Release Provenance

Release provenance

Two related but different questions, both answered in NebulaOS-firmware:

• "What actually produced this build?" — Build Provenance. Every build writes build-manifest.txt, recording the exact commit of every component, the build image used, and hashes of every artifact including the final flashable images.
• "Can every third-party thing this build pulls in (Mainsail, WiFi firmware, etc.) be traced back to its own upstream?" — NEBULAOS_RELEASE_ARTIFACT_PROVENANCE.md in NebulaOS-firmware.

The first published release, nightly-2026-08-15, is the exact build that went through the Final Closure hardware qualification — not a rebuild, the actual bytes that were flashed and tested. The release notes and its attached build-manifest.txt list every source commit and hash, so its provenance is fully traceable back to the four source repos.

Once regular releases exist, each one's notes will document the exact component revisions it was built from the same way.