dev #32

Merged

faicel merged 26 commits from dev into staging 2026-09-04 22:31:24 +00:00

Conversation 0 Commits 26 Files changed 158 +32576 -6915

faicel commented 2026-09-04 22:31:15 +00:00

Owner

Copy link

No description provided.

faicel added 26 commits 2026-09-04 22:31:15 +00:00

init big upgrade f70ae0187e

speckit plannings ee296c8509

, 16a825994f

Update dependencies, refine documentation, and enhance CI workflows ... 3f835e9b1d

- Added new dependencies: `base16ct`, `const-oid`, `crypto-bigint`, `elliptic-curve`, `ff`, `group`, `p256`, and `primeorder`.
- Updated existing dependencies: `crypto-common` and `sigil`.
- Improved `.gitignore` to exclude additional directories and files.
- Enhanced README to clarify architecture and feature configurations.
- Added `deny.toml` for dependency policy management.
- Refined CI workflows for better checks and tagging processes.
- Removed obsolete files related to previous project management tools.

Add footprint reporting example and performance measurement tests ... 30ad8a7597

- Introduced a new example `footprint_report.rs` for capturing size measurements of public types in different feature configurations.
- Updated `.gitignore` to include the generated footprint report in `docs/`.
- Added performance measurement modules in AEAD and installation tests, gated by feature flags for development purposes.
- Enhanced documentation to reflect the latest footprint report update date.

Update version to 1.1.0, enhance security documentation, and implement replay defense ... 4260ec8405

- Bump version of the `sigil` package to 1.1.0 in `Cargo.toml` and `Cargo.lock`.
- Add a new security and threat model section in `README.md`, detailing the limitations of Install/Resume epochs regarding forward secrecy.
- Introduce a replay defense mechanism in the install handshake process, including cache management for replayed requests.
- Update the changelog with detailed descriptions of the new features and changes.
- Enhance error handling with new variants for replay detection in `SigilError`.
- Add tests for the replay defense and durable PSK handling in the install process.

Refactor CI workflows to use inherited secrets for Rust crate checks ... 1846634af4

- Updated `_rust-crate-checks.yml` to remove the `secrets` block under `on.workflow_call`, clarifying that callers must pass secrets using `jobs.<id>.secrets: inherit`.
- Modified all workflows that utilize `_rust-crate-checks.yml` to adopt the new secrets inheritance method, enhancing security and compliance with Forgejo's limitations.
- Added documentation in `README.md` to explain the new secrets handling approach.

fix change log fdc3560a43

fix changelog 26c8db7935

install thumbv6m-none-eabi 7595a9b25d

Merge branch 'dev' into test 38636f2c10

Merge pull request 'test' (#29) from test into dev ... 03dc6a54e7

Reviewed-on: #29

Add OTA firmware-update protocol module behind the ota feature ... 3c39bf22e6

New core::ota module, fully additive (no SigilEvent/SigilError/FrameType
changes), off by default and never implied:

- Shared tier (ota alone): wire codec for command ids 0x10..0x18 under the
  0x7F product envelope, manifest_digest_input/manifest_digest single
  source of truth, local OtaError taxonomy, hand-written golden vectors.
- Receive half (sensor,ota): OtaStorage sink trait, TrailerRecord bootable
  marker, OtaReceiver with contiguous chunks, incremental SHA-256,
  erase-once block bookkeeping, ECDSA-gated finalize via SecureElement,
  STATUS projection, ABORT, idle timeout.
- Send half (gateway,ota): OtaImageSource trait, OtaSender stop-and-wait
  engine with digest preflight, bounded resends, cumulative-ACK progress,
  STATUS-driven resume, REBOOT gated on completion.
- Interop suite drives both engines through the real codec under loss.

Feature-matrix gate extended with ota/sensor,ota/gateway,ota; embedded
cross-checks extended to thumbv6m sensor,ota and armv7 gateway,ota;
empty-set diagnostic accepts the ota-only tooling tier; version 1.2.0;
CHANGELOG, README, CLAUDE.md updated.

Harden OTA storage geometry, reply correlation, and API policy ... 0a2906ee43

Architecture-audit remediation:
- Erase-once bitmap commits each block only after its erase succeeds;
  failed erases retry verbatim while committed blocks are never re-erased
  (shared-block staged bytes survive fault/retry episodes).
- Storage integration errors become runtime errors instead of panics:
  zero granularity rejected at BEGIN/chunk/finalize; trailer erase range
  computed by a single checked helper shared by validation and write, with
  BEGIN enforcing disjointness from the image window (aligned start >=
  staging_cap) before any flash access.
- Sender correlates replies to the ACTIVE manifest: ACK_READY must echo
  the negotiated chunk_len and STATUS must carry matching version+length,
  else they are inert. The receiver's Idle STATUS projection retains the
  dropped session identity so legitimate resume-after-expiry still works.
- Sender validates source len() against the signed length before hashing.
- OtaError is #[non_exhaustive] from day one; closed v1 wire enums
  documented. ota feature no longer pulls heapless; OtaStorage drops the
  unused read() method (readback belongs to host bootloaders).
- Strict rustdoc gate added to scripts/test.sh; broken intra-doc links
  fixed via root re-exports; wording corrections.

Reject trailer erase ranges whose end overflows the address space ... 14b51f1ed4

aligned_trailer_range now verifies start + span with checked arithmetic,
so a trailer block at the top of the 32-bit flash space is rejected at
BEGIN with the standard integration error instead of wrapping. Boundary
test included.

Reuse staged chunk bytes on OTA retransmission and pin engine size bounds ... 3f2dc06b41

Performance-audit remediation:
- Sender poll() resends the already-staged in-flight chunk without any
  OtaImageSource read; the image parameter is dropped from poll(). A
  counting-source test proves zero reads on resend and exactly one read
  when advancing to the next sequence.
- New dual-role-gated type_size_bounds suite pins measured host sizes of
  OtaSender/OtaReceiver/BeginFrame/TrailerRecord behind explicit approved
  caps, per the crate-wide footprint contract.
- SAMD21 linked-footprint and stack high-water measurement is recorded as
  an explicit handoff requirement for the firmware integration project.

Bind product identity into signed OTA manifests and enforce anti-rollback ... d1b2acd311

Security-audit remediation:
- Manifest v2: sigil-ota-v2 domain now binds product_id (u16 LE) into the
  signed digest, so images validly signed for another product sharing the
  factory root are rejected at verification.
- Anti-rollback: OtaReceiverConfig::min_acceptable_version refuses strictly
  older signed versions at BEGIN with new wire verdict VERSION_REJECTED(6);
  equality remains a valid repair; the durable floor is host-owned.
- Manifest authentication moved to BEGIN (before any staging flash access):
  invalid signatures never open a session or spend erase/write cycles;
  FINALIZE keeps verifying the staged-bytes hash against the authenticated
  manifest.
- Absolute per-session lifetime ceiling bounds identical-BEGIN pinning
  (ExpiredAbsoluteLifetime); idle refresh alone can no longer hold a session.
- Literal golden vectors (manifest input, digest image SHA, compressed
  P-256 key, real r||s signature) generated deterministically and verified
  against the independent p256 implementation; ACK_FINAL VersionRejected
  frame vector added.
- Host authorization requirements documented (one receiver per authorized
  gateway; admission budgets stay host policy). p256 dev-dep gains the
  ecdsa feature for the conformance check only.

Bind hardware_profile_id into signed OTA manifests ... 48c74e88fa

Closes the remaining security-audit finding (MAJOR, uncertain scope):
manifest v2 now signs product_id AND the hardware profile byte that
install factory certificates already attest, making OTA images fully
target-bound even when several boards share one factory root. Manifest
input grows to 56 bytes; receiver config gains hardware_profile_id;
frozen P-256 literals and the deterministic generator were regenerated;
CLAUDE.md documents the compatibility invariant.

Migrate Forgejo CI to faicel/central_ci thin callers ... 0cd6b6aaa4

Replace the inline tag/publish/check logic in .forgejo/workflows with thin
callers to the shared faicel/central_ci reusable workflows (rust_crate_checks,
create_tag_on_dev, create_tag_on_main, publish_on_tag, validate_flow), aligned
with the model already used by lis2dh12. Delete the local
_rust-crate-checks.yml gate. Every caller passes
test_command: bash scripts/test.sh; the feature clippy matrix (all features,
sensor, gateway) moves into that script so CI lint coverage is unchanged.
Add scripts/deny-check.sh as the local dependency-policy wrapper. Document
the thin-caller model and the owner-accepted mutable central_ci@main ref risk
in .forgejo/README.md.

Run the feature clippy matrix before the test matrix ... d62a724c5e

Fail-fast: a lint-only regression now surfaces in minutes instead of after
the multi-minute locked feature-matrix test run. Zero effect on green runs;
no gate added, removed, or weakened.

[1.2.1] - 2026-09-05 ... fa3a6c53b5

- Update README.md
 - Migrate the Forgejo CI workflows

Merge branch 'dev' into fix/forgejo-central-ci 14f22b3c26

Merge pull request 'fix/forgejo-central-ci' (#30) from fix/forgejo-central-ci into dev ... 6158e7b472

Reviewed-on: #30

update 0851aaade0

Merge branch 'dev' into fix/forgejo-central-ci e5f429b492

Merge pull request 'update' (#31) from fix/forgejo-central-ci into dev ... 24a08917ad

Reviewed-on: #31

faicel merged commit 1aebb39cf8 into staging 2026-09-04 22:31:24 +00:00

faicel referenced this pull request from a commit 2026-09-04 22:31:24 +00:00

Merge pull request 'dev' (#32) from dev into staging

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

homeiot/sigil!32

No description provided.