Migrate to IDF 5.5.3 candidate
Pin PlatformIO packages and toolchains, rebase protected SDK overrides, and add WebSocket receive regression coverage. Document isolated candidate validation, archive provenance, and remaining gates.
This commit is contained in:
@@ -17,12 +17,12 @@ installs, builds, runs PlatformIO, accesses a device, or regenerates assets.
|
||||
|
||||
Run from the repository root. Supply **an explicit, not-yet-existing output
|
||||
directory outside all three input roots**, with an existing parent. Example
|
||||
for the inventory's local installation (choose a fresh final directory name):
|
||||
for the reviewed installed 5.5.3 candidate (choose a fresh final directory name):
|
||||
|
||||
```sh
|
||||
python3 tools/release_notices.py \
|
||||
--sdk-root /home/mscholz/.platformio/packages/framework-espidf \
|
||||
--toolchain-root /home/mscholz/.platformio/packages/toolchain-xtensa-esp-elf \
|
||||
--sdk-root /home/mscholz/Repos/ESP32_serial_swiss_army_knife/.pio/idf-candidate-5.5.3/core/packages/framework-espidf \
|
||||
--toolchain-root /home/mscholz/Repos/ESP32_serial_swiss_army_knife/.pio/idf-candidate-5.5.3/core/packages/toolchain-xtensa-esp-elf \
|
||||
--output /tmp/esp32-release-notices-review-01
|
||||
```
|
||||
|
||||
@@ -135,6 +135,88 @@ turn; firmware source is unchanged. Assembly is not legal clearance or Phase 9
|
||||
acceptance. The [unfixed Wi-Fi blocker](wifi_security_update_plan.md) also remains
|
||||
a separate security gate; a future coherent vendor update requires catalog review.
|
||||
|
||||
## Installed candidate notice rebase — 2026-09-18
|
||||
|
||||
This addendum audits the existing 75-input catalog against **already installed**
|
||||
PlatformIO 6.13.0 migration candidates, not merely downloaded archives. No
|
||||
installation, build, production/config edit, or security-override rebase was
|
||||
performed by this notice audit. The preceding 2026-09-16 evidence is historical.
|
||||
|
||||
Actual candidate package root:
|
||||
`/home/mscholz/Repos/ESP32_serial_swiss_army_knife/.pio/idf-candidate-5.5.3/core/packages/`.
|
||||
Its `framework-espidf/package.json` reports **3.50503.0**, and `version.txt`
|
||||
reports **5.5.3**. Both `toolchain-xtensa-esp-elf/package.json` and
|
||||
`toolchain-riscv32-esp/package.json` report **14.2.0+20251107**. RISC-V identity
|
||||
was checked for context; it is not a new input root or a claim of RISC-V notice
|
||||
coverage. The shared `/home/mscholz/.platformio/packages/` still contains
|
||||
framework **3.50500.0 / IDF 5.5.0** and both toolchains **14.2.0+20241119**;
|
||||
do not use those shared paths with this rebased catalog.
|
||||
|
||||
All 75 old catalog full-file hashes/sizes matched the old shared SDK/toolchain
|
||||
and current project inputs before editing. Comparison against the installed
|
||||
candidate found exactly **nine changed entries** (eight SDK, one Xtensa),
|
||||
listed below. The other **66 entries remain unchanged**, including all **39
|
||||
project/managed inputs**, the dependency-lock pin, icon evidence and managed
|
||||
version map. No catalog paths, purposes unrelated to version identity, or
|
||||
excerpt ranges were added/removed/relaxed. Snapshot identity/date and the three
|
||||
identity-purpose strings were updated deliberately, not by automatic repinning.
|
||||
|
||||
Paths below are relative to the indicated catalog root. Hashes are full-source
|
||||
SHA-256; old hashes remain in the preceding Git catalog revision.
|
||||
|
||||
| Root / path | Old → candidate bytes | Candidate SHA-256 |
|
||||
| --- | ---: | --- |
|
||||
| sdk / `components/esp-tls/esp_tls_mbedtls.c` | 50176 → 54323 | `edc39052244526cb91c93a16bc765194031060e5560fd432e75542f2f6c8db53` |
|
||||
| sdk / `components/esp_http_server/src/httpd_parse.c` | 42937 → 42937 | `db7fbbb322bccb4a21bc1607208a6bb7d1f4c0d7ecc3299de10c9e60edaa943b` |
|
||||
| sdk / `components/esp_https_server/src/https_server.c` | 15257 → 15459 | `a2a5ca0549fbe8d1ddd7f9647a48a31fdd6329b997e1550ab69d6a10efecff0d` |
|
||||
| sdk / `components/freertos/FreeRTOS-Kernel/include/freertos/task.h` | 133072 → 133108 | `8b908b964d2c87377838762478253eec04312b985e6bb680bacd3f03ab253897` |
|
||||
| sdk / `components/mbedtls/mbedtls/library/ssl_tls.c` | 329921 → 336963 | `0154e70f20b465213d3f97a9c2b75e686d79ee83592f90e1d7e7d995593ca7e1` |
|
||||
| sdk / `components/mbedtls/mbedtls/library/x509_create.c` | 19803 → 19934 | `55edce5b8fcb039a404b84ea830f06d018128b155dfbf0d74d26b17247b546c6` |
|
||||
| sdk / `package.json` | 536 → 536 | `230c52993499adf9f64d1d6477495ea46c3f14d63022bd52081858373098da68` |
|
||||
| sdk / `version.txt` | 5 → 5 | `b473c8e2ed91b38d7e96e54d4ce094474ca6015c0641b7cdfc0ab94b1f8b4668` |
|
||||
| toolchain / `package.json` | 472 → 472 | `bdd3b852d051d6513912e71d29851bd04b800e2d33d78aec48067af5d83da5c9` |
|
||||
|
||||
Semantic notice review: five changed implementation files retain byte-identical
|
||||
complete opening notices at their existing ranges (ESP-TLS `[0,122)`, HTTPD
|
||||
`[0,124)`, HTTPS `[0,123)`, Mbed TLS shared TLS `[0,223)` and X.509 `[0,169)`).
|
||||
Their output hashes stay unchanged; full-source hashes must change even when
|
||||
only implementation bytes change. This does **not** approve the implementation
|
||||
changes or establish compatibility of the project's security overlays.
|
||||
FreeRTOS `task.h` retains its complete MIT notice at `[0,1455)`; only
|
||||
`SPDX-FileContributor: 2023-2024` becomes `2023-2025` within that excerpt.
|
||||
Its output hash changes from
|
||||
`8e3d9f79bbbdf6dfd6fbf132982a7ec3a45ff6dac92277034316efae4cccad84` to
|
||||
`e53c9bcefd4327c713696e870a3568a27cedf8833467b9cd9536cb2e09ab7ad8`.
|
||||
The remaining `task.h` changes correct stack-watermark documentation to bytes.
|
||||
The two package JSON diffs change only versions; SDK `version.txt` changes only
|
||||
`5.5.0` to `5.5.3`.
|
||||
|
||||
All 24 remaining SDK inputs and three Xtensa license inputs match the old pins,
|
||||
including SDK/radio Apache texts, both Newlib documents, mixed argtable3,
|
||||
wpa_supplicant and GCC exception/GPL texts. An auxiliary installed-tree filename
|
||||
comparison found the same 45 SDK files whose basenames start with LICENSE,
|
||||
COPYING or NOTICE (case-insensitive), with no additions/removals. All 85 files
|
||||
under Xtensa `share/licenses/` have identical relative paths and hashes. This
|
||||
finite discovery check is not an exhaustive attribution or linked-object audit.
|
||||
|
||||
Validation after the catalog edit: **36/36 notice fixture tests PASS** via
|
||||
`python3 -B tests/release_notices/run.py`; two fresh temporary actual bundles
|
||||
using the candidate roots above and the current project passed assembly,
|
||||
per-payload manifest SHA-256/size checks, exact file-list checks, and identical
|
||||
relative names/bytes across outputs. Each has **77 files / 4,433,930 bytes**
|
||||
(the unchanged total size does not imply unchanged contents). Both manifest
|
||||
SHA-256 values are
|
||||
`1fd0a69b82dc2632bab4ab6dda33675e7229c8d341c7fafb7158c1e8f2456a68`.
|
||||
Temporary bundles were removed after comparison. Project entries and managed
|
||||
snapshot pins were also asserted equal to the pre-migration Git catalog.
|
||||
|
||||
These results are **notice assembly evidence only**, not legal clearance,
|
||||
corresponding-source delivery, radio-blob exception approval, vulnerability
|
||||
closure, firmware build validation or target acceptance. Existing pinned project
|
||||
provenance retains historical baseline wording; this addendum distinguishes the
|
||||
new SDK notice snapshot without silently rewriting/re-pinning that evidence.
|
||||
All separate distribution gates below remain open.
|
||||
|
||||
## Separate work before distribution
|
||||
|
||||
1. Resolve or obtain qualified review of radio-blob corresponding-source or
|
||||
|
||||
Reference in New Issue
Block a user