From 552d3aab422c1dc0de56031ec10fb01c8fefa8c2 Mon Sep 17 00:00:00 2001
From: "torlando-agent[bot]"
 <281092095+torlando-agent[bot]@users.noreply.github.com>
Date: Wed, 29 Jul 2026 14:12:05 +0000
Subject: [PATCH] fix: bound map TLS trust memory

---
 lib/tdeck_ui/Hardware/TDeck/MapTileCa.h             | 13 ++++++++-----
 lib/tdeck_ui/UI/LXMF/MapScreen.cpp                  |  2 +-
 .../test_map_tile_downloader_contract.py            |  8 +++++---
 3 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/lib/tdeck_ui/Hardware/TDeck/MapTileCa.h b/lib/tdeck_ui/Hardware/TDeck/MapTileCa.h
index 65cb93d3..83c2b1a2 100644
--- a/lib/tdeck_ui/Hardware/TDeck/MapTileCa.h
+++ b/lib/tdeck_ui/Hardware/TDeck/MapTileCa.h
@@ -7,10 +7,11 @@
 namespace Hardware {
 namespace TDeck {
 
-// Public trust anchors for the default OpenStreetMap endpoint; these are not
-// credentials. GlobalSign Root CA - R3 covers the endpoint's current chain,
-// while ISRG Root X1 preserves compatibility with its previous CDN chain.
-static const char MAP_TILE_CA_BUNDLE[] = R"CERT(-----BEGIN CERTIFICATE-----
+// Public trust anchors observed for the default OpenStreetMap endpoint; these
+// are not credentials. Only the current GlobalSign Root CA - R3 chain is
+// loaded at runtime so mbedTLS retains enough constrained internal RAM for the
+// handshake. ISRG Root X1 is retained as a known previous-chain reference.
+static const char MAP_TILE_ISRG_ROOT_X1[] = R"CERT(-----BEGIN CERTIFICATE-----
 MIIFazCCA1OgAwIBAgIRAIIQz7DSQONZRGPgu2OCiwAwDQYJKoZIhvcNAQELBQAw
 TzELMAkGA1UEBhMCVVMxKTAnBgNVBAoTIEludGVybmV0IFNlY3VyaXR5IFJlc2Vh
 cmNoIEdyb3VwMRUwEwYDVQQDEwxJU1JHIFJvb3QgWDEwHhcNMTUwNjA0MTEwNDM4
@@ -41,7 +42,9 @@ oyi3B43njTOQ5yOf+1CceWxG1bQVs5ZufpsMljq4Ui0/1lvh+wjChP4kqKOJ2qxq
 mRGunUHBcnWEvgJBQl9nJEiU0Zsnvgc/ubhPgXRR4Xq37Z0j4r7g1SgEEzwxA57d
 emyPxgcYxn/eR44/KJ4EBs+lVDR3veyJm+kXQ99b21/+jh5Xos1AnX5iItreGCc=
 -----END CERTIFICATE-----
------BEGIN CERTIFICATE-----
+)CERT";
+
+static const char MAP_TILE_GLOBALSIGN_ROOT_R3[] = R"CERT(-----BEGIN CERTIFICATE-----
 MIIDXzCCAkegAwIBAgILBAAAAAABIVhTCKIwDQYJKoZIhvcNAQELBQAwTDEgMB4G
 A1UECxMXR2xvYmFsU2lnbiBSb290IENBIC0gUjMxEzARBgNVBAoTCkdsb2JhbFNp
 Z24xEzARBgNVBAMTCkdsb2JhbFNpZ24wHhcNMDkwMzE4MTAwMDAwWhcNMjkwMzE4
diff --git a/lib/tdeck_ui/UI/LXMF/MapScreen.cpp b/lib/tdeck_ui/UI/LXMF/MapScreen.cpp
index 4a115c82..0db18db1 100644
--- a/lib/tdeck_ui/UI/LXMF/MapScreen.cpp
+++ b/lib/tdeck_ui/UI/LXMF/MapScreen.cpp
@@ -34,7 +34,7 @@ constexpr std::uint16_t STORE_ENTRY_CAPACITY = 128U;
 
 Hardware::TDeck::MapTileDownloadConfig makeDownloadConfig() {
     Hardware::TDeck::MapTileDownloadConfig config;
-    config.ca_certificate = Hardware::TDeck::MAP_TILE_CA_BUNDLE;
+    config.ca_certificate = Hardware::TDeck::MAP_TILE_GLOBALSIGN_ROOT_R3;
     config.firmware_version = FIRMWARE_VERSION;
     return config;
 }
diff --git a/tests/build_scripts/test_map_tile_downloader_contract.py b/tests/build_scripts/test_map_tile_downloader_contract.py
index 8d5b56ff..7efc338e 100644
--- a/tests/build_scripts/test_map_tile_downloader_contract.py
+++ b/tests/build_scripts/test_map_tile_downloader_contract.py
@@ -39,14 +39,16 @@ def test_https_adapter_verifies_peer_with_explicit_ca_and_has_no_credentials():
         assert forbidden not in source
 
 
-def test_default_endpoint_trust_bundle_covers_current_and_fallback_chains():
+def test_default_endpoint_uses_current_chain_with_known_fallback_available():
     ca = MAP_CA.read_text()
     screen = MAP_SCREEN.read_text()
-    assert "MAP_TILE_CA_BUNDLE" in ca
+    assert "MAP_TILE_GLOBALSIGN_ROOT_R3" in ca
+    assert "MAP_TILE_ISRG_ROOT_X1" in ca
     assert "GlobalSign Root CA - R3" in ca
     assert "ISRG Root X1" in ca
     assert ca.count("-----BEGIN CERTIFICATE-----") == 2
-    assert "MAP_TILE_CA_BUNDLE" in screen
+    assert "MAP_TILE_GLOBALSIGN_ROOT_R3" in screen
+    assert "MAP_TILE_CA_BUNDLE" not in screen
     certificates = re.findall(
         r"-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----", ca, re.S)
     fingerprints = []