NoahandClaude Opus 5
3d8a683d68
The firmware builds against sysdrv/source/buildroot/buildroot-2025.02.8 in the vendor SDK. That tree is not in the vendor checkout -- the SDK ships 2023.02.6 -- it was not in this manifest, and nothing anywhere recorded its origin. A clean rebuild on another machine silently fell back to the vendor's older buildroot and produced a different userspace, which is flare-edge#135. fetch-buildroot-tarball.sh follows fetch-kernel-tarball.sh exactly: pinned URL, pinned sha256, fails closed on a missing pin. Buildroot signs releases with GPG rather than publishing a .sha256, so the pin was computed from the tarball and is what the script verifies against. The manifest now says out loud that two of the inputs are tarballs rather than git trees, so "which buildroot" has an answer in the same place as "which LVGL". Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T2D2KtdgwbhbF6Mo64eUrn
35 lines
2.1 KiB
Plaintext
35 lines
2.1 KiB
Plaintext
# Third-party trees this platform is built against, pinned to an exact commit.
|
|
#
|
|
# WHY A PIN AND NOT A COPY. Between them these are ~21 GB; the vendor SDK alone
|
|
# is 21 GB of build tree with absolute paths baked into its host tools. Copying
|
|
# that into git would make every clone of this repo unusable and would still not
|
|
# make the result reproducible. What makes a build reproducible is knowing
|
|
# EXACTLY which tree was used, and that is a commit id -- the same reasoning
|
|
# build/fetch-kernel-tarball.sh already applies to the kernel, where a sha256
|
|
# pin stands in for vendoring 150 MB of tarball.
|
|
#
|
|
# So this file is the single place that answers "which LVGL, which vendor SDK",
|
|
# and fetch-vendor.sh is the only thing that acts on it. A checkout that has
|
|
# drifted off its pin is reported, never silently used.
|
|
#
|
|
# NOT EVERYTHING HERE IS A GIT TREE. Two build inputs are pinned tarballs
|
|
# instead, each with its own fetch-and-verify script beside this file, because a
|
|
# release tarball has no commit to name:
|
|
#
|
|
# linux-6.18.46 build/fetch-kernel-tarball.sh
|
|
# buildroot-2025.02.8 build/fetch-buildroot-tarball.sh
|
|
#
|
|
# The buildroot one matters more than it looks. The firmware builds against
|
|
# sysdrv/source/buildroot/buildroot-2025.02.8 inside the vendor SDK, and the
|
|
# vendor SDK ships 2023.02.6 -- so that tree is not in the vendor checkout, was
|
|
# not in this manifest, and had no recorded origin at all. A clean rebuild
|
|
# silently used the vendor's older buildroot and produced a different userspace
|
|
# (flare-edge#135). Our delta on top of it is captured in the flare-edge repo at
|
|
# sdk-patches/buildroot/.
|
|
#
|
|
# Format: name<TAB>url<TAB>commit<TAB>description
|
|
# Blank lines and lines starting with '#' are ignored.
|
|
|
|
lvgl https://github.com/lvgl/lvgl.git 066d8db0b54819223357731f68961a90b3d785b4 LVGL v9.5.0-383-g066d8db0b: the UI toolkit warden-ui links against
|
|
luckfox-pico https://github.com/LuckfoxTECH/luckfox-pico.git 824b817f889c2cbff1d48fcdb18ab494a68f69d1 Vendor RV1106 SDK: buildroot userspace, U-Boot and the host packaging tools. Being replaced by this repo; still the source of the rootfs and the FIT/resource host tools.
|