# Configuration

| File | Purpose |
| --- | --- |
| [sources.lock.json](sources.lock.json) | Download URLs, sizes, hashes and source provenance |
| [recipes.lock.json](recipes.lock.json) | Recipe and native payload reference for `check --baseline` |
| [release.json](release.json) | Build settings, repository identity, URL and signing fingerprint |
| [debian.sources](debian.sources) | Debian snapshot APT repositories |
| [snapshot-indexes.json](snapshot-indexes.json) | Expected snapshot metadata hashes |

Source downloads come from upstream projects or Debian. Native integration comes from tracked files. Download URLs locate archives but do not form part of build identity. Archive names, hashes, sizes, roles and extraction settings do.

Authenticate source releases before updating their hashes. Recipe dependencies and build options belong in `packages/`.

When changing the Debian snapshot, update both snapshot files, `release.json` and the bootstrap settings together, then recreate the build environment. Keep publication settings consistent with `docs/INSTALL.txt`.

The signing fingerprint identifies the primary key. Signing may use one of its signing subkeys.

See [MAINTAINING.md](../docs/MAINTAINING.md) for update instructions.