-
Notifications
You must be signed in to change notification settings - Fork 1
Build Provenance
Full detail lives in docs/BUILD_PROVENANCE.md — this page is the short version.
This answers "what actually produced this xImage/rootfs.squashfs?" — different from
docs/NEBULAOS_RELEASE_ARTIFACT_PROVENANCE.md,
which is about third-party stuff (Mainsail's zip, WiFi firmware) rather than the build's own
identity.
Every real build writes artifacts/buildroot-halley5-v30-image/build-manifest.txt, which records:
- When it was built, and which build image produced it (we only started recording the image since 2026-08-15 — before that, a shipped build had no record of which container made it)
- This repo's own commit, plus the exact commit of every vendored source tree
- Hashes of the fetched binary artifacts (Mainsail, GuppyScreen, WiFi firmware/CLM/NVRAM, regulatory DB)
- Hashes of the build config actually used (kernel config, Buildroot config, device tree)
- Hashes and sizes of the two artifacts that actually get flashed
manifests/dependencies.conf's QUALIFIED_BASELINE_TAG is the one explicit current reference — we
used to auto-select whatever tag was newest, which turned out to be a real bug, so now it's set
explicitly.
Working backward from just the manifest: check out git_commit_main, pull the exact build
image it names, cross-check every other pin against manifests/dependencies.conf at that
commit (not the current tip), then re-run ./build.sh. You should get something functionally
identical, though not byte-for-byte — Buildroot and BusyBox both embed their own version/timestamp
strings, and the toolchain gets rebuilt from source each time.
See also: Build From Source, A/B Slot Model.
Building
Install / update / recover
Reference