Harden observer preferences and portable controls

scripts/generate_cert_bundle.py

@@ -179,18 +179,21 @@ class InputError(RuntimeError):
 
 def main():
 
-    # Portable observer presets pin their required roots directly in
-    # MQTTPresets.h. Keep the embedded bundle structurally valid but empty so
-    # custom TLS trust stores do not consume 66 KB of the legacy app slot.
+    # Portable observer presets pin their MQTT roots directly in
+    # MQTTPresets.h. Keep only the GlobalSign root needed by the manifest and
+    # firmware hosts so HTTPS pull OTA remains verified without carrying the
+    # roughly 66 KB general-purpose bundle in the legacy app slot.
     if (
         "observer_mqtt" in env.subst("$PIOENV").lower()
         and os.environ.get("MESHCORE_ESP32_FULL_BUILD") != "1"
     ):
+        bundle = CertificateBundle()
+        bundle.add_from_file(os.path.join(certs_dir, "globalsign_root_ca_r1.pem"))
         os.makedirs(binary_dir, exist_ok=True)
         output_file = os.path.join(binary_dir, ca_bundle_bin_file)
         with open(output_file, 'wb') as f:
-            f.write(struct.pack('>H', 0))
-        status('Created empty portable-observer certificate bundle')
+            f.write(bundle.create_bundle())
+        status('Created portable-observer OTA certificate bundle')
         return
 
     bundle = CertificateBundle()