Jetson Promote Image

Promote BSP Image

Purpose

Stage every Customize-* and Build output into bsp_image so it is

ready for /jetson-flash-image. This is the **promote leg of

Deploy** — it copies files, never flashes and never builds.

Prerequisites

• Active target-platform profile with both source: and bsp_image:

resolved (run /jetson-init-source and /jetson-init-image first).

• <source.root_path>/Linux_for_Tegra/ initialized as a git repo

(overlay tracker) with a clean working tree.

• <bsp_image.root_path>/Linux_for_Tegra/ extracted from a BSP

tarball + apply_binaries.sh already run.

• git, yq, cmp, and sudo (for rootfs/* destinations) on

the host.

• <source.root_path>/.build-manifest.yaml + .build-state.yaml

from /jetson-build-source (required when kernel-side repos

have customize-* commits).

Overview

This is the promote leg of Deploy — see

../../context/bsp-customization-workflow.md

for the pipeline view. The two channels this skill walks are:

| Channel | Source | Carrier | Owner |

|---|---|---|---|

| Overlay tracker | <source.root_path>/Linux_for_Tegra/ (git repo at HEAD) | Customize-* outputs that don't require a build (e.g. nvfancontrol.conf, nvpmodel.conf, BPMP DTB hand-edits) | Customize customize-* skills commit here |

| Build manifest | <source.root_path>/.build-manifest.yaml | Rebuilt kernel Image, in-tree .ko, OOT .ko, NVIDIA DTBs | Build jetson-build-source writes here |

The skill computes the union of files to copy and writes each into

<bsp_image.root_path>/Linux_for_Tegra/ with diff-aware

skip-if-identical logic. When the copy pass touches the kernel

Image or anything under rootfs/lib/modules/, it also rebuilds

the initramfs via NVIDIA's tools/l4t_update_initrd.sh so the

freshly promoted kernel + modules ship in the initrd the

bootloader actually loads. After it returns, bsp_image carries

every Customize and Build output. The skill does not flash and

does not modify the workspace.

When to invoke

• First leg of the typical Deploy chain

jetson-promote-image → jetson-flash-image → jetson-validate-image.

• Standalone, when the user wants bsp_image updated but isn't

ready to flash yet (e.g. to inspect resolved files, run an

out-of-band build that reads bsp_image, or hand bsp_image to a

separate flashing host).

Procedure

Resolve active target + paths

Resolve the active profile per the contract in

../../context/target-platform-contract.md.

Refuse and route in these cases:

| Condition | Refuse with |

|---|---|

| No active profile, or active: NA | Route to /jetson-set-target or /jetson-init-target. |

| Profile lacks bsp_image: | Route to /jetson-init-image. |

| <bsp_image.root_path>/Linux_for_Tegra/ missing | Route to /jetson-init-image. |

| <source.root_path>/Linux_for_Tegra/ missing or not a git repo | Route to /jetson-init-source. |

Resolve paths:

• <workspace> = parent of the active profile's target-platform/

directory (discovered at load time).

• <bsp_image.root_path> from bsp_image.root_path: if present,

else <workspace>/Image.

• <source.root_path> from source.root_path: if present, else

<workspace>/Source.

Bind shell variables for the rest of the procedure:

LFT_SRC="<source.root_path>/Linux_for_Tegra"   # overlay tracker
LFT_DST="<bsp_image.root_path>/Linux_for_Tegra"
MANIFEST="<source.root_path>/.build-manifest.yaml"   # build outputs

Validate the two channels

The skill needs at least one channel populated. Refuse if the

overlay tracker has uncommitted changes (status --porcelain

non-empty), if $MANIFEST exists but doesn't parse as YAML, or

if both channels are empty. Records OVERLAY_HAS_COMMITS /

OVERLAY_HEAD and MANIFEST_PRESENT for downstream steps.

See references/copy-pass-snippets.md

for the shell snippet and refuse messages.

Verify build-source freshness

Refuse if .build-state.yaml shows any kernel-side repo in

Source/bsp_sources/ dirty since the last /jetson-build-source

— otherwise the copy pass would silently ship stale artifacts.

Detection rules + shell snippet in

references/build-source-freshness-gate.md.

Records BUILD_FRESH=1.

Pre-promote collision check (overlay only)

When the overlay tracks a remote, refuse if upstream has commits

not yet pulled. Skip gracefully when no remote is configured

(the default git init empty tracker from jetson-init-source).

Manifest channel has no git remote concept — this check is

overlay-only. Records COLLISION_CHECK for the Summary.

See references/copy-pass-snippets.md

for the shell snippet.

Enumerate sources (both channels)

Channel A — overlay: git ls-files against $LFT_SRC is

the source of truth (transparent to symlink mounts when

source.repos.Linux_for_Tegra was overridden, excludes

untracked / .gitignored files). Each entry maps

src = $LFT_SRC/<rel> → dst = $LFT_DST/<rel>.

Channel B — manifest: parse artifacts[].{src,dst} from

$MANIFEST. Refuse if any src is missing on disk (build was

interrupted, or manifest stale — re-run /jetson-build-source).

The manifest schema is written by

jetson-build-source v0.2.0.

See references/copy-pass-snippets.md

for both shell snippets and the manifest YAML schema.

Diff-aware copy into bsp_image

Iterate the union of overlay files and manifest entries. For

each dst: if byte-identical, skip; otherwise cp -p (with

sudo for rootfs/* destinations, where the sample rootfs

was extracted as root). Tag INITRD_DIRTY=1 on any

rootfs/lib/modules/* or kernel/Image write — the

"Refresh initramfs" step gates on this flag. Counts /

FIRST / LAST are recorded for the Summary.

Fail-fast: if any cp fails, surface the failed path and stop.

bsp_image may be left partially updated — re-running after

fixing the cause resumes via the diff-aware skip. **Channel

order** is overlay first, then manifest: on a dst collision

the manifest wins (freshly built artifact beats the older

overlay copy).

See references/copy-pass-snippets.md

for the copy_one() function and the two driving loops.

Mirror kernel Image into rootfs (when kernel changed)

The kernel Image lives in two paths inside bsp_image:

<LFT_DST>/kernel/Image (read by the flash tool) and

<LFT_DST>/rootfs/boot/Image (the rootfs-side copy, visible as

/boot/Image from inside the rootfs chroot the refresh tool

will run in). The build manifest only carries the kernel/Image

dst, so this step mirrors kernel/Image → rootfs/boot/Image

(diff-aware, no-op when already in sync) so the chrooted refresh

tool resolves the kernel against the freshly promoted binary,

not the stale rootfs copy. The mirror also sets INITRD_DIRTY=1

so a kernel-only promote (no rootfs/lib/modules/* writes) still

triggers the refresh.

See references/kernel-image-and-initramfs.md

for the shell snippet, the failure mode this prevents, and the

INITRD_DIRTY corner case.

Refresh initramfs (when kernel or modules changed)

Run tools/l4t_update_initrd.sh from <LFT_DST>/ whenever

INITRD_DIRTY=1 (set by the diff-aware copy or the mirror step

above). The tool chroots into rootfs/, runs NVIDIA's

nv-update-initrd, and writes both

<LFT_DST>/bootloader/l4t_initrd.img (used by the flash tool)

and <LFT_DST>/rootfs/boot/initrd (/boot/initrd on the DUT).

Idempotent; ~30 s. Skip when INITRD_DIRTY=0 (overlay-only

edits). DUT-side workarounds (update-initramfs -u + manual

cp) are out of scope — fix the gap here so flash ships a

coherent image.

See references/kernel-image-and-initramfs.md

for the shell snippet, refuse paths, the "module shadowing" and

"vermagic skew" failure modes the rebuild closes, and why

bootloader/initrd (a different file) is left alone.

Summary

Report:

• Overlay scope: overlay HEAD ($OVERLAY_HEAD) or "(empty)".
• Manifest scope: `mode=<...>, bsp_version=<...>, rebuilt_at=<...>,

N artifacts` or "(absent)".

• Collision check: $COLLISION_CHECK.
• Counts:
• overlay: $COPIED_OVERLAY copied, $IDENTICAL_OVERLAY identical
• manifest: $COPIED_MANIFEST copied, $IDENTICAL_MANIFEST identical
• Kernel Image mirror: $KIMG_MIRRORED and initramfs:

$INITRD_STATUS (copied … / rebuilt when triggered by

kernel/Image or rootfs/lib/modules/* writes; skipped …

otherwise).

• First / last paths copied (omit if both COPIED totals are 0).
• Resolved <source.root_path>, <bsp_image.root_path>.
• Next step: /jetson-flash-image (or /jetson-validate-image if

the user only wanted bsp_image refreshed for inspection / static

validation).

Limitations

• Two channels, one destination. bsp_image/Linux_for_Tegra/

is written by both passes. Overlay carries customize-* outputs

(overlay-only edits like nvfancontrol.conf); manifest carries

rebuilt binaries (kernel/OOT/DT). The two are intentionally

disjoint by construction: build outputs don't go into the

overlay, and customize-* edits to non-build files don't enter

the manifest.

• Build manifest is the trace-to-dirty contract. Anything in

the manifest came from a dirty source repo (per

jetson-build-source's "Write the build manifest" step trace policy). Promoting the

manifest is therefore safe: every entry is a customization-bearing

artifact, not toolchain-divergence noise. The skill does not

re-derive the trace — it trusts the manifest.

• Manifest entries can outlive their build outputs. If the

user wipes Source/.build/ or bsp_sources/'s build artifacts

between jetson-build-source and jetson-promote-image, the

manifest will reference missing files. The "Enumerate sources (both channels)" step refuses in that

case and points the user at /jetson-build-source to rebuild.

• Manifest absence is fine when only overlay edits happened.

A purely overlay-side customization (e.g. customize-fan)

produces no build outputs and writes no manifest — the "Enumerate sources (both channels)" step is a

no-op, the "Diff-aware copy into bsp_image" step promotes only overlay files. The skill prints

"manifest: (absent)" in the summary and continues.

• Diff-aware, idempotent. Re-running with no overlay commits

or manifest changes since the last promote is a no-op (all

files identical). Use this to confirm bsp_image is in sync

without side effects.

• Symlink-mount transparency. When

source.repos.Linux_for_Tegra was overridden in

jetson-init-source, the canonical mount is a symlink into

<source.root_path>/.repos/Linux_for_Tegra/<subdir>. git -C,

cp -p, and cmp -s all follow it transparently — no special

handling needed at this layer. Manifest src paths are

absolute, so symlinks under bsp_sources/ don't matter for the

manifest channel.

• sudo is scoped to rootfs/ destinations. Files under

rootfs/ were extracted with sudo tar xpjf by

jetson-init-image, so they carry root ownership and special

mode bits the flashing toolchain reads back. sudo cp -p

preserves them. Everything else (bootloader/, kernel/,

kernel/dtb/, tools/, etc.) is user-owned and does not need

sudo. This applies to both channels.

• Channel-overlap precedence. If the same dst appears in

both overlay and manifest, manifest wins (later in the "Diff-aware copy into bsp_image" step's

loop). This is the desired semantic — manifest entries are

freshly built, overlay entries may be older state. Hand-editing

binary files into the overlay is discouraged (Build's job

is to rebuild them); the precedence rule makes such mistakes

recoverable.

• bsp_image is read-only outside Deploy. This skill is the

only writer in the normal flow (matches the workflow invariant).

Hand-edits to <bsp_image.root_path>/Linux_for_Tegra/ outside

Deploy will be silently overwritten on the next promote run if

the same path exists in either channel; conversely they will

*not* be reverted if no entry shadows them. Both behaviors are

wrong for the diff trail — never hand-edit upstream.

• Scope is overlay HEAD only (channel A). Named tags /

manifests / commit ranges are deferred (see below). To promote

a historical state, git -C $LFT_SRC checkout <ref> first,

then re-run. The manifest channel has no ranged scope — it

reflects whatever jetson-build-source's last run produced.

• No automatic rollback on partial failure. If cp fails

partway through, bsp_image is left in an intermediate state.

Fix the underlying cause (usually permissions / disk full) and

re-run — the "Diff-aware copy into bsp_image" step will resume by skipping already-promoted files.

• Kernel Image mirror + initramfs refresh. Gated on copy-pass

writes to kernel/Image or rootfs/lib/modules/*; the mirror

feeds the refresh's chroot. Both are diff-aware and skipped on

pure-overlay edits. tools/l4t_update_initrd.sh must exist in

bsp_image (ships with apply_binaries.sh); a missing tool

refuses and routes to /jetson-init-image. See

references/kernel-image-and-initramfs.md

for the full contract and failure modes.

Troubleshooting

| Error | Cause | Solution |

|---|---|---|

| Overlay has uncommitted changes at <LFT_SRC> | Customize-* edits not committed before promote | Run git -C $LFT_SRC commit (or stash), then re-run. |

| origin has N unpulled commits on <upstream> | Remote overlay diverged from local | git -C $LFT_SRC pull, resolve conflicts, then re-run. |

| Both overlay and manifest are empty — nothing to promote | No Customize-* commits and no Build manifest | Run a customize-* skill or /jetson-build-source first. |

| Kernel-side source(s) changed since last /jetson-build-source | Freshness gate detected unprocessed customize-* edits under Source/bsp_sources/ | Commit pending edits, run /jetson-build-source, re-run promote. |

| Manifest entry references missing build output: <src> | bsp_sources/ build outputs wiped or stale manifest | Re-run /jetson-build-source to regenerate. |

| Build manifest at <MANIFEST> is not valid YAML | Manifest hand-edited or partially written | Re-run /jetson-build-source to rewrite the manifest. |

| cp: permission denied under rootfs/ | Missing sudo privilege on the host | Run on an account that can sudo cp; re-run resumes via diff-aware copy. |

| Profile lacks bsp_image: / source: | Workspace not bootstrapped | Run /jetson-init-image and/or /jetson-init-source. |

| tool not found at <LFT_DST>/tools/l4t_update_initrd.sh | tools/ was pruned, or bsp_image extracted from a non-NVIDIA tarball | Re-run /jetson-init-image to repopulate. |

| l4t_update_initrd.sh exited non-zero | Insufficient sudo, broken rootfs (missing lib/modules/<ver>/modules.dep), or out-of-space /tmp | Run depmod -a -b <LFT_DST>/rootfs <ver> against the rootfs first; verify /tmp headroom; rerun promote. |

| DUT boots with stale kernel / modules after promote, modules fail to load with disagrees about version of symbol …, or initramfs ships pre-customize modules even after the refresh ran | The mirror / refresh gate didn't fire (manual hand-edit under <LFT_DST> outside the skill), or rootfs/boot/Image drifted from kernel/Image so the chrooted refresh built against the stale kernel | Force the gate by sudo touch <LFT_DST>/kernel/Image + re-run promote, or run the two steps manually: sudo cp -p <LFT_DST>/kernel/Image <LFT_DST>/rootfs/boot/Image && cd <LFT_DST> && sudo ./tools/l4t_update_initrd.sh. Then re-flash. See references/kernel-image-and-initramfs.md. |

Spec status

Locked in for v0.2.0:

• Two-channel scope — overlay HEAD + build manifest, both

diff-aware, both copying into <bsp_image.root_path>/Linux_for_Tegra/.

• Channel-overlap precedence — manifest wins on dst collision.
• Source-repo collision check — overlay only; manifest has no

remote concept and source repos under bsp_sources/ are not

fetched (their state was sealed when jetson-build-source

wrote the manifest).

• Atomicity — fail-fast, no rollback. Diff-aware copy makes

resume natural.

• Audit trail — stdout-only at promote time. The overlay

tracker's git log is the canonical record for channel A; the

manifest itself is the canonical record for channel B.

• Kernel Image mirror + initramfs refresh. Locked in as a

paired step. The mirror copies kernel/Image →

rootfs/boot/Image whenever the copy pass touched

kernel/Image; the refresh runs

tools/l4t_update_initrd.sh whenever kernel/Image or any

rootfs/lib/modules/* was promoted, rebuilding both

bootloader/l4t_initrd.img and rootfs/boot/initrd.

Inseparable because the refresh chroots into rootfs/ and

resolves the kernel through /boot/Image — the mirror has to

run first. Closes both module-shadowing and vermagic-skew

failure modes; both diff-aware, both skipped on overlay-only

edits. Full contract in

references/kernel-image-and-initramfs.md.

Still deferred:

• Named-tag / commit-range scope for the overlay channel.

Revisit when a "promote release X" use case appears.

• Manifest history. Currently only the last build's manifest

exists; if a user wants to roll bsp_image back to a previous

build state, they'd need to re-run /jetson-build-source at

the prior commit. A manifest archive (saved per-build-mode or

per-commit) would enable rollback without rebuild.

• Sidecar manifest in bsp_image. Revisit when promotion

happens on a host that does not have access to the overlay

tracker repo (or the workspace's manifest file).

References

• references/kernel-image-and-initramfs.md — full contract for the kernel Image mirror + l4t_update_initrd.sh refresh: shell snippets, failure modes, tool semantics, output filenames.
• ../../context/target-platform-contract.md — target-platform contract.
• ../../context/bsp-customization-workflow.md — workspace edit protocol (this skill is the promote leg of Deploy).
• ../jetson-init-source/SKILL.md — Setup; materializes the overlay tracker this skill reads (channel A) and authors source.toolchain.
• ../jetson-build-source/SKILL.md — Build builder; writes the .build-manifest.yaml this skill reads (channel B).
• ../jetson-flash-image/SKILL.md — next leg; flashes the just-promoted bsp_image to the DUT.
• ../jetson-validate-image/SKILL.md — final leg; static + on-target validation.