-
Notifications
You must be signed in to change notification settings - Fork 1
Build Provenance
Developer documentation. Full detail: docs/BUILD_PROVENANCE.md — this page is a summary.
Answers "what factory, and what source, produced this specific xImage/rootfs.squashfs?" —
distinct from docs/NEBULAOS_RELEASE_ARTIFACT_PROVENANCE.md,
which tracks third-party artifacts (Mainsail zip, WiFi firmware, etc.), not the build's own identity.
Every real build writes artifacts/buildroot-halley5-v30-image/build-manifest.txt
(SCRIPT_VERIFIED, written by 05-final-build.sh), recording:
-
built_at,build_image_repo/build_image_digest(added 2026-08-15 — a shipped artifact previously had no record of which factory built it) -
git_commit_main(+ dirty flag) and every vendored source tree's exact commit - Hashes of fetched binary artifacts (Mainsail, GuppyScreen, WiFi firmware/CLM/NVRAM, regulatory DB)
- Hashes of the resolved build configuration (kernel config, Buildroot config, device tree)
- Hashes/sizes of the two artifacts that actually get flashed (
xImage,rootfs.squashfs)
manifests/dependencies.conf's QUALIFIED_BASELINE_TAG names the one explicit current reference —
not auto-selected (that auto-selection was itself a real, fixed bug).
Reconstructing a build's identity from artifacts alone: check out git_commit_main, pull the
exact build_image_digest, cross-check every other pin against manifests/dependencies.conf at
that commit (not the current tip), then re-run ./build.sh — expect
SEMANTICALLY_IDENTICAL_WITH_KNOWN_NONDETERMINISM, not byte-identical (Buildroot/BusyBox
self-versioning strings and toolchain rebuild vary by design).
See also: Build From Source, A/B Slot Model.
Building
Install / update / recover
Reference