertFile) are not read from this path by default. [defects, defects #193829]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-62874d2586
API guide: Mixes web-monitoring and agent-TLS locations. [defects, defects #193830]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-730907cc40
Admin handbook: SSH keys and agent TLS files are not read from the ssl directory. [defects, defects #193831]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-50f06b823d
VERIFY.md: L-A39: claims a third attestation (SLSA Verification Summary) and gives a verify-attestation command for it (line 28), but no record produced one. [defects, defects #193832]		lowopenheld review (review model)—
RSD-zabbix-c891a3ad90
Admin handbook: False outcome: restoring into an initialised database does load data. [defects, defects #195717]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-1f0224dc65
Admin handbook: False outcome: existing data is not left unchanged. [defects, defects #195718]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-b59f5879e2
Database handbook: False outcome: existing data is not left unchanged. [defects, defects #195719]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-f351b9ff55
Database handbook: False outcome: existing data is not left unchanged. [defects, defects #195720]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-356267c85f
API guide: False outcome: the restore does load data (the round-1 'restores nothing' wording is still wrong). [defects, defects #195721]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-8a36b1f735
API guide: False outcome: existing data is not left unchanged. [defects, defects #195722]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-df07e0171c
Database handbook: Unsupported security claim: nothing enforces the change; a customer relying on it leaves the default credential in place. [defects, defects #195723]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-70e386323c
Admin handbook: Says two, lists three. [defects, defects #195724]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-cfbdbe5bba
Admin handbook: The exit-1 behaviour only applies when DB_SERVER_SSLMODE is verify-*; this section never sets DB_SERVER_SSLMODE, and without it the entrypoint's pg_isready uses libpq's default prefer and never… [defects, defects #195725]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-4fb8bf2af2
Admin handbook: Contradicts line 121 and the entrypoint: only *.conf files are included. [defects, defects #195726]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-393073ecfa
API guide: `/var/lib/zabbix/ssl` is root-owned in the image. [defects, defects #195727]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-8f3d21d819
API guide: The image ships zabbix_get, zabbix_sender and zabbix_js (the build's own trapper round-trip test runs zabbix_sender). [defects, defects #195728]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-6c63d3ab77
API guide: Contradicts line 732 and 'Changing Configuration After Start': the configuration is regenerated and read only at container start; mounting the directory needs a new container. [defects, defects #195729]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-d605efdeb6
API guide: As written the procedure fails: `docker restart` keeps the old env-file value, and re-running `docker run --name zabbix-server` without removing the container hits a name conflict. [defects, defects #195730]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-3abca5f953
API guide: -t does not make pg_dump fail; it corrupts the dump with CR characters. [defects, defects #195731]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-3c16ea5b6c
API guide: The example names host paths while the following sentence mounts the modules at /var/lib/zabbix/modules; the admin handbook names modules relative to LoadModulePath. [defects, defects #195732]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-249491b62f
API guide: No step names the rebuilt image readystack/zabbix:<tag>; the claim is false. [defects, defects #196695]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-0024a2b80a
API guide: Run step for a rebuilt image without load+tag: runs a different image or fails offline. [defects, defects #196696]		highfixed-before-releaseheld review (review model)—
RSD-zabbix-afcb6bcee6
Admin handbook: False outcome: rows that do not collide are not loaded from a table that has a colliding seed row. [defects, defects #196697]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-a18aebf0ae
Admin handbook: False outcome: rows that do not collide are not loaded from a table that has a colliding seed row. [defects, defects #196698]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-9ce7b9eec1
Database handbook: False outcome: rows that do not collide are not loaded from a table that has a colliding seed row. [defects, defects #196699]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-9ad65c8afd
API guide: The stated reason is wrong; the real failure is a silent empty restore. [defects, defects #196700]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-ce07de59d7
API guide: Absolute claim contradicted by docker run --user. [defects, defects #196701]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-69a033b94f
API guide: Instruction text leaked into the guide. [defects, defects #196702]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-0748faa6b2
Admin handbook: False absolute: libpq does read a default path in the container (~/.postgresql/root.crt, HOME=/var/lib/zabbix); contradicts API guide line 331. [defects, defects #199790]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-02d6ee654d
API guide: False absolute and cross-section contradiction: libpq does read ~/.postgresql/root.crt in this container (line 331 says so). [defects, defects #199791]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-2298da89ce
API guide: Names the wrong parameter: LogType selects the log destination (the entrypoint writes console), not the level; the level is DebugLevel (shown at line 762). [defects, defects #199792]		lowfixed-before-releaseheld review (review model)—
RSD-zabbix-738a3bf548
Database handbook: Contradicts the preceding sentence: the restore into a database the container initialised does not fail, it exits 0 and half-merges. [defects, defects #199793]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:25fd0a61d27475735e5c55001559feecbe27f9df662868b4a048070e9c0843e6 · published digest sha256:25fd0a61d27475735e5c55001559feecbe27f9df662868b4a048070e9c0843e6 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 235) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T11:43:49Z · failing Docker Scout counts 126 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T11:43:34Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3764350544 · transparency-log entry · integrated 2026-11-09T11:47:54Z) [ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:ba8ac1ec6ca4fa0069205e8f7b0afbd047b2a7f064e95506aae6c1e5c29091f9 · state attached · log index 3764353075 · transparency-log entry
    • kind sbom · digest sha256:ba8ac1ec6ca4fa0069205e8f7b0afbd047b2a7f064e95506aae6c1e5c29091f9 · state attached · log index 3764354931 · transparency-log entry
    • kind vsa · digest sha256:ba8ac1ec6ca4fa0069205e8f7b0afbd047b2a7f064e95506aae6c1e5c29091f9 · state attached · log index 3764357165 · transparency-log entry
    • kind provenance · digest sha256:25fd0a61d27475735e5c55001559feecbe27f9df662868b4a048070e9c0843e6 · state attached · log index 3764359137 · transparency-log entry
    • kind sbom · digest sha256:25fd0a61d27475735e5c55001559feecbe27f9df662868b4a048070e9c0843e6 · state attached · log index 3764361101 · transparency-log entry
    • kind vsa · digest sha256:25fd0a61d27475735e5c55001559feecbe27f9df662868b4a048070e9c0843e6 · state attached · log index 3764362612 · transparency-log entry
    (at 2026-11-09T11:47:55Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/zabbix/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T04:04:53Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:25fd0a61d27475735e5c55001559feecbe27f9df662868b4a048070e9c0843e6 [clean-room rebuild ledger, runs[684]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-08T16:47:12Z [stage_runs, stage_runs chain 892 stage publish_image]
  • Archive manifests written2026-11-09T11:46:08Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 869 · probed 2026-11-09T11:47:32Z · source g8) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T11:49:09Z generated: by KitForge release/build_trail.py · generator commit d5dd95cc70cbde883ad7cde173904a80a5a6a342
  • 2026-11-09T11:50:29Z publication: promoted at 2026-11-09T11:49:42Z · promoted digest sha256:ba8ac1ec6ca4fa0069205e8f7b0afbd047b2a7f064e95506aae6c1e5c29091f9 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 413 · checklist status complete · checklist at 2026-11-09T11:50:29Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/zabbix/7.4.16-CE-ubuntu24.04-r3/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/zabbix/7.4.16-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.rebuild.jsonbeside the archive (prodasset /data/production/zabbix/7.4.16-CE-ubuntu24.04-r3/), as staged for publishing—
ReadyStack-zabbix-7.4.16-CE-ubuntu24.04-r3.rebuild.json.sigstorebeside the archive (prodasset /data/production/zabbix/7.4.16-CE-ubuntu24.04-r3/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/zabbix/7.4.16-CE-ubuntu24.04-r3/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)575
chainssadb, ReadyStack's engine database (not published)892
defectssadb, ReadyStack's engine database (not published)zabbix 7.4.16-CE-ubuntu24.04-r3
drive_runssadb, ReadyStack's engine database (not published)chain 892
held_roundssadb, ReadyStack's engine database (not published)chain 892
lesson_recallssadb, ReadyStack's engine database (not published)chain 892
micro_step_runssadb, ReadyStack's engine database (not published)chain 892
release_imagessadb, ReadyStack's engine database (not published)zabbix 7.4.16-CE-ubuntu24.04-r3
stage_eventssadb, ReadyStack's engine database (not published)chain 892
stage_runssadb, ReadyStack's engine database (not published)chain 892
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—