Skip to content

Build Provenance

Tim edited this page Aug 15, 2026 · 3 revisions

Build provenance

Developer documentation. Full detail: docs/BUILD_PROVENANCE.md — this page is a summary.

Answers "what factory, and what source, produced this specific xImage/rootfs.squashfs?" — distinct from docs/NEBULAOS_RELEASE_ARTIFACT_PROVENANCE.md, which tracks third-party artifacts (Mainsail zip, WiFi firmware, etc.), not the build's own identity.

Every real build writes artifacts/buildroot-halley5-v30-image/build-manifest.txt (SCRIPT_VERIFIED, written by 05-final-build.sh), recording:

  • built_at, build_image_repo/build_image_digest (added 2026-08-15 — a shipped artifact previously had no record of which factory built it)
  • git_commit_main (+ dirty flag) and every vendored source tree's exact commit
  • Hashes of fetched binary artifacts (Mainsail, GuppyScreen, WiFi firmware/CLM/NVRAM, regulatory DB)
  • Hashes of the resolved build configuration (kernel config, Buildroot config, device tree)
  • Hashes/sizes of the two artifacts that actually get flashed (xImage, rootfs.squashfs)

manifests/dependencies.conf's QUALIFIED_BASELINE_TAG names the one explicit current reference — not auto-selected (that auto-selection was itself a real, fixed bug).

Reconstructing a build's identity from artifacts alone: check out git_commit_main, pull the exact build_image_digest, cross-check every other pin against manifests/dependencies.conf at that commit (not the current tip), then re-run ./build.sh — expect SEMANTICALLY_IDENTICAL_WITH_KNOWN_NONDETERMINISM, not byte-identical (Buildroot/BusyBox self-versioning strings and toolchain rebuild vary by design).

See also: Build From Source, A/B Slot Model.

Clone this wiki locally