Skip to content

Read prebuilt SHA-1s from release manifest#137

Merged
jserv merged 1 commit intomasterfrom
hotfix
Apr 30, 2026
Merged

Read prebuilt SHA-1s from release manifest#137
jserv merged 1 commit intomasterfrom
hotfix

Conversation

@jserv
Copy link
Copy Markdown
Collaborator

@jserv jserv commented Apr 30, 2026

The kernel and rootfs archive hashes plus the input fingerprint were duplicated in mk/external.mk and required manual updating on every republish; missing the update made 'make check' fail at sha1sum -c. Move all three to a prebuilt.sha1 manifest published alongside the archives, so consumers (mk/external.mk, .github/workflows/main.yml) read whatever the publisher recorded.

The manifest fetch is FORCE-rebuilt every invocation but cmp-deduped so downstream targets only invalidate when content actually changed. A failed fetch falls back to the cached manifest when one exists, and only aborts when no cache is available.

Drift detection moves from a parse-time $(warning) to a runtime .PHONY: prebuilt-check target so it can read the inputs hash from the just-refreshed manifest. .ci/publish-prebuilt.sh writes a third line under the virtual name 'inputs' to expose that value. The publisher workflow's paths filter gains .ci/publish-prebuilt.sh so this change auto-republishes the manifest in the new format on merge.

Close #136

The kernel and rootfs archive hashes plus the input fingerprint were
duplicated in mk/external.mk and required manual updating on every
republish; missing the update made 'make check' fail at sha1sum -c.
Move all three to a prebuilt.sha1 manifest published alongside the
archives, so consumers (mk/external.mk, .github/workflows/main.yml)
read whatever the publisher recorded.

The manifest fetch is FORCE-rebuilt every invocation but cmp-deduped
so downstream targets only invalidate when content actually changed.
A failed fetch falls back to the cached manifest when one exists, and
only aborts when no cache is available.

Drift detection moves from a parse-time $(warning) to a runtime
.PHONY: prebuilt-check target so it can read the inputs hash from the
just-refreshed manifest. .ci/publish-prebuilt.sh writes a third line
under the virtual name 'inputs' to expose that value. The publisher
workflow's paths filter gains .ci/publish-prebuilt.sh so this change
auto-republishes the manifest in the new format on merge.

Close #136
Copy link
Copy Markdown

@cubic-dev-ai cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No issues found across 6 files

@jserv jserv merged commit 1ec04c7 into master Apr 30, 2026
15 checks passed
@jserv jserv deleted the hotfix branch April 30, 2026 15:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fail to calculate prebuilt image checksum

1 participant