mirror of
https://github.com/mikecarper/MeshCore.git
synced 2026-09-26 16:27:57 +00:00
agessaman
8275512964
The reduced-TLS work was validated on hardware but only reachable through
PLATFORMIO_BUILD_FLAGS pointing at an absolute path in a developer's home
directory, so nothing outside that machine could reproduce it.
Distribute the archives as a release asset instead of committing them: ~6 MB
per architecture, and they must be rebuilt for every espressif32 bump, so
committing would grow history permanently and go stale without any signal.
scripts/mbedtls_4k_manifest.txt per-arch sha256 of each archive
scripts/fetch_mbedtls_4k.sh fetch into .mbedtls-4k/<arch>/, verify
scripts/mbedtls_4k.py pre-build wiring and post-link proof
Off by default. The script is attached to esp32_base but returns immediately
unless MESHCORE_REDUCED_TLS=1, so ordinary builds need no artifact and are
byte-for-byte unaffected — confirmed by building with it absent.
Both ways this can fail silently produce a firmware that looks fine and lacks
the change, so the opt-in path refuses to guess:
- a -L at a missing or partial directory: the linker ignores an unusable
search path and resolves mbedTLS from the framework. Now a hard error.
- archives left over from an earlier platform version: now a sha256
mismatch against the manifest, naming both hashes.
- a -L that is present but outranked, leaving the flag inert: after the
link, firmware.map must resolve every libmbed*.a into .mbedtls-4k/, or
the build fails and prints the offending paths.
That last check earned its place immediately — it caught its own first
implementation comparing a relative map path against an absolute one, and an
earlier build flag in this investigation was accepted by the compiler while
no source read it. A flag reaching the compiler proves nothing about the link.
Verified all four paths on Heltec_v3_repeater_observer_mqtt: default build
unaffected; opted in with archives present links all four from .mbedtls-4k/
and says so; archives absent fails with a fetch hint; a single appended byte
fails on sha256.
Also removes platformio.local.ini.hold, which held the superseded approach of
pointing platform_packages at a whole custom framework. That installs over the
shared framework package and changes mbedTLS for every other ESP32 project on
the machine; the -L path keeps the change scoped to one env.
Note the inbound record buffer stays at 16 KiB, so this lowers per-connection
footprint by ~12 KiB but does not move the contiguous allocation a handshake
needs. It buys headroom, not a lower floor.
(cherry picked from commit a87faff6ff170c328fdd0550f4b4dd9089aa2ea0)
73 lines
2.6 KiB
Bash
Executable File
73 lines
2.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Fetch the reduced-TLS mbedTLS archives into .mbedtls-4k/<arch>/.
|
|
#
|
|
# These archives are built from the shipped sdkconfig plus three lines
|
|
# (CONFIG_MBEDTLS_ASYMMETRIC_CONTENT_LEN=y, IN_CONTENT_LEN 16384,
|
|
# OUT_CONTENT_LEN 4096) and save ~12 KiB of internal DRAM per TLS connection.
|
|
# See docs/mbedtls-tls-footprint.md for the rationale and the build recipe.
|
|
#
|
|
# They are not committed: ~6 MB per architecture, and they must be rebuilt for
|
|
# every platform bump, so they are published as a release asset keyed on the
|
|
# espressif32 platform version instead.
|
|
#
|
|
# scripts/fetch_mbedtls_4k.sh [arch] # default: esp32s3
|
|
#
|
|
# Set MBEDTLS_4K_LOCAL to skip the download and copy from a local build tree:
|
|
# MBEDTLS_4K_LOCAL=~/mbedtls-4k-esp32s3/staged scripts/fetch_mbedtls_4k.sh
|
|
set -euo pipefail
|
|
|
|
ARCH="${1:-esp32s3}"
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
DEST="$REPO_ROOT/.mbedtls-4k/$ARCH"
|
|
MANIFEST="$REPO_ROOT/scripts/mbedtls_4k_manifest.txt"
|
|
BASE_URL="${MBEDTLS_4K_BASE_URL:-https://github.com/agessaman/MeshCore/releases/download/mbedtls-4k}"
|
|
|
|
if [ ! -f "$MANIFEST" ]; then
|
|
echo "error: missing $MANIFEST" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Manifest lines: <arch> <sha256> <filename>. Blank lines and # comments ignored.
|
|
expected="$(awk -v a="$ARCH" '$1 == a && $0 !~ /^#/ {print $2" "$3}' "$MANIFEST")"
|
|
if [ -z "$expected" ]; then
|
|
echo "error: no manifest entries for arch '$ARCH'" >&2
|
|
echo "known arches: $(awk '$0 !~ /^#/ && NF {print $1}' "$MANIFEST" | sort -u | tr '\n' ' ')" >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "$DEST"
|
|
|
|
if [ -n "${MBEDTLS_4K_LOCAL:-}" ]; then
|
|
echo "copying from $MBEDTLS_4K_LOCAL"
|
|
while read -r _sha name; do
|
|
cp "$MBEDTLS_4K_LOCAL/$name" "$DEST/$name"
|
|
done <<< "$expected"
|
|
else
|
|
TARBALL="mbedtls-4k-$ARCH.tar.gz"
|
|
echo "downloading $BASE_URL/$TARBALL"
|
|
tmp="$(mktemp -d)"
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
curl -fsSL "$BASE_URL/$TARBALL" -o "$tmp/$TARBALL"
|
|
tar -xzf "$tmp/$TARBALL" -C "$tmp"
|
|
while read -r _sha name; do
|
|
# Accept the archive whether or not the tarball has a leading directory.
|
|
found="$(find "$tmp" -name "$name" -type f | head -1)"
|
|
if [ -z "$found" ]; then
|
|
echo "error: $name missing from $TARBALL" >&2
|
|
exit 1
|
|
fi
|
|
cp "$found" "$DEST/$name"
|
|
done <<< "$expected"
|
|
fi
|
|
|
|
# Verify every archive against the manifest. A wrong or truncated archive would
|
|
# otherwise link silently and produce a firmware without the reduced buffers.
|
|
cd "$DEST"
|
|
if command -v shasum >/dev/null 2>&1; then
|
|
echo "$expected" | shasum -a 256 -c -
|
|
else
|
|
echo "$expected" | sha256sum -c -
|
|
fi
|
|
|
|
echo "ok: $ARCH archives verified in $DEST"
|