v6.2.5: make the release tree buildable from a fresh clone again

.github/workflows/build.yml

@@ -4,8 +4,9 @@ on:
   push:
     branches:
       - main
+      - "release/**"
   pull_request:
-    branches: ["main"]
+    branches: ["main", "release/**"]
 
 # Smoke-build SO3 with Infrabase (bitbake) inside the so3-env image. Both the
 # kernel (build.sh -x so3) and the user space (build.sh -x usr-so3, which also

.github/workflows/style.yml

@@ -8,9 +8,9 @@ concurrency:
 
 on:
   push:
-    branches: ["main"]
+    branches: ["main", "release/**"]
   pull_request:
-    branches: ["main"]
+    branches: ["main", "release/**"]
 
 jobs:
   formatting-check:

.gitignore

@@ -88,6 +88,17 @@ so3/usr/lib/libc/include/asm
 so3/rootfs/rootfs.fat
 # lvgl is fetched at build time (meta-usr lvgl bbappend, :lvgl override), not a submodule
 so3/usr/lib/lvgl/
+# ... and everything below is materialized into the usr tree by the lvgl
+# patch set / quilt at build time — never track it (a tracked copy makes
+# do_patch fail on a fresh clone with "would create ... which already exists")
+so3/usr/patches/
+so3/usr/lib/slv/
+so3/usr/lib/lv_conf.h
+so3/usr/src/fillfb.c
+so3/usr/src/lvgl_demo.c
+so3/usr/src/lvgl_perf.c
+so3/usr/src/lvgl_benchmark.c
+so3/usr/src/lvgl_widgets.c
 # The whole linux/ tree is a build working area, not committed: linux/linux
 # is the fetched agency kernel, linux/usr is regenerated from the meta-usr
 # patch set (base + :soo), linux/images holds rendered ITS + .itb output.

build/meta-toolchain/recipes-toolchain/musl/files/config.mak

@@ -19,6 +19,17 @@
 GNU_SITE = https://ftp.gnu.org/gnu
 DL_CMD = wget -c --tries=5 --waitretry=10 --timeout=30 -O
 
+# Same story for the musl tarball itself: musl.libc.org is a single host with
+# no mirror rotation, and when it goes down (timeouts, then "Unable to
+# establish SSL connection" — observed 2026-08-10, both CI platforms and from
+# outside CI) the toolchain build fails at ~2 min and no amount of retrying
+# helps. Fetch it from the MacPorts distfiles mirror, which carries the exact
+# upstream tarball. musl-cross-make checks every download against
+# hashes/<file>.sha1, so a mirror serving anything else fails the build loudly
+# rather than silently building something different (verified: the mirrored
+# musl-1.2.5.tar.gz matches hashes/musl-1.2.5.tar.gz.sha1).
+MUSL_SITE = https://distfiles.macports.org/musl
+
 BINUTILS_VER = 2.44
 GCC_VER = 12.4.0
 # MUSL_VER = git-master

doc/source/release_process.rst

@@ -141,6 +141,20 @@ release (they drift silently otherwise):
   ``PREFERRED_VERSION_avz`` entries in ``build/conf/local.conf`` (see the
   ``v6.2.3`` bump for a template).
 
+Before tagging: check the CI
+***************************
+
+The ``Build`` workflow runs on ``main`` **and on every** ``release/**``
+**branch**, so the commit a tag will point at has always been built. Check it
+before tagging::
+
+   gh run list --workflow Build --branch release/v6.2
+
+Tagging a red commit is how ``v6.2.4`` shipped a tree that no fresh clone
+could build. ``build (virt32)`` and ``build (virt64)`` are required status
+checks on ``main`` for the same reason: merging on red stays possible for a
+maintainer, but never by accident.
+
 Rules of thumb
 **************
 

so3/so3/include/version.h

@@ -35,7 +35,7 @@
  * (see scripts/so3version.sh and include/generated/autoversion.h). Keep this in
  * sync with the current release tag as a safety net.
  */
-#define SO3_KERNEL_VERSION_FALLBACK "6.2.3"
+#define SO3_KERNEL_VERSION_FALLBACK "6.2.5"
 
 /* Release version resolved at build time (git tag -> base version). */
 #include <generated/autoversion.h>