From e097f30c13bef52dc01a2b539a937a460b0edf93 Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com>
Date: Wed, 9 Sep 2026 23:44:54 +0000
Subject: [PATCH 1/2] chore(deps): update dependency kernel-rt-7.2 to v7.2.4

---
 configs/mister_rt.fragment | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configs/mister_rt.fragment b/configs/mister_rt.fragment
index adfe3557..6a53fc00 100644
--- a/configs/mister_rt.fragment
+++ b/configs/mister_rt.fragment
@@ -16,7 +16,7 @@
 # This pin is a signed-manifest release, strictly stronger than the TOFU hash
 # the old -rc pins had: do NOT reintroduce a TOFU value here without moving
 # back to an -rc (the sync script refuses -rc values; only a hand pin can).
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="7.2.3"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="7.2.4"
 
 # --- Beta patch set: the series-file-driven subset of linux-patches/ (§7.2) ---
 # WARNING: the series deliberately DROPS 0047 (already in 7.2; at -F0 its hunk

From f0fd790986ae889535a73c7b9f772374b83685f7 Mon Sep 17 00:00:00 2001
From: "renovate-hash-sync[bot]" <renovate-hash-sync@users.noreply.github.com>
Date: Wed, 9 Sep 2026 23:45:18 +0000
Subject: [PATCH 2/2] renovate-hash-sync: refresh companion hash(es) for this
 PR

Recomputed from a freshly-fetched artifact:
  - driver/firmware/libchdr package pins: sha256sum of the github
    archive tarball at the new pinned owner/repo/ref (same "locally
    computed" practice this tree's own .hash file headers already
    document)
  - kernel pins (stable 6.18.y and the RT/beta 7.2 line): kernel.org's
    signed sha256sums.asc for each pin's own vN.x series. An -rc is
    never refreshed here -- no signed manifest exists for one
  - ip7z/7zip pins (lzma-sdk, 7zip): sha256sum of the release
    ASSET for the new version (upstream publishes no checksums at
    all -- see package/lzma-sdk/lzma-sdk.hash's header), PLUS the
    files each package's *_LICENSE_FILES names, hashed from that
    same asset. A changed license file is refreshed AND diffed
    into the step log with a ::warning:: -- read that diff before
    merging; it is the only thing standing between an automated
    hash refresh and a silent relicense
  - sdcard payload pins (update_all.sh, wifi.sh): sha256 + size of
    the raw file at the new pinned commit, rewritten in place in
    scripts/fetch-sdcard-payload.sh
  - Buildroot pin (BUILDROOT_SHA256, root Makefile): transcribed
    from buildroot.org's GPG-signed release manifest
    (buildroot-<ver>.tar.gz.sign) -- the same signed file `make
    buildroot-showsig` prints, never a locally-computed sha256sum
    of the tarball (that remains forbidden; see the Makefile's own
    header comment)
  - azcopy pin: REBUILT, not fetched. Buildroot's own
    support/download/go-post-process re-ran `go mod vendor` over the
    newly pinned tag with the Go version the pinned Buildroot tree
    pins, and the resulting azcopy-<ver>-go2.tar.gz was hashed --
    the only way this value can be derived, since no URL serves that
    file (see package/azcopy/azcopy.hash's header). LICENSE and
    NOTICE.txt were re-hashed from the same tarball
  - golden config hashes (configs/fragments/golden.sha256): on a
    Buildroot bump only, the target branch's own
    scripts/check-config-fragments.sh --update-golden was run
    against the freshly unpacked (hash-verified) Buildroot tree and
    the new version's lines recorded -- never a rewrite of lines
    that already existed (docs/buildroot-config.md section 11)
---
 board/mister/de10nano/patches/linux/linux.hash | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/board/mister/de10nano/patches/linux/linux.hash b/board/mister/de10nano/patches/linux/linux.hash
index bd274e0d..50238065 100644
--- a/board/mister/de10nano/patches/linux/linux.hash
+++ b/board/mister/de10nano/patches/linux/linux.hash
@@ -90,4 +90,4 @@ sha256  ae826f33111fea6f1d279dde7299d7463c8dfd204aeb75a8fb5432bc60a28191  linux-
 # also the one case scripts/hash-sync-kernel.sh refuses to automate -- it
 # declines any value containing "-rc" and leaves this line alone, so the build
 # fails closed rather than blessing a snapshot nobody looked at.
-sha256  8ba259e8e7b13ec6ef0941c8a39ad90b24bd4a4d6c0010ba6bafb794550ecd03  linux-7.2.3.tar.xz
+sha256  01710ee01737dac492f1bae52becd057e08d20d11589089aa06accff415c28dd  linux-7.2.4.tar.xz