mirror of
https://github.com/mikecarper/MeshCore.git
synced 2026-09-26 19:57:55 +00:00
agessaman
8275512964
The reduced-TLS work was validated on hardware but only reachable through
PLATFORMIO_BUILD_FLAGS pointing at an absolute path in a developer's home
directory, so nothing outside that machine could reproduce it.
Distribute the archives as a release asset instead of committing them: ~6 MB
per architecture, and they must be rebuilt for every espressif32 bump, so
committing would grow history permanently and go stale without any signal.
scripts/mbedtls_4k_manifest.txt per-arch sha256 of each archive
scripts/fetch_mbedtls_4k.sh fetch into .mbedtls-4k/<arch>/, verify
scripts/mbedtls_4k.py pre-build wiring and post-link proof
Off by default. The script is attached to esp32_base but returns immediately
unless MESHCORE_REDUCED_TLS=1, so ordinary builds need no artifact and are
byte-for-byte unaffected — confirmed by building with it absent.
Both ways this can fail silently produce a firmware that looks fine and lacks
the change, so the opt-in path refuses to guess:
- a -L at a missing or partial directory: the linker ignores an unusable
search path and resolves mbedTLS from the framework. Now a hard error.
- archives left over from an earlier platform version: now a sha256
mismatch against the manifest, naming both hashes.
- a -L that is present but outranked, leaving the flag inert: after the
link, firmware.map must resolve every libmbed*.a into .mbedtls-4k/, or
the build fails and prints the offending paths.
That last check earned its place immediately — it caught its own first
implementation comparing a relative map path against an absolute one, and an
earlier build flag in this investigation was accepted by the compiler while
no source read it. A flag reaching the compiler proves nothing about the link.
Verified all four paths on Heltec_v3_repeater_observer_mqtt: default build
unaffected; opted in with archives present links all four from .mbedtls-4k/
and says so; archives absent fails with a fetch hint; a single appended byte
fails on sha256.
Also removes platformio.local.ini.hold, which held the superseded approach of
pointing platform_packages at a whole custom framework. That installs over the
shared framework package and changes mbedTLS for every other ESP32 project on
the machine; the -L path keeps the change scoped to one env.
Note the inbound record buffer stays at 16 KiB, so this lowers per-connection
footprint by ~12 KiB but does not move the contiguous allocation a handshake
needs. It buys headroom, not a lower floor.
(cherry picked from commit a87faff6ff170c328fdd0550f4b4dd9089aa2ea0)
39 lines
992 B
Plaintext
39 lines
992 B
Plaintext
.direnv
|
|
.pio
|
|
.build-wt-*
|
|
.vscode/.browse.c_cpp.db*
|
|
.vscode/c_cpp_properties.json
|
|
.vscode/launch.json
|
|
.vscode/ipch
|
|
out/
|
|
.direnv/
|
|
.DS_Store
|
|
.vscode/settings.json
|
|
.vscode/extensions.json
|
|
.idea
|
|
cmake-*
|
|
.cache
|
|
.ccls
|
|
compile_commands.json
|
|
.venv/
|
|
venv/
|
|
# Script-generated cert bundles (see scripts/generate_cert_bundle.py)
|
|
src/certs/x509_crt_bundle.bin
|
|
src/helpers/esp32/WebConfigHtml.h
|
|
ssl_certs/cacert.pem
|
|
platformio.local.ini
|
|
.cursor/*
|
|
.claude/*
|
|
.cursorrules
|
|
# Worktrees checked out inside the repo. Committing one adds a stray gitlink
|
|
# that makes every CI checkout warn "No url found for submodule path ... in
|
|
# .gitmodules", and leaves `git status` permanently dirty so the next `git add
|
|
# -A` re-commits it. .wt-* covers the hand-made ones; .build-wt-* the CI ones.
|
|
.build-wt-*/
|
|
.wt-*/
|
|
scripts/__pycache__/*
|
|
|
|
# Reduced-TLS mbedTLS archives, ~6 MB per arch, fetched by scripts/fetch_mbedtls_4k.sh.
|
|
# Not committed because they must be rebuilt for every espressif32 platform bump.
|
|
.mbedtls-4k/
|