ZITADEL v4.20.0-CE-ubuntu24.04-r1 build trail

How ReadyStack built readystack/zitadel:v4.20.0-CE-ubuntu24.04-r1 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/zitadel:v4.20.0-CE-ubuntu24.04-r1
  • Index digestsha256:3f9af2e2aaa50db0cc8997819f37c43ba164b9696eec96fd012f89cb26bfd53e
  • linux/amd64 digestsha256:7af834957f0ed4bb1a7ab007a0ee63e94812d14f5fbf1ee14f8d14e6fb5da8d8
  • ArchiveReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.tar.gz
  • Archive SHA-256 now99ca50b830b61bf96f6b4a68de87c5ee5c21ec4cfb910413294e977638ee2865
  • Generated2026-11-02T23:33:35Z by KitForge release/build_trail.py
  • Sections9 sections, 4 fully recorded; 10 items not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.trail.json.sigstore ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.trail.json
ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.trail.jsonReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.trail.json.sigstoreReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.trail.mdZITADEL product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

1 item not recorded
  • ProductZITADEL (zitadel) [MANIFEST.json]
  • Release tagv4.20.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Imagereadystack/zitadel:v4.20.0-CE-ubuntu24.04-r1 [MANIFEST.json]
  • Image index digestsha256:3f9af2e2aaa50db0cc8997819f37c43ba164b9696eec96fd012f89cb26bfd53e [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:7af834957f0ed4bb1a7ab007a0ee63e94812d14f5fbf1ee14f8d14e6fb5da8d8 [ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.tar.gz (bytes 963256158) [MANIFEST.json]
  • Archive sha256 at publishf47b1bc331276f3763e32da1fdf22e29a390b794904cedc9d0454fc06d5a885f [MANIFEST.json, repack_history[0].previous_tarball_sha256]
  • Archive sha256 now99ca50b830b61bf96f6b4a68de87c5ee5c21ec4cfb910413294e977638ee2865 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack history
    • at 2026-11-01 · label kitfix · reason customer kit files brought up to the current engine: BUILD_OFFLINE.sh (kit root, docs/offline, docs/docker); the header of BUILD_OFFLINE.sh no longer says a --provenance rebuild meets a SLSA build level, comment lines only; not image inputs; image and every build input unchanged · previous sha256 f47b1bc331276f3763e32da1fdf22e29a390b794904cedc9d0454fc06d5a885f · sha256 99ca50b830b61bf96f6b4a68de87c5ee5c21ec4cfb910413294e977638ee2865 · replaced BUILD_OFFLINE.sh, docs/docker/BUILD_OFFLINE.sh, docs/offline/BUILD_OFFLINE.sh, rebuild.json
    [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/zitadel/zitadel [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refv4.20.0 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit8afa5dd37a8e723efb9eace8d09fd5c1cccef694 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hashcd883d5d3de2c513ae9c97140769940baca0ebd6d469f78e3b378ec04acd7e44 (files 9603) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:8c5ee4310d643770c85a49f2c8b6212d98b83a7829e3c025e0e9c315ff9f55bf [ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1792652744 (utc 2026-10-22T07:05:44Z) [ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.rebuild.json, engine]
  • Not recorded: the engine commit(s) that built it (drive_runs records them for drives from 2026-11-02; this release's drives were rebuilt from line logs, which do not name it)

Why this release exists

Fully recorded
  • Chain710 (created 2026-10-27T17:04:51Z · trigger customer_request · upstream version v4.20.0) [chains, chains #710]
  • Requestbuild request #387 (rebuild) (requested at 2026-10-27T04:41:32Z · requested by kitforge-agent · version v4.20.0) [build_requests, build_requests #387]
  • Reasonretarget to v4.20.0: a newer upstream release (rule 1) [build_requests, build_requests #387 request_reason]
  • Supersedesreadystack/zitadel:v4.19.5-CE-ubuntu24.04-r1 (chain 569) [chains, chains #569]

The path through the harness

2 items not recorded

1 chain · 8 drives · 18 stages · 4 rewinds

Chain 710 release · shipped

Created 2026-10-27T17:04:51Z, upstream v4.20.0, build request 387 [chains, chains #710]

DriveStartedMinutesBuild hostHow it stopped
8022026-10-27T17:05:30Z46.8build host 4 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #802] rebuilt from a build line's log
8042026-10-27T18:45:33Z4.1build host 4 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #804] rebuilt from a build line's log
8092026-10-27T19:39:15Z5.9build host 4 withhold-publish stage_failed at package_archive [drive_runs, drive_runs #809] rebuilt from a build line's log
8312026-10-28T08:23:17Z28.9build host 4 withhold-publish infra_hub_rate_limit at publish_image [drive_runs, drive_runs #831] rebuilt from a build line's log
8322026-10-28T09:10:42Z12.8build host 4 withhold-publish ready_to_ship [drive_runs, drive_runs #832] rebuilt from a build line's log
8352026-10-29T17:27:41Z10.3build host 4 withhold-publish ready_to_ship [drive_runs, drive_runs #835] rebuilt from a build line's log
8382026-10-29T19:14:18Z6.5build host 4 withhold-publish ready_to_ship [drive_runs, drive_runs #838] rebuilt from a build line's log
8412026-10-29T19:53:05Z10build host 4 publish-held shipped [drive_runs, drive_runs #841] rebuilt from a build line's log

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-10-27T17:05:36Z2026-10-27T17:05:36Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 —
acquire 2026-10-27T17:05:48Z2026-10-27T17:05:48Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 —
plan 2026-10-27T17:06:54Z2026-10-27T17:06:55Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 —
assemble_kit 2026-10-27T17:18:07Z2026-10-28T08:38:34Z2
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 —
remediate 2026-10-27T17:19:18Z2026-10-28T08:38:40Z2
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 —
build_kit 2026-10-27T17:26:22Z2026-10-28T08:48:34Z2
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 —
verdict 2026-10-27T17:27:24Z2026-10-28T08:49:29Z2
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 —
publish_image 2026-10-27T17:28:07Z2026-10-28T09:11:30Z2
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 —
boot_instance 2026-10-27T17:28:30Z2026-10-28T09:11:54Z4
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 —
sbom 2026-10-27T17:28:45Z2026-10-28T09:12:08Z2
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 —
schema_discovery 2026-10-27T17:28:49Z2026-10-28T09:12:11Z2
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 —
admin_handbook 2026-10-27T17:38:45Z2026-10-28T09:12:21Z2
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 —
db_handbook 2026-10-27T17:50:21Z2026-10-28T09:12:33Z2
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 —
seed_data 2026-10-27T17:50:26Z2026-10-28T09:12:39Z2
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 —
seed_validate 2026-10-27T17:50:29Z2026-10-28T09:12:41Z2
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 —
usecase_validate 2026-10-27T17:50:54Z2026-10-28T09:13:06Z2
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 —
finalize_docs 2026-10-27T17:51:00Z2026-10-28T09:13:12Z2
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 —
package_archive 2026-10-27T17:52:19Z2026-10-29T20:03:03Z7
33 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 vex_shipped
  • G8 scout_grade_a
  • G8 script_copies
  • G8 three_way_sha
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 assetchain_coverage
 —

[stage_runs]

Rewinds

  • 2026-10-28T08:23:26Z: package_archive to assemble_kit on strategy_changed (chain 710: strategy changed — rewound from 'package_archive' to assemble_kit and dropped the vendored tree so the change actually reaches the build.) [stage_events, stage_events #2345]
  • 2026-10-28T09:54:23Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2303]
  • 2026-10-29T18:00:06Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #2304]
  • 2026-10-29T19:52:36Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py) [stage_events, stage_events #993]
  • Not recorded: each drive's ticks and first failed check (drive_runs records them for drives from 2026-11-02; these drives were rebuilt from line logs)
  • Not recorded: the sha256 of each stage's artifacts (stage_events records them for stages passed from 2026-11-02; this chain's events were rebuilt from stage_runs and logs) — the archive's CHECKSUMS.sha256 lists the sha256 of every file it ships

Model work per stage

3 items not recorded

Role: writer model. Calls up to 2026-10-29T20:03:03Z.

105 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 not recordednot recorded —
remediate2001 not recordednot recorded —
admin_handbook39903 not recordednot recorded —
db_handbook582003 not recordednot recorded —
usecase_validate4001 not recordednot recorded —

[micro_step_runs]

  • Not recorded: forced commits (micro_step_runs records them for calls from 2026-11-02)
  • Not recorded: real token counts (recorded per call from 2026-11-02; earlier rows hold only an estimate, which is not shown)
  • Not recorded: the lesson rules shown to the writer model (lesson_recalls holds no rows for this chain: its recorder was silent from 2026-06-06 to 2026-11-02)

Review

2 items not recorded

Role: review model.

3 rounds, 3 counted, $7.07 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-10-28T09:23:55Z 0510 findings to repackage [held_rounds, held_rounds #227] rebuilt from a held-review state file $2.98 not recorded not recorded
22026-10-29T17:38:20Z 0410 findings to repackage [held_rounds, held_rounds #228] rebuilt from a held-review state file $2.39 not recorded not recorded
32026-10-29T19:21:27Z 007 clean to publish [held_rounds, held_rounds #229] rebuilt from a held-review state file $1.70 not recorded not recorded
  • Not recorded: the sha256 of the archive each round reviewed (held_rounds records it for rounds from 2026-11-02; these rounds were rebuilt from state files)
  • Not recorded: the round cap in force at each round (the state files did not keep it)

Defects

Fully recorded
  • Ledger entries37 [defects, defects where product_slug=zitadel and this tag or chain]
  • Disclosed in the archive35 [docs/defects/defects.json, entries]

37 ledger entries: by severity low 26, medium 2, high 9; by status fixed-in-release 2, open 3, fixed-before-release 32.

DefectSeverityStatusFound byFixed in
RSD-zitadel-90d0c3222c
Release notes: The Known issues entry presents a harness artefact (request by Host 127.0.0.1 against an instance whose external domain is localhost) as a product failure; the file is served normally under the… [defects, defects #117950]		lowfixed-in-releaseheld review (review model)v4.20.0-CE-ubuntu24.04-r1
RSD-zitadel-17f77c09e1
The image refuses to start without ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD, although ZITADEL uses it only to create the first instance [defects, defects #117951]		lowopenruntime check—
RSD-zitadel-dffabd7d65
The Docker Hub run example puts ZITADEL_DATABASE_POSTGRES_USER_PASSWORD, ZITADEL_DATABASE_POSTGRES_ADMIN_PASSWORD and ZITADEL_FIRSTINSTANCE_ORG_HUMAN_PASSWORD on the command line (export), where the shell's history keeps them [defects, defects #117952]		mediumfixed-before-releaseagent case study—
RSD-zitadel-f085a837c0
Database handbook: The handbook says the OIDC discovery document answers on any hostname. [defects, defects #131285]		highfixed-before-releaseheld review (review model)—
RSD-zitadel-37f004defb
Database handbook: Same false claim: discovery 'answers on any Host header' and can be used to 'bootstrap integrations regardless of how the request reaches the container'. [defects, defects #131286]		highfixed-before-releaseheld review (review model)—
RSD-zitadel-11c5f31151
Database handbook: Same false claim, in the same sentence that says discovery gets 404 for other hosts. [defects, defects #131287]		highfixed-before-releaseheld review (review model)—
RSD-zitadel-5bf87334a1
Database handbook: Same false claim; the preceding sentence of the paragraph lists the discovery document among the endpoints that return 404 for other hosts. [defects, defects #131288]		highfixed-before-releaseheld review (review model)—
RSD-zitadel-35870cb4f0
Database handbook: The sentence says that after the first start only the unprivileged role is used. [defects, defects #131289]		highfixed-before-releaseheld review (review model)—
RSD-zitadel-0147e46f48
Database handbook: The discovery document appears in both the unauthenticated and the authenticated lists. [defects, defects #131290]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-5bdd98e7a0
Database handbook: A file readable by others is not rejected; only a file unreadable by uid 999 is. [defects, defects #131291]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-82e5de22ce
Database handbook: The sentence imposes a complexity rule on the database password that no record supports and that the handbook's own typical value (`postgres`) breaks. [defects, defects #131292]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-90525014b2
Database handbook: Unsupported specific number. [defects, defects #131293]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-41c76c121d
Admin handbook: Same unsupported thread count as DB_HANDBOOK.md:1147. [defects, defects #131294]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-2cb3074c32
Admin handbook: The sentence applies the administrator password's complexity rule to all three passwords and contradicts the next bullet. [defects, defects #131295]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-8deecbaf84
Admin handbook: Typo: a doubled slash in the route a customer might paste. [defects, defects #131296]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-f2481f8344
Admin handbook: As written the sentence says the Console is never reached at http://localhost:8080, which is exactly the address the local-trial sections tell the customer to use. [defects, defects #131297]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-9f383a6622
Admin handbook: Contradicts the preceding section of the same handbook, which lists three modes. [defects, defects #131298]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-c28fa89370
Release notes: The line prints a harness artefact (wrong Host header) under Known issues as if the product failed the check; the file is served correctly under the configured external domain. [defects, defects #131299]		lowopenheld review (review model)—
RSD-zitadel-60bd193892
CVE-2026-111497 in libbrotli1 1.1.0-2build2 is on CISA's Known Exploited Vulnerabilities list [defects, defects #135522]		mediumfixed-in-releaseimage scanv4.20.0-CE-ubuntu24.04-r1
RSD-zitadel-576deb46ee
Admin handbook: The sign-in form does not accept the bare user name zitadel-admin; a customer following the first-login instruction is told the user does not exist. [defects, defects #135701]		highfixed-before-releaseheld review (review model)—
RSD-zitadel-ea2ce6552d
Admin handbook: Sentence says to sign in with the username zitadel-admin (fails) and then says the login name is the long form; the instruction is wrong. [defects, defects #135702]		highfixed-before-releaseheld review (review model)—
RSD-zitadel-ad96a933e1
Admin handbook: Contradicts line 1849 of the same handbook and the measured behaviour: the bare user name is refused with 'User could not be found'. [defects, defects #135703]		highfixed-before-releaseheld review (review model)—
RSD-zitadel-2a31294281
Admin handbook: The instruction to use localhost for a same-machine PostgreSQL contradicts the handbook's own Network Access section and fails with 'dial tcp 127.0.0.1:5432: connect: connection refused' for the… [defects, defects #135704]		highfixed-before-releaseheld review (review model)—
RSD-zitadel-a34db48e30
Admin handbook: Contradicts the 'Environment Variables' section of the same handbook (three variables). [defects, defects #135705]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-f9d4e930a5
Admin handbook: 'Any string' contradicts the restriction stated three lines below it. [defects, defects #135706]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-00aa3a76fd
Admin handbook: Calls all three passwords PostgreSQL passwords although the third is not; the next sections say only two are PostgreSQL passwords with character restrictions. [defects, defects #135707]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-cfc3bfce24
Admin handbook: Lists the discovery document among the debug probes that answer on any host (it is host-routed), repeating the discovery-document confusion of round 1. [defects, defects #135708]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-69ec6e4c94
Database handbook: Unsupported driver name stated as fact; the connection errors are those of the pgx driver. [defects, defects #135709]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-894096be36
Database handbook: States everything held in PostgreSQL is encrypted with the masterkey; contradicts the Password Hashing section. [defects, defects #135710]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-33e5818c3f
Database handbook: Says the customer must create the database while the same section's later text says ZITADEL creates it. [defects, defects #135711]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-3f451dd63e
Database handbook: The sentence says the token must be a PAT or OAuth access token, but the documented System API procedure authenticates with a signed JWT. [defects, defects #135712]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-f3bfb84ebe
Docker Hub README: The sentence tells the customer to take 'passwords that only set up the first start' out of the env file after setup. [defects, defects #135713]		lowopenheld review (review model)—
RSD-zitadel-1e9d459379
Admin handbook: The handbook's System API procedure (Resetting a forgotten password, step 3, and API tokens) authenticates with a JWT the customer signs with a System API user's key and sends as `Authorization:… [defects, defects #138369]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-7037f88c39
Admin handbook: The handbook's System API procedure (Resetting a forgotten password, step 3, and API tokens) authenticates with a JWT the customer signs with a System API user's key and sends as `Authorization:… [defects, defects #138370]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-fac3bff1ce
Database handbook: The handbook's System API procedure (Resetting a forgotten password, step 3, and API tokens) authenticates with a JWT the customer signs with a System API user's key and sends as `Authorization:… [defects, defects #138371]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-778fa47cb2
Database handbook: The handbook's System API procedure (Resetting a forgotten password, step 3, and API tokens) authenticates with a JWT the customer signs with a System API user's key and sends as `Authorization:… [defects, defects #138372]		lowfixed-before-releaseheld review (review model)—
RSD-zitadel-85b7fa95b7
Admin handbook: Unsupported claim: under Docker's default settings the unprivileged container user can bind ports below 1024; the image's only listener is 8080 for other reasons. [defects, defects #138373]		lowfixed-before-releaseheld review (review model)—

Verification

2 items not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:7af834957f0ed4bb1a7ab007a0ee63e94812d14f5fbf1ee14f8d14e6fb5da8d8 · published digest sha256:7af834957f0ed4bb1a7ab007a0ee63e94812d14f5fbf1ee14f8d14e6fb5da8d8 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 233) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks cosign, scan_grade, tag_base_os, vex_shipped, scout_grade_a, script_copies, three_way_sha, offline_rebuild, rebuild_manifest, artifact_coverage, assetchain_coverage) [stage_runs, stage_runs chain 710 package_archive gate_result.g8.result]
  • Grade at releaseA (percent 94 · docker grade B · docker percent 83 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-10-29T19:53:26Z · failing Docker Scout counts 96 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component). · corrections No outdated base images) [SCOUT_EVIDENCE.json, docker_scout_policy.corrected]
  • First own scan of the releaseA (at 2026-10-29T20:03:17Z · score 100 · rubric cerodeo-v1 · fixable critical 0 · fixable high 0 · syft 1.54.1 · grype 0.120.1 · grype db v6.1.10@2026-10-29T06:23:34Z) [image_scans, image_scans #1565]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-10-29T19:53:15Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3632865735 · transparency-log entry · integrated 2026-11-01T14:49:36Z) [ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:3f9af2e2aaa50db0cc8997819f37c43ba164b9696eec96fd012f89cb26bfd53e · state attached · log index 3575280326 · transparency-log entry
    • kind sbom · digest sha256:3f9af2e2aaa50db0cc8997819f37c43ba164b9696eec96fd012f89cb26bfd53e · state attached · log index 3575282956 · transparency-log entry
    • kind vsa · digest sha256:3f9af2e2aaa50db0cc8997819f37c43ba164b9696eec96fd012f89cb26bfd53e · state attached · log index 3575287179 · transparency-log entry
    • kind provenance · digest sha256:7af834957f0ed4bb1a7ab007a0ee63e94812d14f5fbf1ee14f8d14e6fb5da8d8 · state attached · log index 3575290673 · transparency-log entry
    • kind sbom · digest sha256:7af834957f0ed4bb1a7ab007a0ee63e94812d14f5fbf1ee14f8d14e6fb5da8d8 · state attached · log index 3575293742 · transparency-log entry
    • kind vsa · digest sha256:7af834957f0ed4bb1a7ab007a0ee63e94812d14f5fbf1ee14f8d14e6fb5da8d8 · state attached · log index 3575298784 · transparency-log entry
    (at 2026-10-29T19:59:28Z) [attestations.json, results]

Offline clean-room rebuilds

  • 2026-10-28T09:23:59Z on build host 4 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:7af834957f0ed4bb1a7ab007a0ee63e94812d14f5fbf1ee14f8d14e6fb5da8d8 [clean-room rebuild ledger, runs[517]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)
  • Not recorded: the pins record (docs/PINS.md is not in this archive as generated; a repack that adds it is appended to this trail's history)

Publication

Fully recorded
  • Image pushed (internal tag), publish_image passed2026-10-28T09:11:30Z [stage_runs, stage_runs chain 710 stage publish_image]
  • Release tag promoted2026-10-29T20:02:01Z (method imagetools_create_retag_by_digest_no_rebuild · digest sha256:3f9af2e2aaa50db0cc8997819f37c43ba164b9696eec96fd012f89cb26bfd53e · tag readystack/zitadel:v4.20.0-CE-ubuntu24.04-r1) [deliverables/provenance/PROMOTION_RECORD.json, promoted_at]
  • Archive manifests written2026-10-29T19:56:57Z [PUBLISH_MANIFEST.json, published_at]
  • Archive cut over on prodasset, package_archive passed2026-10-29T20:03:03Z [stage_runs, stage_runs chain 710 stage package_archive]
  • Cut-over markerpresent (chain 710) [.cutover.json]
  • Release checklist and site event2026-10-29T20:03:01Z (status complete · site event 289 · steps grade a verified done · release tag promoted done · cosign signed done · release evidence recorded done · contract gate passed done · archive published done · hub readme live done · reproducibility recorded done · defects ledger published done · catalog available done · build request fulfilled done · seo regenerated skipped · site catalogue refreshed done · site grade recorded done · site queue synced done · customer requests charged done · owners notified done) [deliverables/provenance/RELEASE_CHECKLIST.json, run_at]

Packages and CPU level

Fully recorded
  • Packages in the image344 (scanned 2026-11-02T06:30:04Z · source backfill:daily-scan) [release_images, package_count]
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 743 · probed 2026-11-02T17:09:59Z · source backfill) [release_images, isa_level_hard]

History

1 event
  • 2026-11-02T23:33:35Z generated: by KitForge release/build_trail.py · generator commit 916780cc218cf013bd623a8c085aaf73d3b053d0 · note backfill: built after the release from its records

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.tar.gz)—
.cutover.jsonbeside the archive (prodasset /data/production/zitadel/v4.20.0-CE-ubuntu24.04-r1/)—
MANIFEST.jsonbeside the archive (prodasset /data/production/zitadel/v4.20.0-CE-ubuntu24.04-r1/)—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/zitadel/v4.20.0-CE-ubuntu24.04-r1/)—
ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.rebuild.jsonbeside the archive (prodasset /data/production/zitadel/v4.20.0-CE-ubuntu24.04-r1/)—
ReadyStack-zitadel-v4.20.0-CE-ubuntu24.04-r1.rebuild.json.sigstorebeside the archive (prodasset /data/production/zitadel/v4.20.0-CE-ubuntu24.04-r1/)—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/zitadel/v4.20.0-CE-ubuntu24.04-r1/)—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)387
chainssadb, ReadyStack's engine database (not published)710
defectssadb, ReadyStack's engine database (not published)zitadel v4.20.0-CE-ubuntu24.04-r1
drive_runssadb, ReadyStack's engine database (not published)chain 710
held_roundssadb, ReadyStack's engine database (not published)chain 710
image_scanssadb, ReadyStack's engine database (not published)1565
micro_step_runssadb, ReadyStack's engine database (not published)chain 710
release_imagessadb, ReadyStack's engine database (not published)zitadel v4.20.0-CE-ubuntu24.04-r1
stage_eventssadb, ReadyStack's engine database (not published)chain 710
stage_runssadb, ReadyStack's engine database (not published)chain 710
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/RELEASE_CHECKLIST.jsonthe chain's workspace on the controller (not published)—