mirror of
https://github.com/agessaman/MeshCore.git
synced 2026-08-26 19:59:50 +00:00
agessaman
74a3df3206
The manifest said "rebuild these for every espressif32 platform bump" and nothing enforced it. mbedtls_4k.py verified the staged archives against the manifest's own hashes, which proves the pair agrees with itself and nothing more: bump the platform without rebuilding and every check still passes while the link takes mbedTLS built against a different IDF. That fails at runtime on struct-layout drift, not at the link, which is the failure the mechanism claimed to prevent. Fingerprint the framework's own mbedTLS archives — the ones ours displace — as stock: lines in the manifest and check them before the build. If the framework moves, the staged pair is stale by construction and the build stops with the replacement hashes printed ready to paste. Stronger than comparing a version string: framework-arduinoespressif32 versions independently of the platform, and its archives are what actually has to match. The lib directory is resolved by trying the layouts espressif32 has used rather than hardcoding one, and failing closed if none holds all four archives. The fetch script ignores the new lines; its known-arches hint skips them so they cannot be reported as architectures.
76 lines
2.8 KiB
Bash
Executable File
76 lines
2.8 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Fetch the reduced-TLS mbedTLS archives into .mbedtls-4k/<arch>/.
|
|
#
|
|
# These archives are built from the shipped sdkconfig plus three lines
|
|
# (CONFIG_MBEDTLS_ASYMMETRIC_CONTENT_LEN=y, IN_CONTENT_LEN 16384,
|
|
# OUT_CONTENT_LEN 4096) and save ~12 KiB of internal DRAM per TLS connection.
|
|
# See docs/mbedtls-tls-footprint.md for the rationale and the build recipe.
|
|
#
|
|
# They are not committed: ~6 MB per architecture, and they must be rebuilt for
|
|
# every platform bump, so they are published as a release asset keyed on the
|
|
# espressif32 platform version instead.
|
|
#
|
|
# scripts/fetch_mbedtls_4k.sh [arch] # default: esp32s3
|
|
#
|
|
# Set MBEDTLS_4K_LOCAL to skip the download and copy from a local build tree:
|
|
# MBEDTLS_4K_LOCAL=~/mbedtls-4k-esp32s3/staged scripts/fetch_mbedtls_4k.sh
|
|
set -euo pipefail
|
|
|
|
ARCH="${1:-esp32s3}"
|
|
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
DEST="$REPO_ROOT/.mbedtls-4k/$ARCH"
|
|
MANIFEST="$REPO_ROOT/scripts/mbedtls_4k_manifest.txt"
|
|
BASE_URL="${MBEDTLS_4K_BASE_URL:-https://github.com/agessaman/MeshCore/releases/download/mbedtls-4k}"
|
|
|
|
if [ ! -f "$MANIFEST" ]; then
|
|
echo "error: missing $MANIFEST" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# Manifest lines: <arch> <sha256> <filename>. Blank lines and # comments ignored.
|
|
# The "platform" and "stock:<arch>" lines bind the archives to a framework version;
|
|
# they are the build check's business, not ours, and are not architectures.
|
|
expected="$(awk -v a="$ARCH" '$1 == a && $0 !~ /^#/ {print $2" "$3}' "$MANIFEST")"
|
|
if [ -z "$expected" ]; then
|
|
echo "error: no manifest entries for arch '$ARCH'" >&2
|
|
echo "known arches: $(awk '$0 !~ /^#/ && NF && $1 != "platform" && $1 !~ /^stock:/ {print $1}' \
|
|
"$MANIFEST" | sort -u | tr '\n' ' ')" >&2
|
|
exit 1
|
|
fi
|
|
|
|
mkdir -p "$DEST"
|
|
|
|
if [ -n "${MBEDTLS_4K_LOCAL:-}" ]; then
|
|
echo "copying from $MBEDTLS_4K_LOCAL"
|
|
while read -r _sha name; do
|
|
cp "$MBEDTLS_4K_LOCAL/$name" "$DEST/$name"
|
|
done <<< "$expected"
|
|
else
|
|
TARBALL="mbedtls-4k-$ARCH.tar.gz"
|
|
echo "downloading $BASE_URL/$TARBALL"
|
|
tmp="$(mktemp -d)"
|
|
trap 'rm -rf "$tmp"' EXIT
|
|
curl -fsSL "$BASE_URL/$TARBALL" -o "$tmp/$TARBALL"
|
|
tar -xzf "$tmp/$TARBALL" -C "$tmp"
|
|
while read -r _sha name; do
|
|
# Accept the archive whether or not the tarball has a leading directory.
|
|
found="$(find "$tmp" -name "$name" -type f | head -1)"
|
|
if [ -z "$found" ]; then
|
|
echo "error: $name missing from $TARBALL" >&2
|
|
exit 1
|
|
fi
|
|
cp "$found" "$DEST/$name"
|
|
done <<< "$expected"
|
|
fi
|
|
|
|
# Verify every archive against the manifest. A wrong or truncated archive would
|
|
# otherwise link silently and produce a firmware without the reduced buffers.
|
|
cd "$DEST"
|
|
if command -v shasum >/dev/null 2>&1; then
|
|
echo "$expected" | shasum -a 256 -c -
|
|
else
|
|
echo "$expected" | sha256sum -c -
|
|
fi
|
|
|
|
echo "ok: $ARCH archives verified in $DEST"
|