Project configuration (schema below). Never touched by template updates.
.buildhive_manifest.json
SHA-256 per template file; drives change detection on template updates.
.buildhive_baseline/
Pristine copies of text template files; base for 3-way merges.
project.json is loaded from the current working directory only (no upward search). A directory counts as a project if project.json exists, parses as a JSON object and has a name key. Optional fields with value null are omitted on save (exclude_none).
OpenBao server holding build secrets. url: API base. role: OIDC auth role (default dev). mount: KV v2 mount (default buildhive). Secrets read: <mount>/mirror key SSTATE_MIRROR_AUTH, <mount>/users/<login email>/<sw.buildsign.secret> then <mount>/<sw.buildsign.secret>, key BUILDSIGN_TOKEN. Lookup order per secret: env var of the same name, BAO_TOKEN env (CI), cached OIDC token, browser login (buildhive login). Server errors degrade: warning and mirror off, signing fatal. Without a secrets block only the env vars are used.
sw.yocto_manifests
Git
repo init -u <url> -b <branch> on first container run.
sw.clone
dict of Git, optional
Extra repos, cloned/pulled in parallel into sources/<name> and mounted at /custom_sources/<name>. Yocto recipes fetch uwm/udm from there (SRCREV=${AUTOREV}). --no-update skips the pull.
sw.buildsign
optional
Signing server for update archives. url: API base. public_key: pinned base64 Ed25519 key (32 bytes) used to verify signatures locally; if unset, verification is skipped with a warning. secret: KV path under the secrets mount holding key BUILDSIGN_TOKEN (default buildsign). Lookup: users/<login email>/<secret> (personal token) first, then <secret> (shared). Without a buildsign block, build update requires --no-sign.
sw.secure_boot
bool, false
true: requires keys/psk.pem (fatal otherwise), adds require .../secure-boot.conf to local.conf, switches the update archive to signed-FIT components. false: strips the require line. See secure-boot.md.
sw.sstate_mirror
optional
Shared sstate/download mirror (see sstate-mirror/README.md). url: HTTPS base serving sstate-cache/ and downloads/; written to local.conf as SSTATE_MIRRORS, SOURCE_MIRROR_URL, INHERIT += "own-mirrors" between # >>> / # <<< buildhive sstate mirror markers on every run. hashserv: optional BB_HASHSERVE address (wss://host through the mirror proxy or host:8687 plain), sets BB_SIGNATURE_HANDLER = "OEEquivHash". Credentials user:password (basic auth) from SSTATE_MIRROR_AUTH env or the secrets server (secrets field); written to ~/.netrc inside the container, never to local.conf. Unavailable: warning, marker block removed, build uses the local cache only.