1.2 KiB
1.2 KiB
Configuration
| File | Purpose |
|---|---|
| sources.lock.json | Download URLs, sizes, hashes and source provenance |
| recipes.lock.json | Recipe and native payload reference for check --baseline |
| release.json | Build settings, repository identity, URL and signing fingerprint |
| debian.sources | Debian snapshot APT repositories |
| snapshot-indexes.json | Expected snapshot metadata hashes |
Source downloads come from upstream projects or Debian. Native integration comes from tracked files. Download URLs locate archives but do not form part of build identity. Archive names, hashes, sizes, roles and extraction settings do.
Authenticate source releases before updating their hashes. Recipe dependencies and build options belong in packages/.
When changing the Debian snapshot, update both snapshot files, release.json and the bootstrap settings together, then recreate the build environment. Keep publication settings consistent with docs/INSTALL.txt.
The signing fingerprint identifies the primary key. Signing may use one of its signing subkeys.
See MAINTAINING.md for update instructions.