Zeph Leggett
1.9 KiB
Tracked dependency sources
Dependencies are ordinary folders in this repository. Clone normally, run
tools/op.sh setup, and commit application and dependency edits together.
upstream-sync.json records the last integrated upstream commit and its pristine
tree for each dependency. A recorded tree identifies the merge base; it does not
claim that the current folder is unchanged. Optional import exclusions are
explicit, and an optional include list imports only the listed upstream paths. Required third-party license notices remain in the source folders.
Run python3 tools/vendor/check.py to validate the tracked working tree, or add
--revision REV to validate a fetched commit before checking it out. Validation
checks layout and provenance fields; it does not establish runtime compatibility.
Maintainers can preview a dependency update with:
python3 tools/vendor/sync.py panda FULL_UPSTREAM_COMMIT_HASH
The base is the previously integrated snapshot, ours is the committed local
folder, and theirs is the selected upstream snapshot. The command requires a
clean checkout. It downloads objects into an external cache, reports conflicts
without changing the checkout, and preserves local edits through a three-way
merge. Use --source-repo /path/to/upstream/repo for an existing local object
cache. Add --apply to stage a conflict-free result and updated manifest. Review
the diff, run the affected tests, and create one ordinary local commit. The tool
does not commit, push, or resolve conflicts by discarding local changes.
Updating the main openpilot base is a separate integration task. Review the upstream changes and dependency pins together, resolve any dependency tree replacements explicitly, and update the main manifest revision only after integration. Never accept a gitlink in place of a source folder. Updater and CI checks reject that layout.
Dependency provenance checks do not replace runtime, firmware, or vehicle qualification for an update.