Repository navigation
audit: esp32 / framework-arduinoespressif32 — does platform_packages override work? (parent #664) #672
Description
Parent: #664 (full context, scope, motivation).
What to check
- Open
crates/fbuild-packages/src/library/esp32_framework/mod.rs— confirm the framework URL / commit / sha256 are pinned asconst &strand that the only public constructor takes no override. - Open the orchestrator at
crates/fbuild-build/src/esp32/orchestrator/— does it consultconfig.get_env_config(env_name)?for aplatform_packagesentry naming this framework, and pass the URL+ref through to awith_overrideconstructor? Or does it only ever call the default constructor? - Reply on this issue with:
- bug exists — if the orchestrator never reads
platform_packages, plus file:line for both the const URL pin and the call site. (also check esp32_platform.rs and esp32/orchestrator/install_deps_processor.rs) - fixed / no bug — if an override path exists, plus file:line showing the lookup + override constructor.
- bug exists — if the orchestrator never reads
Reference
#663 is the original report of this pattern (nxplpc). #664 lists every framework package being audited. Use the same evidence shape: file:line for the const URL pin and for the orchestrator call site.
Activity
zackees commentedon Jun 20, 2026
VERDICT: bug exists
EVIDENCE (framework):
new(project_dir, _mcu), ignores overrides;from_url()at line 80 accepts URL but never called with platform_packagesEsp32Framework::new(project_dir, mcu)when platform.json lookup fails; no platform_packages checkEVIDENCE (platform):
new(project_dir), no override parameter; nofrom_url()alternativeEsp32Platform::new(project_dir), never readsenv_config.get("platform_packages")NOTES: ESP32 framework has
from_url()escape hatch (used for platform.json URLs) but orchestrator never checksplatform_packagesenv override. ESP32 platform has no constructor variant at all — completely hardcoded to pioarduino stable. Both silently ignore user overrides. Matches #663 exactly.