Harden observer preferences and portable controls

scripts/generate_cert_bundle.py

@@ -179,18 +179,21 @@ class InputError(RuntimeError):
 
 def main():
 
-    # Portable observer presets pin their required roots directly in
-    # MQTTPresets.h. Keep the embedded bundle structurally valid but empty so
-    # custom TLS trust stores do not consume 66 KB of the legacy app slot.
+    # Portable observer presets pin their MQTT roots directly in
+    # MQTTPresets.h. Keep only the GlobalSign root needed by the manifest and
+    # firmware hosts so HTTPS pull OTA remains verified without carrying the
+    # roughly 66 KB general-purpose bundle in the legacy app slot.
     if (
         "observer_mqtt" in env.subst("$PIOENV").lower()
         and os.environ.get("MESHCORE_ESP32_FULL_BUILD") != "1"
     ):
+        bundle = CertificateBundle()
+        bundle.add_from_file(os.path.join(certs_dir, "globalsign_root_ca_r1.pem"))
         os.makedirs(binary_dir, exist_ok=True)
         output_file = os.path.join(binary_dir, ca_bundle_bin_file)
         with open(output_file, 'wb') as f:
-            f.write(struct.pack('>H', 0))
-        status('Created empty portable-observer certificate bundle')
+            f.write(bundle.create_bundle())
+        status('Created portable-observer OTA certificate bundle')
         return
 
     bundle = CertificateBundle()

scripts/portable_esp32_link.py

@@ -14,15 +14,26 @@ def has_define(name):
     return False
 
 
-build_flags = str(env.get("BUILD_FLAGS", "")) + " " + os.environ.get("PLATFORMIO_BUILD_FLAGS", "")
-pio_env = env.subst("$PIOENV").lower()
-full_build = os.environ.get("MESHCORE_ESP32_FULL_BUILD") == "1"
+build_flags = (
+    str(env.get("BUILD_FLAGS", ""))
+    + " "
+    + os.environ.get("PLATFORMIO_BUILD_FLAGS", "")
+)
 
-if (has_define("PORTABLE_ESP32_NANO_LIBC") or
-        "PORTABLE_ESP32_NANO_LIBC" in build_flags or
-        os.environ.get("MESHCORE_PORTABLE_NANO_LIBC") == "1" or
-        (not full_build and ("observer_mqtt" in pio_env or "bridge_espnow" in pio_env))):
-    # newlib-nano provides the same C ABI with a substantially smaller printf
-    # implementation. These profiles omit display, GPS, external sensors, and
-    # the general CLI paths that require floating-point printf.
-    env.Append(LINKFLAGS=["--specs=nano.specs"])
+if (
+    has_define("PORTABLE_ESP32_ROM_NANO_FORMAT")
+    or "PORTABLE_ESP32_ROM_NANO_FORMAT" in build_flags
+):
+    # ESP-IDF supplies linker tables for the compact printf implementation in
+    # chip ROM. This retains the framework's normal C library and ABI; it does
+    # not substitute libc_nano. The classic ESP32 table must not be used with
+    # that chip's PSRAM cache workaround. The ESP32-S3 has its own ROM table and
+    # no equivalent restriction in the framework linker script.
+    mcu = str(env.BoardConfig().get("build.mcu", "")).lower()
+    classic_esp32_psram = mcu == "esp32" and (
+        has_define("BOARD_HAS_PSRAM") or "BOARD_HAS_PSRAM" in build_flags
+    )
+    if mcu == "esp32" and not classic_esp32_psram:
+        env.Append(LINKFLAGS=["-T", "%s.rom.newlib-nano.ld" % mcu])
+    elif mcu == "esp32s3":
+        env.Append(LINKFLAGS=["-T", "%s.rom.newlib-nano.ld" % mcu])