Pin where buildroot comes from

The firmware builds against sysdrv/source/buildroot/buildroot-2025.02.8 in the
vendor SDK. That tree is not in the vendor checkout -- the SDK ships 2023.02.6 --
it was not in this manifest, and nothing anywhere recorded its origin. A clean
rebuild on another machine silently fell back to the vendor's older buildroot
and produced a different userspace, which is flare-edge#135.

fetch-buildroot-tarball.sh follows fetch-kernel-tarball.sh exactly: pinned URL,
pinned sha256, fails closed on a missing pin. Buildroot signs releases with GPG
rather than publishing a .sha256, so the pin was computed from the tarball and
is what the script verifies against.

The manifest now says out loud that two of the inputs are tarballs rather than
git trees, so "which buildroot" has an answer in the same place as "which LVGL".

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T2D2KtdgwbhbF6Mo64eUrn

This commit is contained in:

Noah

2026-09-03 21:24:10 -06:00

co-authored by

Claude Opus 5

parent b6aee456e8

commit 3d8a683d68

3 changed files with 70 additions and 0 deletions

build/buildroot-2025.02.8.tar.xz.sha256

View File

				`@@ -0,0 +1 @@`
				`695360d10d038122f11c76c35f3bd10561d949af2bc90468659f4ec5ee6687cc buildroot-2025.02.8.tar.xz`