dandri/pyxis
1
0
Fork 0
mirror of https://github.com/torlando-tech/pyxis.git synced 2026-08-27 21:19:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix: bound map TLS trust memory

Browse Source
This commit is contained in:
torlando-agent[bot]
2026-08-07 01:37:13 +00:00
parent 8ba5a678c4
commit 552d3aab42
3 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/tdeck_ui/Hardware/TDeck/MapTileCa.h
+8 -5
View File
@@ -7,10 +7,11 @@
namespace Hardware {
namespace TDeck {
// Public trust anchors for the default OpenStreetMap endpoint; these are not
// credentials. GlobalSign Root CA - R3 covers the endpoint's current chain,
// while ISRG Root X1 preserves compatibility with its previous CDN chain.
static const char MAP_TILE_CA_BUNDLE[] = R"CERT(-----BEGIN CERTIFICATE-----
// Public trust anchors observed for the default OpenStreetMap endpoint; these
// are not credentials. Only the current GlobalSign Root CA - R3 chain is
// loaded at runtime so mbedTLS retains enough constrained internal RAM for the
// handshake. ISRG Root X1 is retained as a known previous-chain reference.
static const char MAP_TILE_ISRG_ROOT_X1[] = R"CERT(-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
@@ -41,7 +42,9 @@ oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
)CERT";
static const char MAP_TILE_GLOBALSIGN_ROOT_R3[] = R"CERT(-----BEGIN CERTIFICATE-----
MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAwTDEgMB4G
A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNp
Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4
lib/tdeck_ui/UI/LXMF/MapScreen.cpp
+1 -1
View File
@@ -34,7 +34,7 @@ constexpr std::uint16_t STORE_ENTRY_CAPACITY = 128U;
Hardware::TDeck::MapTileDownloadConfig makeDownloadConfig() {
Hardware::TDeck::MapTileDownloadConfig config;
config.ca_certificate = Hardware::TDeck::MAP_TILE_CA_BUNDLE;
config.ca_certificate = Hardware::TDeck::MAP_TILE_GLOBALSIGN_ROOT_R3;
config.firmware_version = FIRMWARE_VERSION;
return config;
}
tests/build_scripts/test_map_tile_downloader_contract.py
+5 -3
View File
@@ -39,14 +39,16 @@ def test_https_adapter_verifies_peer_with_explicit_ca_and_has_no_credentials():
assert forbidden not in source
def test_default_endpoint_trust_bundle_covers_current_and_fallback_chains():
def test_default_endpoint_uses_current_chain_with_known_fallback_available():
ca = MAP_CA.read_text()
screen = MAP_SCREEN.read_text()
assert "MAP_TILE_CA_BUNDLE" in ca
assert "MAP_TILE_GLOBALSIGN_ROOT_R3" in ca
assert "MAP_TILE_ISRG_ROOT_X1" in ca
assert "GlobalSign Root CA - R3" in ca
assert "ISRG Root X1" in ca
assert ca.count("-----BEGIN CERTIFICATE-----") == 2
assert "MAP_TILE_CA_BUNDLE" in screen
assert "MAP_TILE_GLOBALSIGN_ROOT_R3" in screen
assert "MAP_TILE_CA_BUNDLE" not in screen
certificates = re.findall(
r"-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----", ca, re.S)
fingerprints = []