blueflare/bfe-core1106-sdk
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Pin where buildroot comes from

Browse Source 
The firmware builds against sysdrv/source/buildroot/buildroot-2025.02.8 in the
vendor SDK. That tree is not in the vendor checkout -- the SDK ships 2023.02.6 --
it was not in this manifest, and nothing anywhere recorded its origin. A clean
rebuild on another machine silently fell back to the vendor's older buildroot
and produced a different userspace, which is flare-edge#135.

fetch-buildroot-tarball.sh follows fetch-kernel-tarball.sh exactly: pinned URL,
pinned sha256, fails closed on a missing pin. Buildroot signs releases with GPG
rather than publishing a .sha256, so the pin was computed from the tarball and
is what the script verifies against.

The manifest now says out loud that two of the inputs are tarballs rather than
git trees, so "which buildroot" has an answer in the same place as "which LVGL".

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T2D2KtdgwbhbF6Mo64eUrn
This commit is contained in:
Noah
2026-09-03 21:24:10 -06:00
co-authored by Claude Opus 5
parent b6aee456e8
commit 3d8a683d68
3 changed files with 70 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build/vendor.manifest
+15
View File
@@ -12,6 +12,21 @@
# and fetch-vendor.sh is the only thing that acts on it. A checkout that has
# drifted off its pin is reported, never silently used.
#
# NOT EVERYTHING HERE IS A GIT TREE. Two build inputs are pinned tarballs
# instead, each with its own fetch-and-verify script beside this file, because a
# release tarball has no commit to name:
#
# linux-6.18.46 build/fetch-kernel-tarball.sh
# buildroot-2025.02.8 build/fetch-buildroot-tarball.sh
#
# The buildroot one matters more than it looks. The firmware builds against
# sysdrv/source/buildroot/buildroot-2025.02.8 inside the vendor SDK, and the
# vendor SDK ships 2023.02.6 -- so that tree is not in the vendor checkout, was
# not in this manifest, and had no recorded origin at all. A clean rebuild
# silently used the vendor's older buildroot and produced a different userspace
# (flare-edge#135). Our delta on top of it is captured in the flare-edge repo at
# sdk-patches/buildroot/.
#
# Format: name<TAB>url<TAB>commit<TAB>description
# Blank lines and lines starting with '#' are ignored.